Verification and validation: what MDR Annex II Section 6, ISO 13485 Clause 7.3 and the QMSR since February 2, 2026 require as evidence

Anyone building verification and validation evidence for a medical device or a GMP process works against three texts that count differently. The MDR says what the technical documentation must contain. ISO 13485:2016 says which steps the quality management system must provide and gives them numbers. The FDA's QMSR has said since February 2, 2026 that this very standard is binding law in the United States, and it has removed the agency's own version of the requirements. For drug manufacturers, Annex 15 of the EU GMP Guide comes on top. This article places the texts side by side and names the reference for every duty.

What the MDR wants to see in the technical documentation

Two sections of Annex II carry the V&V evidence. Section 4 requires, for every applicable general safety and performance requirement, "a justification, validation and verification of the solutions adopted to meet those requirements" and, under point (d), "the precise identity of the controlled documents offering evidence of conformity", with "a cross-reference to the location of such evidence within the full technical documentation". That is the traceability a notified body checks: from the requirement through the method to the controlled document and its location.

Section 6 is headed "Product verification and validation" and requires "the results and critical analyses of all verifications and validation tests and/or studies". Section 6.1(b) names the content: "detailed information regarding test design, complete test or study protocols, methods of data analysis", in particular on biocompatibility "including the identification of all materials in direct or indirect contact with the patient or user", on physical, chemical and microbiological characterization, on electrical safety and EMC, on stability including shelf life, and on performance and safety. For software the requirement is the most detailed: "evidence of the validation of the software, as used in the finished device", with the results of all testing "performed both in-house and in a simulated or actual user environment prior to final release", across all hardware configurations and operating systems. Where no new testing has been undertaken, the documentation needs a rationale; the MDR gives biocompatibility testing on identical materials of a previous version of the device as the example.

Two further provisions belong here. Annex I Section 17.2 requires software to be developed taking into account the principles "of development life cycle, risk management, including information security, verification and validation". Annex II Section 6.2(e) requires, for devices placed on the market in a sterile condition, the validation reports on packaging, sterilization and maintenance of sterility, addressing "bioburden testing, pyrogen testing and, if applicable, testing for sterilant residues". The IVDR carries the same heading in its Annex II Section 6, there as product verification and validation structured by specimen types, accuracy, analytical sensitivity and specificity.

On the quality management side, Annex IX Section 2.2(c) requires a description of "the procedures and techniques for monitoring, verifying, validating and controlling the design of the devices" together with the resulting data and records, point (d) the manufacturing techniques, in particular the procedures and methods used for sterilization, and point (e) "the appropriate tests and trials which are to be carried out before, during and after manufacture", with calibration of the test equipment that is adequately traceable.

What ISO 13485:2016 numbers

The standard is not freely accessible, but its structure is. The table of contents of DIN EN ISO 13485:2021-12 lists under 7.3 "Design and development" the clauses 7.3.3 "Design and development inputs", 7.3.4 "Design and development outputs", 7.3.6 "Design and development verification", 7.3.7 "Design and development validation" and 7.3.10 "Design and development files"; under 7.5 stands 7.5.6 "Validation of processes for production and service provision", under 4.2 the clause 4.2.3 "Medical device file".

The structure carries two statements that have to be found again in a V&V plan. Verification and validation are separate clauses with their own numbers; a plan that provides for only one of the two stages departs from the structure of the standard before a single line of its text has been read. And process validation has its own place in 7.5.6, separate from design and development, just as the MDR in Annex IX Section 2.2 separates the design of the device in point (c) from the manufacturing techniques in point (d).

What the QMSR does differently since February 2, 2026

Since February 2, 2026, 21 CFR Part 820 carries the title Quality Management System Regulation. § 820.7 incorporates two documents by reference: ISO 9000:2015(E), Clause 3, for the terms in § 820.3, and ISO 13485:2016(E) for §§ 820.1, 820.3, 820.10, 820.35 and 820.45. § 820.10(a) requires a documented quality management system that complies with "the applicable requirements of ISO 13485"; paragraph (c) requires manufacturers of class II and class III devices and of the listed class I devices, among them all "Devices automated with computer software", to comply with "Design and Development, Clause 7.3 and its Subclauses in ISO 13485". § 820.1(b) provides that where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act, the Act controls, and § 820.10(e) names the consequence of a failure: the device is "adulterated" under section 501(h).

