The obligation to establish installation instructions and test procedures, distribute them to installers, and document installation and test results carries forward from §820.170. The core requirement — devices must be correctly installed and the installation verified — is unchanged.
§7.5.3 adds two structural requirements absent from §820.170: explicit acceptance criteria for verification (not only instructions and test procedures); and a distinct provision obligation when customer agreements allow external-party installation — the organization must provide documented requirements to that party, not merely make a manual available. Record maintenance is now explicitly scoped to manufacturer/supplier-performed installations.
Auditors will test whether acceptance criteria are explicitly documented — not only instructions — and whether external-party installers have received documented verification requirements. They will sample installation records to confirm they are maintained as quality records per §4.2.5. Customer contracts permitting external installation will be examined for compliance with the provision obligation.
Maps to
QMSR / ISO 13485: §820.170 Installation.
ISO 13485: §7.5.3 Installation activities
Requirement text
The organization shall document requirements for medical device installation and acceptance criteria for verification of installation, as appropriate. If the agreed customer requirements allow installation of the medical device to be performed by an external party other than the organization or its supplier, the organization shall provide documented requirements for medical device installation and verification of installation. Records of medical device installation and verification of installation performed by the organization or its supplier shall be maintained (see 4.2.5).
Why this clause exists
Medical devices that require installation — imaging systems, laboratory analyzers, surgical robots, large patient monitoring systems, infusion pumps integrated into hospital infrastructure — can fail to perform as intended not because the device itself is defective but because installation was performed incorrectly or was not verified against defined criteria. ISO 13485 §7.5.3 addresses this failure mode by requiring that installation requirements and acceptance criteria be documented and, where external parties perform installation, be communicated to those parties in a form they can act on.
The two-scenario structure of §7.5.3 reflects the installation landscape for medical devices. In the first scenario, the manufacturer or its supplier performs installation — the default case. Here, documented requirements and acceptance criteria must exist, and records of both the installation and the verification must be maintained by the organization. In the second scenario, the agreed customer requirements allow an external party (not the manufacturer or its supplier, e.g., a hospital facilities team or third-party integrator) to perform installation. In this case, the organization's primary obligation is to provide the documented requirements — the installation manual, acceptance criteria, verification procedures — so that the external party has the specification they need to install and verify correctly.
The record-maintenance obligation in §7.5.3 applies specifically to installation and verification performed by the organization or its supplier. Where external parties perform installation, the organization is not required by §7.5.3 to maintain installation records for those installations (though other regulatory requirements and quality system obligations may apply). This scope limitation is intentional: the manufacturer can control and record what it or its suppliers do, but cannot mandate record systems for independent third parties.
What changed
§820.170 — Part 820 (legacy)
"(a) Each manufacturer of a device requiring installation shall establish and maintain adequate installation and inspection instructions, and where appropriate test procedures. Instructions and procedures shall include directions for ensuring proper installation so that the device will perform as intended after installation. The manufacturer shall distribute the instructions and procedures with the device or otherwise make them available to the person(s) installing the device. (b) The person installing the device shall ensure that the installation, inspection, and any required testing are performed in accordance with the manufacturer's instructions and procedures and shall document the inspection and any test results to demonstrate proper installation."
§7.5.3 — ISO 13485:2016 (current)
"The organization shall document requirements for medical device installation and acceptance criteria for verification of installation, as appropriate. If the agreed customer requirements allow installation of the medical device to be performed by an external party other than the organization or its supplier, the organization shall provide documented requirements for medical device installation and verification of installation. Records of medical device installation and verification of installation performed by the organization or its supplier shall be maintained (see 4.2.5)."
Common gaps (what we see in audits)
- Installation Instructions Exist But Acceptance Criteria Are Not Defined — The organization provides installation manuals with instructions for how to install the device but has not defined acceptance criteria specifying what a successful installation looks like — the measurable or observable standards against which installation verification is judged. ISO 13485 §7.5.3 requires documented acceptance criteria for verification, not merely instructions.
- No Documented Requirements Provided to External-Party Installers — Customer agreements allow installation by the customer's facilities team or a third-party integrator. The organization provides an installation manual but has not confirmed that it constitutes documented requirements for installation and verification of installation as required by §7.5.3. The manual may describe how to install without specifying the acceptance criteria the external party is required to verify.
- Installation Records Not Systematically Maintained — Installation activities are performed by the organization's field service team but records are not retained as quality records. Site-specific installation documentation may remain at the customer site or be maintained by the service team without integration into the quality records system. ISO 13485 §7.5.3 requires that records of installation and verification performed by the organization or its supplier be maintained.