§4.2.5 requires you to control your records — identify them, protect them, store them properly, and retain them for as long as required. Records are proof. Treat them accordingly.
We pulled three of our resident experts into one (virtual) room to tackle the five AI questions medical device manufacturers are wrestling with right now. There was banter. There were citations. Norma kept her composure.
§4.2.4 requires you to actually control your documents — not just own them. Norma explains what that means in practice, what changed from the 2003 version, and why ‘it’s in a shared drive somewhere’ is the document control equivalent of hiding under a blanket.
Section 820.7 is three short paragraphs, and most people skim right past it. Don’t. It’s the provision that turns ISO 13485:2016 from a helpful standard into a legal requirement — and it fundamentally changes how you read the entire QMSR.
The Medical Device File goes by many names — Technical File, Design History File, Device Master Record — but §4.2.3 has one clear message: for every device you make, there must be a file that proves you know what you’re doing. Norma explains what goes in it and why “it’s all in various folders” is not an answer.
The Quality Manual is one of those requirements that makes people either write 200 pages or one page of pure abstraction. Norma explains what §4.2.2 actually asks for — and how to get it right without losing your mind or your auditor.
Clause 4.2.1 establishes the documentation framework your entire QMS depends on. Here’s why ‘we know how to do it’ is not the same as ‘it’s documented’ — and why that distinction will matter enormously at your next audit.
Let’s be honest. When someone first hands you ISO 13485 and says “we need to comply with this,” you flip