Developing and manufacturing a medical device has an added layer of complexity that most innovators don’t need to worry about. The regulations and compliance requirements in life sciences (whether they are medical or pharma) are a massive undertaking. This is on top of actually creating the products themselves…which isn’t exactly easy. These rules are there for a reason, as the consequences of sending out bad products into the market are often life-threatening. often life-threatening.
Key Takeaways:
- Verification confirms a device meets its design specifications. Validation confirms it meets user needs in its intended use conditions.
- In regulated markets, V&V is mandatory. The US now runs it under the QMSR (effective February 2, 2026), and the EU under Regulation (EU) 2017/745 (MDR), while most countries across Asia have their own framework.
- Process validation applies whenever a manufacturing result cannot be fully verified by later inspection or test, as with sterilization or molding.
What Makes V&V Different for Medical Devices?
Outside regulated industries, a company decides for itself how much verification and validation is enough. In life sciences, you don’t have a choice, because a regulator decides for you.
In the United States, medical device quality systems were falling under 21 CFR Part 820. As of February 2, 2026, that regulation is the Quality Management System Regulation (QMSR), which incorporates the international standard ISO 13485:2016 by reference. This aligned the FDA framework with the system most other regulators already use.
In the European Union, manufacturers work under Regulation (EU) 2017/745, the Medical Device Regulation (MDR), in force since May 26, 2021. The MDR requires verification and validation evidence inside the technical documentation submitted for CE marking.
Both frameworks rest on the same quality management backbone, ISO 13485, and both treat V&V as documented, auditable evidence rather than internal confidence. The practical consequence is that every V&V activity has to be planned, justified, and recorded in a way an auditor can follow.
What is Process Validation for a Medical Device?
There are two distinct V&V questions in medtech. Design V&V asks whether the device itself is right. Process validation, on the other hand, asks a different question: does the manufacturing process reliably produce that device, unit after unit?
The FDA defines it under 21 CFR 820.75 as establishing, through objective evidence, that a process consistently yields a result meeting its predetermined specifications. ISO 13485:2016 sets the same expectation in clause 7.5.6.
If you cannot fully verify the output of a step by a subsequent inspection or test, you must validate the process that produced it.
Some results can be checked on every unit, like the length of a bone screw measured with calipers. Others cannot be checked without destroying the product or at a prohibitive cost. Sterilization, injection molding, welding, aseptic filling and sterile barrier sealing are the classic examples. You cannot confirm a sealed package's integrity on every unit without destroying it, so the process that delivers it has to be validated instead.
How Does the Medical Device Validation Process Work?
A reliable V&V effort needs a backbone, and in regulated industries that backbone is the GAMP 5 V-model. It pairs every requirement on the way down with the activity that will prove it on the way up. The left side descends from user requirements through design to implementation at the base of the V. The right side climbs back up through verification and validation of what was built. Read across the V, and each specification meets the activity that proves it.
Requirements and Test Planning
Everything starts with capturing what the device has to do. User requirements describe the need. System and functional requirements translate that need into specifications the engineering team can build to. Each requirement is written as a controlled document, and each one is paired at the same moment with the test that will later prove it. That pairing is carried in a traceability matrix, so any requirement can be followed from capture to the activity that validates it.
You plan how you will prove a requirement before you build towards it. Each plan takes concrete form as a validation protocol, the approved and auditable document you later execute and record against. What a protocol actually contains is shown further down.
Device Design and Build
Once requirements are set, the team moves into system architecture, design specifications, and implementation. In design controls terms, this is where design outputs are created to meet the design inputs set above them. Every input needs a matching output, and every output needs to be traceable back to the input that justified it.
That evidence lives in the Design and Development File (Formerly called the Design History File (DHF)), the record an FDA investigator can ask to see. Every decision made at this stage is what the later phases will hold to account.
Verification and Acceptance
Verification starts once components are built. Module verification confirms each built component matches its specification, then system verification confirms the integrated product does the same. Every verification addresses just one question, is the device built right. The instruments are calibrated and traceable, the criteria are numeric, and the evidence is logged against each unit.
Verification is where most engineering teams feel at home. It is a specification-to-output comparison. Its output is a pass or a fail against a number that was written down beforehand.
Validate Against Intended Use
Validation asks the question verification cannot: was the right device built. The system validation acceptance test confirms the device does what its users need it to do, in its intended use environment... not just what its specification says.
For a device used by patients or clinicians, that also means proving use-related risk has been controlled. Summative usability testing under IEC 62366 has become the standard way to demonstrate this, and in the European Union the MDR ties validation to a documented clinical evaluation that supports the intended use claims.