For V&V evidence this means three things. The former QSR subsections in which design verification, design validation and process validation stood with their own definitions, the previous §§ 820.30 and 820.75, have been superseded; the QMSR lists §§ 820.20 to 820.30 and § 820.40 as "Reserved", and Subparts C to O are empty. The terms design history file, device master record and device history record are no longer QMSR terms; § 820.3(b) speaks of the "medical device file (MDF)", and according to the FDA statement recorded in the register, records predating February 2, 2026 do not have to remove the old terms. And what the QMSR requires beyond the standard stands in § 820.35 for records, such as the UDI for each device or batch, and in § 820.45 for labeling and packaging, which must be examined "for accuracy prior to release or storage". A V&V plan for a device with a US market therefore cites the same numbers as a plan for the EU: 7.3.6, 7.3.7 and 7.5.6.

What Annex 15 requires for processes

Annex 15 has been in operation in its revised version since October 1, 2015. Its General section requires the scope and extent of qualification and validation to be "based on a justified and documented risk assessment", and says of retrospective validation: "Retrospective validation is no longer considered an acceptable approach." Points 1.4 and 1.5 require a validation master plan with policy, roles, the status of all facilities and processes, change control, "Guidance on developing acceptance criteria" and the strategy including requalification.

Point 3 describes the qualification stages: the user requirements specification as the "point of reference throughout the validation life cycle", design qualification with verification of the URS, FAT and SAT, installation qualification with checks against drawings and specifications, calibration and materials of construction, operational qualification with tests of the operating limits "and/or 'worst case' conditions", and performance qualification with production materials "with worst case batch sizes" across the operating range of the process. Point 5 governs process validation: under 5.3 prospective "wherever possible" before certification of the product, under 5.7 with a documented basis for why a parameter or attribute is critical. Point 5.19 leaves the number of batches to the manufacturer, who determines and justifies it under quality risk management; 5.20 names "a minimum of three consecutive batches manufactured under routine conditions" as generally acceptable. Point 5.22 defines the protocol content, from critical process parameters and quality attributes with acceptance criteria to analytical methods including method validation, in-process controls and the sampling plan. Points 5.28 to 5.32 require ongoing process verification across the lifecycle, and point 11.4 the evaluation of every planned change for its impact on "validation, regulatory status, calibration, maintenance"; that evaluation serves "to plan for any necessary process validation, verification or requalification efforts".

What follows for practice

Four points decide whether the evidence holds. First, the form of the technical documentation: Annex II Section 4(d) requires the cross-reference per requirement to the controlled document and its location, Section 6.1(b) the complete protocols and the method of data analysis; a report that only summarizes results meets neither. Second, the structure of the plan: verification under 7.3.6 against the design and development inputs under 7.3.3, validation under 7.3.7 against the intended purpose, process validation under 7.5.6 for processes whose resulting output cannot be, or is not, verified by subsequent monitoring or measurement. Third, the legal bases in the plan: where 21 CFR 820.30 or 820.75 are still cited, the applicable QMSR requirements and the corresponding clauses of ISO 13485 have to be applied: § 820.10(c) together with clause 7.3 for design controls, and § 820.10(a) together with clause 7.5.6 for process validation. Fourth, the batch logic: the number of validation batches is a justified decision under Annex 15 point 5.19, three is the lower end of what is usual, and the justification stands in the protocol before the first batch runs.

Entourage prepares V&V master plans, verification and validation protocols with end-to-end traceability and process validations with IQ, OQ and PQ in Verification & Validation and builds the design and development files under ISO 13485 Clause 7.3 in Design Controls.