ISO 13485 clause 7.2: review requirements and capability before accepting an order

Establish what you are committing to before accepting an order

A repeat order for the same medical-device model does not necessarily carry the same supply conditions.
Quantity and the delivery date may look familiar while the installation site, post-delivery support or necessary user training has changed.
Checking stock and transport alone can leave a gap between what the customer expects and what the organization has prepared to provide.

ISO 13485:2016 clause 7.2 addresses customer-related processes.
The central point here is to identify the requirements, review the ability to meet them, and then commit to supply.
FDA's public MDSAP Audit Approach also calls for reviewing customer and purchase-order requirements before making that commitment.[1][2]

The previous article on clause 7.1 connected product-realization processes, resources and assessment activities.
This article focuses on agreeing the conditions of a particular order and establishing whether the organization can fulfil them.
The two clauses interact, but an updated development schedule does not replace an order review.

Three clauses, three distinct questions

This table is an original explanation, not a prescribed form.
The clauses do not describe three activities performed only once.
Communication may reveal a new condition that requires requirements and the review to be revisited.
Communication with regulatory authorities is also addressed according to applicable requirements.[3]

A fictional order: the same product, with installation and training requested

Imagine an organization receiving an order request for an existing medical-device model.
The first email states quantity and a requested delivery date.
The person handling it checks inventory and transport and is ready to accept.

Further clarification reveals that the customer plans to use the product at a new location and expects installation and user training as part of the supply.
The earlier quotation covered product delivery.
The immediate issue is not redesigning the device.
It is identifying the difference between the quotation and the request, then reviewing whether the new conditions can be fulfilled.

Installation and training are customer requests in this fictional example.
They are not presented as identical on-site obligations for every medical device.
Training needed for specified performance and safe use must also be considered in light of the product, whether or not the customer expressly asks for it.

7.2.1: determine more than what appears on the order

Requirement determination includes customer requirements for delivery and post-delivery activities.
Conditions needed for a known intended or specified use may matter even when the customer has not written them down.
Applicable regulation, training needed for specified performance and safe use, and additional requirements established by the organization also need attention.[3]

In the example, the team can clarify what the customer means by installation.
Positioning the device and performing the connections and settings needed for its use may involve different preparations.
The users, functions and materials involved in training also affect the scope.
Appropriate installation activities and training duration depend on the product; no universal value is invented here.

Where the customer has not provided a documented statement of requirements, those requirements need confirmation before acceptance.
A confirmation email or an order-condition record can help implement this.
Neither a particular form nor a separate customer signature for every order is presented as mandatory.
The objective is a clear understanding of what was requested and what will be supplied.

7.2.2: resolve differences and establish the ability to fulfil the requirements

The review precedes the commitment to supply.
It addresses defined and documented product requirements, differences from earlier proposals or contracts, and applicable regulatory requirements.
Necessary user training must be available or planned to be available, and the organization must have the ability to meet the defined requirements.
Review results and resulting actions need to be recorded.[2][3]

For the fictional order, acknowledging the training request is not enough.
The organization needs to assess whether suitable personnel and materials can be provided when required and whether the necessary installation conditions can be met.
Forwarding a request to a colleague is different from concluding that the request can be fulfilled.

If installation cannot be provided on the requested date, the team can review a workable alternative and discuss the supply conditions with the customer.
An agreement cannot waive applicable regulation or conditions necessary for safe use.
Accepting first and leaving unresolved conditions to be sorted out later undermines the purpose and timing of the review.

7.2.3: connect the reply with changes and feedback

The final reply in the fictional conversation explains the reviewed scope and timing so that both parties work from the same conditions.
Clause 7.2.3 extends beyond this reply.
It covers planned and documented arrangements for product information, enquiries, contracts and orders including amendments, customer feedback including complaints, and advisory notices.
Communication with regulatory authorities follows applicable regulatory requirements.[3]

If the customer later changes the location or the training audience, the relevant requirements may change too.
Review the effect on the ability to supply, amend the relevant documents and make affected personnel aware of the changed requirements.
A revised customer email does not, by itself, update an installation team still working from the old schedule.

A useful record for one order

The customer request, differences from the earlier proposal, review outcome, resulting actions and final supply conditions can be linked in a record.
The following is MedQraft's implementation suggestion, not a table specified by the standard.

An order record that only identifies who received it does not explain why the organization concluded it could meet the request.
Link the clarified requirements to the review outcome and the conditions communicated to the customer.
Acceptance should rest on an assessment of the ability to fulfil defined conditions, not merely on receipt of a request.

Sources and scope

1. ISO 13485:2016, official publication information.
   Third edition, 2016; the official page identifies review and confirmation in 2025 and current status.
2. FDA MDSAP Audit Approach, MDSAP AU P0002.009, August 6, 2024.
   Production and Service Controls, Task 25 supports review of customer requirements before commitment to supply.
3. Korean National Law Information Center: public medical-device GMP review criteria, Annex 2, clause 7.2. The public Korean provisions were used as a cross-check for requirement determination, review and communication.
   Korean requirements and the international standard are separate documents; this article is not a comparison of complete national regulatory obligations.

Checked October 26, 2026.
This is an original practical explanation based on official public material and the clause structure, not a reproduction or official translation of the full ISO standard.
Historical US regulatory citations in the MDSAP document are not used to describe current US law.
All scenarios, tables and diagrams are original fictional explanations.

Related reading

• ISO 13485 clause 7.1: planning product realization
• Intended purpose, operating principle and performance