For either ISO 9001 or ISO 13485
Twenty-five pages covering the whole of ISO 13485:2016 Clause 7.2 — determination of requirements, review prior to commitment, and communication arrangements. Written for device organisations as a filled-in worked example, not adapted from a quality base.
Since 2 February 2026, this is a regulatory document. The FDA Quality Management System Regulation incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For US-marketed devices, your customer-related processes procedure is the operative form of a federal requirement, and the records it generates are inspectable.
01
Clause 7.2.1(d) requires you to determine any training needed to ensure specified performance and safe use, and 7.2.2(d) requires confirming at review that it is available or planned. There is no ISO 9001 equivalent, so it is absent from most procedures adapted from a quality base. It matters beyond compliance: where a risk control is implemented through the user rather than through the design, the training is the risk control. Supply without it and the control is not in place.
02
ISO 13485 has no equivalent to ISO 9001's contingency clause. For device manufacturers the obligation arises from law instead — which is precisely why it is missing from so many quality systems. No clause checklist points at it. This procedure covers both regimes: FD&C Act Section 506J in the United States, and EU MDR and IVDR Article 10a.
03
The arrangement for issuing an advisory notice is a communication requirement of the clause, not something to work out during the event. Appendix B logs it alongside customer communication and complaints, so the route exists before you need it.
Every appendix, form and worked example is part of the document. Nothing is sold separately.
Quality and regulatory managers at device manufacturers, contract manufacturers and specification developers certified or certifying to ISO 13485. Particularly useful for organisations whose customer-related processes procedure was adapted from an ISO 9001 base, which is where the training and reporting obligations usually go missing.
Not sure yet? The free Sales Management Maturity Check has a device path that adds the requirements with no ISO 9001 equivalent. Under five minutes, and your score appears without entering anything.
Both, deliberately. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set. You are editing a working document rather than filling in a hollow outline.
Yes. Since 2 February 2026 the FDA Quality Management System Regulation incorporates ISO 13485:2016 by reference into 21 CFR Part 820. The procedure is written on that basis, and the cross-reference maps obligations across both the standard and the regulation.
Because the clause numbers do not map and the obligations differ. ISO 13485 predates the harmonised ten-clause structure, and it carries requirements with no ISO 9001 counterpart — user training determination and advisory notices among them. Adapting a quality procedure is how those requirements go missing in the first place.
Editable Microsoft Word (.docx). Adapt it, rebrand it, and adopt it into your own document control system. The licence permits the buying organisation to use it across its own sites and issue it to employees, contractors and auditors, and permits consultants to adapt it for engagements they deliver.
A procedure does not pass an inspection; an organisation does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record. Conformity is demonstrated by implementation and evidence. Unfilled placeholders are unmet requirements, so fill them.
Take the integrated ISO 9001 and ISO 13485 version instead. It covers both standards in one document with device-scope content marked throughout, and includes a decision record naming every point where the two standards diverge.