Qualify the Manufacturing Process
Validating the device is one thing. Proving the process that makes it, unit after unit, is another. Once the design is validated, the manufacturing process is qualified inside the manufacturer's quality system through the IQ, OQ, and PQ sequence.
- Installation Qualification confirms the equipment is installed to specification.
- Operational Qualification challenges it across its full operating range, worst case included.
- Performance Qualification demonstrates that under normal production conditions the process consistently produces acceptable devices.
This is process validation made concrete: you validate a manufacturing process by qualifying the equipment that runs it, and IQ, OQ, and PQ are how that gets done.
Where Test Fits In
A medical device V&V effort rarely runs on the device alone. Behind it sits a test and production system that runs the checks, records the evidence, and feeds the traceability an auditor will follow. That test system has its own development lifecycle, and it has to be proven before the device it handles can be trusted.
A medical device test system built to GAMP 5 mirrors the device's own path. It starts from user requirements, moves through system and functional requirements, design specifications, and implementation, then climbs back through internal verification and two stages of formal acceptance. If outsourced, the Factory Acceptance Test (FAT) proves it against its specification at the builder's facility, before shipment. The Site Acceptance Test (SAT) repeats that proof once the system is installed in its real production environment.
From SAT, responsibility hands off to the product manufacturer, who runs IQ, OQ, and PQ on the accepted system as part of their own quality system. The regulatory payoff sits at the end of the chain: a notified body audit or FDA conformity review of the technical file and QMS, then registration in the relevant databases, GUDID in the United States and EUDAMED, carrying the device's UDI-DI, in the European Union, with other national UDI systems as applicable.
When done properly, a test system built this way shortens that path because the requirements, design, verification, and acceptance evidence are already documentation an auditor recognises.
Continued Process Verification
Validation does not end at launch. Once the process is qualified and running, data from routine production is tracked to confirm it stays in a state of control. Statistical monitoring through indicators like process capability (Cpk) and acceptance sampling (AQL) catches drift before it becomes a defect. Any significant change to equipment or materials, handled through change control and an impact assessment, can trigger revalidation. That same data feeds the post-market surveillance and vigilance reporting regulators expect once the device is on the market.
The Three-Batch Rule: Requirement or Myth?
For a long time, process qualification often meant running three consecutive good batches, treated as proof a process was validated. Ian Fleming's Goldfinger gave us the line that "once is happenstance, twice is coincidence, three times is enemy action", which is a good one, and you rarely want to argue with Goldfinger! The FDA itself once leaned the same way: the preamble to its 1996 Quality System Regulation called three production runs the accepted standard. It has since changed its tune. In its CGMP questions and answers, the agency states that neither its regulations nor its policy set a minimum number of validation batches, and acknowledges that the three-batch idea spread partly because of its own past guidance. That answer is written for drugs, but device guidance lands in the same place: the GHTF process validation guidance which the FDA's device center points to, sets no fixed number and asks for enough runs to show results are meaningful and consistent. Three batches can still be the answer, as long as it is a reasoned one.
Medical Device Validation Protocol Example
To make the protocol concrete, take a sterilization step, one of the processes you cannot verify by inspecting the finished unit. You cannot open a sealed sterile device to confirm the cycle worked without destroying it, so the process itself has to carry the proof.
Run against ISO 17665 for moist-heat sterilization, a protocol would typically spell out:
- The objective and the target sterility assurance level, usually a SAL of 10⁻⁶ for a terminally sterilized device, meaning no more than one non-sterile unit in a million.
- The load configurations and cycle parameters to be qualified, including temperature, pressure, exposure time, and dwell.
- The physical qualification studies, from chamber temperature and pressure distribution to heat penetration into the actual load.
- The microbiological qualification, using biological indicators seeded with a resistant spore and placed at the hardest points of the load to reach.
- The sampling plan and the number of qualification runs that establish confidence.
- The acceptance criteria, including the biological indicator results that count as a pass.
- Who executes the runs and who signs off on the review and approval, with a record that ties the result back to the process.
When the runs execute, the process either meets those predefined criteria or it does not, and the evidence goes on file either way, ready for an auditor.
How Averna Approaches Medical Device V&V
V&V only delivers value when the test architecture behind it is calibrated and traceable, and repeatable across the line. That’s why the test system itself must be qualified to the same standard as the devices it checks. Averna Powered by Spherea designs and builds that infrastructure for regulated production testing, from feasibility and design for testability through to functional and end-of-line systems, with the data and traceability that qualification and audit demand. That work extends to pharma packaging inspection and broader life sciences test expertise.
If your program needs a test system a regulator will accept, our engineers can help scope the next step.
You may also be interested in…
Looking for other ways to improve product quality and accelerate medical manufacturing? Check out this 30-minute webinar!
Get in touch with our experts or navigate through our resource center.
