MedQraft
← All insights
QMS / ISO 13485

ISO 13485 clause 7.1: what to plan before development begins

Connect product objectives and requirements with processes, resources, assessment activities, acceptance criteria, risk management and evidence records.

Last regulatory review: 2026-10-25 Rev. 1.0 8 min read

Turn a product concept into a workable plan

When a new medical-device concept is agreed, setting a prototype date alone can leave important work invisible.
Test facilities, material-handling conditions or specialist skills may only be discovered later.
Early planning connects what the product must achieve with the processes and resources needed to implement and assess it.

ISO 13485:2016 clause 7.1 concerns planning the processes needed for product realization, consistently with the other processes of the quality management system.
Its scope extends beyond the development schedule.
This article applies that perspective to a fictional project kickoff.
Clause 7.1 does not prescribe one universal first business activity or require every detailed specification to be frozen before an exploratory prototype can be built.[1][2]

The central connection is between objectives and requirements, processes and resources, assessment activities and acceptance criteria, and the records that will provide evidence.
Risk management informs that connection throughout.
The four groups below are an editorial explanation, not a reproduction of the standard or a mandatory form.

Objectives, processes and resources, checks and criteria, and records connected within product-realization planning, with risk management spanning them
Figure 1.
Four connected parts of planning.
This original concept diagram shows relationships to review together, not a once-through sequence.

1. Define quality objectives and product requirements

Imagine a team developing a portable measuring device.
“Accurate and easy to use” does not yet provide enough information to select a sensor or prepare a test.
The team needs to establish the intended measurement, purpose, environment and performance conditions.

A product requirement states a condition to be met.
A quality objective states a quality-related goal to be achieved.
Reducing both to “pass testing” obscures what the team is aiming for and what it will evaluate.
Numerical limits need a basis in intended use, applicable regulations and standards, risk and technical evidence.
No accuracy limit or universal acceptance value is invented here.

In the fictional kickoff, the team can start by describing the conditions under which the measurement must remain valid.
An unconfirmed environmental condition can be recorded as an open issue, with an owner and a date for obtaining the information needed by the next activity.
That management approach is MedQraft's practical suggestion.

2. Connect the processes, documents and resources

The team considers the processes needed to implement the requirements and the people and equipment needed to perform them.
Product-specific infrastructure and work-environment needs also belong in this review.
Having a development team does not, by itself, explain whether the necessary skills, space and facilities will be available.

If temperature could affect the fictional device, the team might consider facilities for reproducing relevant conditions, a suitable comparison method and the competence needed to conduct the work.
Where these cannot be provided internally, external capacity and preparation time can be investigated.
This example does not prescribe a particular temperature test for every measuring device.

The review also identifies which existing procedures apply and where additional product-specific instructions are needed.
Referencing the relevant controlled documents can be more useful than copying all procedures into one planning document.

3. Plan assessment activities with acceptance criteria

Clause 7.1 addresses the appropriate product-specific verification, validation, monitoring, measurement, inspection and test activities, together with product acceptance criteria.
This does not mean creating a new test for every term in that list.
Activities need to be selected for the product's requirements and risks, with a clear purpose for each.[2]

For the fictional device, “performance testing planned” leaves the method, conditions and decision unresolved.
The plan can connect the performance to be assessed with the proposed method, conditions and resources.
Detailed methods and values may be developed in subsequent design and test planning.
Acceptance criteria should not be chosen after seeing the results merely to obtain a favorable verdict.

A requirement connected to the method and conditions, acceptance criteria, and an evidence record
Figure 2.
Develop “testing planned” into a defined relationship between method, conditions, criteria and evidence.
No specific test or numerical limit is prescribed by this original diagram.
Planning question Fictional measuring-device entry
What is being assessed? Measurement performance under defined use conditions
How will it be assessed? Applicable method, comparison means and necessary equipment
What outcome is acceptable? Performance criteria and conditions supported by reviewed evidence
What will demonstrate the outcome? A record linking the sample, version, conditions, results and decision

This is an example planning aid.
Detailed verification and validation requirements must also be considered under the relevant clauses, including 7.3, and product-specific rules.

4. Connect risk management and records from the outset

Risk management is not a final checkbox added after planning.
Documented risk-management processes and maintained records support decisions throughout product realization.
Identified risks can influence the selected processes, resources and assessment activities.[2]

If an inaccurate measurement could affect a user's decision, the fictional team needs more than an entry reading “accuracy test.”
It can investigate conditions that could produce an inaccurate result and connect the findings with design responses and the activities needed to assess them.
No particular alarm or control is presented as a universal answer.

Planning also addresses the records needed to demonstrate that product-realization processes and the resulting product meet requirements.
A plan describes intended work; a record provides evidence of what was actually performed.
Preparing an empty test form is different from completing a test and recording its results.
At the planning stage, identify the records and their relationships; during execution, retain the actual evidence.

An open condition leads to an assigned follow-up and then an updated plan, with a return loop for new information
Figure 3.
A practical suggestion for turning an unresolved condition into follow-up work.
The loop represents reviewing the affected plan when new information becomes available.

Early planning does not mean fixing every detail immediately

An early plan contains both known conditions and questions still to be resolved.
The problem is not simply that something is undecided.
It is that an unresolved condition may disappear from the schedule and resource plan while still affecting the work.

Item Initial entry Follow-up connection
Use environment Initial assumptions about location and conditions Obtain use information and reflect it in the requirements
Measurement performance Needed performance scope and supporting references Review applicable conditions and develop numerical criteria
Processes and resources Expected fabrication, assembly and assessment activities Check internal capability and availability of external facilities
Risks and evidence Initial hazards and types of records needed Refine controls and assessment plans using the analysis results

Using owners and follow-up dates is MedQraft's implementation suggestion, not a requirement for this particular table format.
Planning outputs can be organized to suit the organization's operations.
Clearly linked existing documents may form part of that approach.

Distinguish clause 7.1 from clause 7.3.2

Clause 7.1 takes a product-realization perspective across the necessary processes and conditions.
Clause 7.3.2 focuses on planning design and development stages and controls.
A development kickoff is the setting used here to explain 7.1; it does not reduce the clause's scope to an R&D timetable.

The useful outcome of the fictional meeting is a visible connection: a product requirement has processes and resources beside it, followed by assessment activities, criteria and evidence records.
That connection is the purpose of filling in the planning board.

Sources and scope

  1. ISO 13485:2016, official publication information, third edition, 2016.
    ISO reports review and confirmation in 2025 and identifies this version as current.
  2. MDSAP Audit Approach, MDSAP AU P0002.009, published by FDA, August 6, 2024.
    Relevant discussion: risk-management planning under Management, product-realization planning under Production and Service Controls, and planning under Purchasing.

Checked October 25, 2026.
This practical explanation does not replace the standard.
The public MDSAP document supports the relationship between ISO requirements and operational activities; its historical US regulatory citations are not used here to describe current US law.
The measuring-device scenario, tables and diagrams are original fictional explanations, not actual performance data or certification evidence.

Related reading

Continue through ISO 13485 clauses

Compare clause purposes and supporting evidence

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement