Document control refers to the regulated handling of all documents that define a medical device manufacturer’s quality management system: creation, review, approval, distribution, change, identification of revision status, withdrawal, and archiving. ISO 13485 governs this in section 4.2.4 for documents and in section 4.2.5 for records, and requires a documented procedure for both. It is also indirectly required by law via Article 10(9) of Regulation (EU) 2017/745, which requires a quality management system with a concept for compliance with regulatory requirements and procedures for managing changes. The existing glossary entry “Quality Management System” describes document control as one component among several; this entry focuses on its specific requirements.
Approval, version control, and distribution
Each controlled document must be reviewed for suitability before use and approved by a defined function; the approval must be traceable by date and identity. The revision status must be clearly identified—typically via document number, revision level, and approval date—so that it is evident at every workplace whether the version at hand is the current one. Distribution must ensure that the current version is available where the described activity is performed, including outsourced processes and external manufacturing sites. When changes are made, the change must be reviewed and approved again; ISO 13485 requires that the assessment be performed either by the originally responsible function or by another authorized function with access to the relevant background information. The nature of the change and the current revision level must be evident from a change history or a document matrix.
Obsolete versions, external documents, and retention
Obsolete versions must be removed from use without delay or clearly marked as invalid so that they are not used unintentionally. At the same time, ISO 13485 requires that at least one copy of each obsolete document be retained for the specified period during which products were manufactured and tested, but at least for the lifetime of the product or the period specified by regulatory requirements. This is a prerequisite for being able to reconstruct a batch years later against the requirements that applied at the time. External documents such as standards, guidelines, supplier specifications, or software documentation must be identified, controlled in their distribution, and monitored for currency, as outdated versions of standards lead to compliance gaps. For records, section 4.2.5 additionally requires protection against unauthorized changes and ensuring legibility; retention periods are governed by Article 10(8) of Regulation (EU) 2017/745, with at least ten years, or fifteen years for implantable products.
Distinction from change control, technical documentation, and the Trial Master File
Document control governs the formal lifecycle of a document, whereas change control governs the substantive assessment of a planned change to a product or process, including its impact on risk management, validation, and conformity. The two interact, but are not identical: a correctly versioned instruction can contain an unassessed product change, and a carefully assessed change remains ineffective if the version is not distributed in a controlled manner. Document control as a process also differs from technical documentation under Annex II of Regulation (EU) 2017/745 as an outcome: the dossier is the object of control, not its rule set. Finally, it must be distinguished from the Trial Master File and requirements for study documentation, because these do not document manufacturer specifications but rather evidence of study conduct, with their own requirements for completeness and reconstructability.
Relevance for clinical trials
In clinical investigations of medical devices, the manufacturer’s document control directly affects the study. The clinical investigation plan, investigator’s brochure, instructions for use for the investigational product, handling and training materials, and data collection forms carry version identifiers that must be clearly identifiable at the investigational sites. If an instructions for use or handling instruction is changed during the course of the study, it must be documented when which site worked with which version and what training took place; otherwise, use errors cannot be clearly attributed.
In inspections and audits, this very interlinking is a frequent focus: alignment between the versions available at the investigational site and the approved status, traceability of changes, and completeness of distribution and training evidence. Full-service CROs such as Mediconomics support sponsors and manufacturers in tracking version statuses of study-relevant documents across sites, maintaining audit-ready distribution and training records, and ensuring consistency between manufacturer specifications and study documentation.
Frequently Asked Questions (FAQ)
Do obsolete documents have to be destroyed?
No—on the contrary. They must be removed from use or marked as invalid; however, at least one copy must be retained for the specified period in order to be able to retrospectively demonstrate manufacturing and testing status.
Does document control also apply to external standards?
Yes. External documents must be identified and their distribution controlled. In addition, it must be monitored whether new editions have been issued and what impact these have on evidence of conformity.
Are electronic systems permitted?
Yes, provided they are validated, clearly attribute approvals to an individual, log changes, and ensure document legibility throughout the entire retention period.
Regulatory References
- ISO 13485:2016, section 4.2.4 – Control of documents
- ISO 13485:2016, section 4.2.5 – Control of records
- ISO 13485:2016, sections 4.2.1 to 4.2.3 and 7.3.9 – Documentation requirements, medical device file, change control
- Regulation (EU) 2017/745, Article 10(8) and (9) – Retention and quality management system
- Regulation (EU) 2017/745, Annex IX sections 2.2 and 2.4 – Assessment and changes to the quality management system
