Walk through almost any medical device facility and you’ll eventually find it: the piece of equipment with a handwritten sticky note that says “DO NOT USE — see Dave.” Nobody knows who Dave is anymore. Dave left in 2022. The machine has been quietly judging everyone ever since.
That sticky note is, in a roundabout way, what ISO 13485 §6.3 is about. The standard wants to know that your buildings, your equipment, and your supporting systems are actually up to the job of making a safe product — and that you have a plan for keeping them that way, rather than discovering problems the hard way when a batch goes sideways.
What §6.3 Actually Requires
Section 6.3 asks you to document the requirements for the infrastructure you need to achieve conforming product, prevent product mix-up, and ensure orderly handling of product. Note the verb: document. It’s not enough to have a building and some machines. You’re expected to define what infrastructure you need and why.
The standard spells out three categories of infrastructure, “as appropriate”:
- Buildings, workspace, and associated utilities — your facility, your layout, your power, water, compressed air, HVAC, and anything else the walls provide.
- Process equipment — both the hardware and the software. Yes, the validated spreadsheet counts. So does the firmware on that sealing machine.
- Supporting services — transport, communication, and information systems. The unglamorous plumbing that keeps everything moving.
Then comes the part the 2016 revision sharpened, and the part auditors love most. You must document the maintenance requirements — including the interval — whenever maintenance (or the lack of it) can affect product quality. And you must keep records of that maintenance. In other words: decide how often the thing needs servicing, write it down, do it on schedule, and prove you did.
Why “as appropriate” Is Not a Loophole
People love the phrase “as appropriate.” They read it as “optional.” It isn’t. It means you decide what’s relevant to your product and process — and then you justify that decision. If you make sterile implants, your cleanroom HVAC is extremely appropriate. If you assemble cable harnesses on a workbench, maybe less so. The standard trusts you to make the call. It does not trust you to skip the thinking.
What This Looks Like in Real Life
Doing §6.3 well is mostly about three boring, beautiful habits.
First, a maintenance schedule that’s real. Not a binder someone made for the last audit and hasn’t touched since. A living list of the equipment that affects product quality, the maintenance each piece needs, and how often. Calibration belongs to §7.6, but preventive maintenance — lubrication, filter changes, seal replacements, the works — lives here. The auditor will pick a machine, ask to see its schedule, and then ask to see the records proving you followed it. The gap between “what the schedule says” and “what the records show” is where findings are born.
Second, a facility that prevents mix-ups by design. This is the quiet phrase in §6.3 that people skim past: infrastructure must help prevent product mix-up and ensure orderly handling. That means clear segregation between quarantine, in-process, and released product. It means labeled storage, defined flow, and not having your nonconforming reject bin sitting cozily next to the finished-goods pallet because that’s where there happened to be room. Auditors notice a chaotic floor faster than they notice anything in your document system.
Third, control over the unsexy supporting systems. Your ERP, your label printer, the compressed air feeding your pneumatics — if it can affect product, it’s infrastructure, and it needs the same discipline. The 2016 standard explicitly pulled software into scope, so “it’s just the IT system” is not a reason to leave it unmanaged.
The most common ways companies trip over §6.3 are depressingly predictable: a maintenance schedule with no records to back it up, a “we do it when it breaks” approach to equipment that absolutely should be on a preventive plan, environmental conditions nobody monitors, and the eternal classic — equipment that’s been out of service for months with no documented decision about what that means for product already made on it.
The Bottom Line
Section 6.3 is short, but it’s quietly demanding. It asks you to treat your building and your machines as part of the quality system, not as background scenery. Define what infrastructure you need, maintain it on a schedule you actually wrote down, keep the records, and lay out your floor so product can’t wander into the wrong pile.
And please — find out who Dave was, fix the machine or formally retire it, and replace that sticky note with an actual record. Your future auditor, and your future self, will both thank you.