MedQraft
← All insights
QMS / ISO 13485

ISO 13485 7.3.3 design inputs: define use, performance and safety requirements

Turn a vague goal such as a fast, accurate thermometer into assessable design inputs.
A fictional example connects use conditions, performance, safety, evidence and review under clause 7.3.3.

Last regulatory review: 2026-10-28 Rev. 1.0 9 min read

Define the conditions the design must satisfy

Before developing the detailed design, turn the intended use and the necessary function, performance, usability and safety into requirements that can be assessed.
“Fast and accurate” expresses an ambition.
It does not tell a designer or evaluator what result is acceptable, under which conditions, or why that result is appropriate.

This article addresses ISO 13485:2016 clause 7.3.3, design and development inputs.
Our preceding article on clause 7.3.2 connected development activities with responsibilities.
Here the focus is the required properties and behavior of the product.
Information from product realization planning under 7.1 and customer-related processes under 7.2 can contribute to those inputs.

The official MDSAP audit approach links clause 7.3.3 with establishing, reviewing and approving inputs, including intended use, functional, performance and safety requirements, applicable regulatory requirements and risk management results.
It also examines completeness, clarity, consistency and verifiability.[1] The thermometer example and document arrangements below are MedQraft's practical illustrations.

A broad product goal is connected to use context and developed into functional, performance and safety requirements
Figure 1.
Translate an aspiration into conditions and requirements.
“Fast” alone does not define the timing conditions or an acceptance criterion.

Fictional example: a fast, accurate home thermometer

Imagine a team considering an electronic thermometer for a caregiver to measure a child's temperature at home.
Its first draft says only “measure quickly and accurately.”
One developer may focus on measurement time while another reader thinks about the number of displayed digits.
They are giving different meanings to the same instruction.

The team first defines the intended user and patient population, measurement site and method, and use environment.
Calling the device an electronic thermometer does not determine whether it is contact or non-contact, or which site it measures.
Filling in a convenient accuracy or time value before establishing that context can fix an inappropriate target.

No actual measurement range, permissible error or time limit is prescribed here.
The table identifies decisions and evidence needed to complete requirements.
An unresolved numerical field is not an approved, complete design input.

Starting phrase Context to establish Content to specify Illustrative assessment approach
Suitable for home use User, patient population, measurement site and method, environment Measurement and reading tasks to be supported under those conditions Use-scenario analysis and appropriate user evaluation
Accurate Measurement range, reference comparison conditions, environmental range Performance criteria and permissible error under defined conditions Performance evaluation using suitable reference methods
Fast Definitions of measurement start, completion and readiness Permitted time to completion under the stated conditions Timing with consistent start and end conditions
Avoid misleading the user Foreseeable invalid measurements and associated harm Risk controls to prevent an invalid measurement being mistaken for a normal result Evaluation of specified error conditions and user recognition and response

The final row is a possible risk-control requirement for this fictional product.
It is not a universal requirement for every thermometer to use the same error detection or display.
The relevant technology and risk analysis determine which conditions can be detected and which response is appropriate.

Collect evidence beyond a customer request

A customer request alone is unlikely to cover every relevant input.
The following original guide organizes information to consider when applying clause 7.3.3; it is not a reproduction of an ISO table or a prescribed form.

Information to examine Question for the fictional thermometer team
Function, performance, usability and safety for the intended use Who measures whose temperature, at which site, under which conditions, and with what required result?
Applicable regulations and standards Which requirements apply to the target markets and device method, and which editions and conditions were reviewed?
Risk management outputs Which product requirements implement the controls identified through risk analysis?
Relevant information from previous similar designs Which earlier use problems or complaints also matter for this product?
Other essential conditions Are compatibility, maintenance, storage or other product-specific needs missing?

An earlier model's specification is evidence to assess, not an automatic answer for the new device.
A different user, measurement method or environment can change whether earlier test conditions and controls remain appropriate.
Similarly, a list of standard titles is more useful when it identifies the particular requirements and conditions that influence the design inputs.

Connect each requirement to conditions and a basis

MedQraft suggests linking a requirement identifier, requirement statement, applicable conditions, source or rationale, assessment approach and review status.
Those field names are a practical suggestion, not mandatory ISO column headings.
Their purpose is to make the origin of a requirement and the basis for judging it traceable.

For example, “measurement time must be short” has no start or end point.
Timing from power-on and timing from the start of measurement can produce different results.
Review the relevant requirements and intended use, establish the criterion, and make its conditions available in the requirement or a linked document.

An assessable requirement does not always need a number.
Required behavior in a defined state, information to be provided, and completion of a user task can also be specified clearly and evaluated appropriately.
Words such as “convenient,” “sufficient” or “if possible,” without further definition, invite evaluators to apply different criteria.

One requirement linked to use conditions, source and risk rationale, and an assessment approach
Figure 2.
Connect the statement with its conditions, basis and assessment approach.
The record arrangement is illustrative; actual methods and acceptance criteria need product-specific evidence.

Considering how a requirement can be assessed at the input stage does not replace subsequent detailed verification and validation planning.
Clause 7.3.6 addresses whether design outputs meet input requirements; clause 7.3.7 addresses suitability for the specified application or intended use.
A single performance test should not be assumed to answer every usability and safety question.

Distinguish a required outcome from an implementation idea

“The caregiver can recognize that measurement is complete” and “place a particular colored LED on the front panel” describe different levels of information.
Clarifying the required function and use conditions first allows the team to evaluate possible implementations, such as visual or audible feedback, against that need.

This does not prohibit technical constraints in the inputs.
A contract, interface compatibility requirement or regulatory condition may constrain structure or components.
Record that constraint and its basis where applicable.
The point is to avoid turning an unsupported early idea into a mandatory requirement by accident.

Resolve ambiguity and conflict before approval

Suppose the fictional team records both “completion must be audible” and “the device must make no sound during use.”
Without conditions, those statements conflict.
Determine which users and environments need which feedback, distinguish the conditions or adjust the requirement, and retain the rationale.
Approving both statements unchanged leaves the implementation team to choose between them.

Review whether the inputs are sufficiently complete, have a clear meaning, are consistent with one another and can be assessed.
Track unresolved conditions, the evidence or action needed to resolve them, and their implications for related design work.
A “to be decided” field should not be treated as a completed input.

Draft inputs reviewed for gaps, ambiguity, conflict and assessability, including resolution of open items before approval
Figure 3.
Review establishes whether the inputs are a usable design basis.
This original diagram includes resolution of open items in the review before approval.

Inputs are not necessarily written once and then frozen forever.
When use conditions or risk analysis change, assess the effects on related requirements, design and assessment activities, and apply the organization's change procedures.
The central point of clause 7.3.3 here is to establish, review and approve clear product requirements with the conditions and evidence needed to support them.

Sources and scope

  1. MDSAP Audit Approach, MDSAP AU P0002.011, revised 3 August 2026.
    Chapter 5, Tasks 5 and 6 on inputs and their review, and Tasks 7 and 10 on outputs, verification and validation.
    Official document page.
  2. ISO 13485:2016 official publication information.
    Third edition, 2016, shown as current after confirmation in 2025.

Checked 28 October 2026.
This is a public-source explanation, not a reproduction or official translation of the standard.
The thermometer, record arrangements and review questions are fictional examples and practical suggestions.
Determine numerical criteria and applicable regulations and standards for the actual target markets, intended use and device characteristics.

Related reading

Continue through ISO 13485 clauses

Compare clause purposes and supporting evidence

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement