ISO 13485 and the FDA's Quality Management System Regulation (QMSR) require a medical device manufacturer to document how each device is produced: where the components came from, how they were inspected, how many were issued to the production lot, how they were assembled, and how the assemblies were inspected and tested.
Those records, the device history record and the traceability behind it, are how a manufacturer demonstrates that a device was built to its specifications. This article explains what those records are, what the standards require, and how a contract manufacturer maintains them from incoming receiving inspection through shipment.
What the records must contain
Behind each lot of finished devices is a set of controlled records. Together they allow the manufacturer to reconstruct how that lot was produced.
- Device history record (DHR). The production record for each batch or lot, showing that the device was manufactured according to its documented requirements. The DHR is the central production record. The term originates in FDA's former Quality System Regulation, and the same record-keeping is now required through ISO 13485, which the FDA's Quality Management System Regulation (QMSR) adopted on February 2, 2026.
- Component traceability. Material certifications and incoming lot numbers link each finished unit to the specific components and raw materials used to build it.
- Process records. Travelers or work orders document the processes performed in production and who performed them.
- Inspection records. Incoming, in-process, and final lot-release inspection results record what was checked and the result.
- Identification. Lot and batch numbers, equipment and calibration references, and operator identification make each step attributable.
ISO 13485 requires the control of these records (Clause 4.2.5) and traceability of the product (Clause 7.5.9). Together, they are what medical device quality documentation consists of.
What traceability is for
Traceability is the ability to establish the origin, usage, and location of a device and the components it was built from. Under ISO 13485, that ability serves three specific functions.
- Reconstruction. The full production history of any unit can be rebuilt from the records.
- Containment. If a nonconformity is identified in a lot, traceability establishes exactly which units and which components are affected.
- Evidence of conformance. The records demonstrate that each required step was performed and met specification.
These functions apply inside the facility, before a device is released.
What makes a record complete
A complete record is specific rather than a summary. For a single production run it typically includes component and material certifications, receiving inspection records, process travelers referencing the processes used, in-process and lot-release inspection results, equipment calibration and maintenance references, operator identification, and the documented lot release.
On a long-running project, the production record for a single run can run to hundreds of pages. That level of detail is the difference between asserting that a lot was built correctly and being able to show it, step by step.
Record controls under ISO 13485
Record-keeping is one requirement of a medical device quality management system, and records have to be created and controlled as the work is performed. ISO 13485 Clause 4.2.5, control of records, requires each record to remain legible, identifiable, and retrievable, with defined controls for storage, protection, and retention.
In practice, an operator records each activity as it is completed, and lot numbers are captured as the material is issued. Records reconstructed after the fact do not meet this requirement. This is what medical device quality documentation looks like in operation, and it is the basis on which medical device compliance is demonstrated.
Who reviews the records
The records exist first for the customer's own quality organization. The working relationship between a spec developer or legal manufacturer (the Customer) and its contract manufacturer depends on them. The Customer reviews the records to confirm each lot was built to specification, to support product release, and to oversee how its device is being produced. Because the Customer is the legal manufacturer of the device, the DHR is how it meets its own regulatory responsibility. The contract manufacturer's records therefore have to be as thorough as if the Customer had produced the device itself.
The same records support other reviews. An independent certification body examines DHRs during regular compliance reviews to confirm the quality system operates as documented, and during an acquisition, the acquiring company's due-diligence team reviews production records as part of assessing the operation. In each case the requirement is the same: the records must be accurate, complete, and demonstrate conformance to specification and the QMS.
Records and traceability at A&M BioMedical
A&M BioMedical provides medical device contract manufacturing services. We build devices to our customers' specifications and maintain the production and quality records for the work we perform. Document control and traceability operate under one ISO 13485 quality management system: a device history record for each lot, component-level traceability, processes validated through IQ, OQ, and PQ, and a documented lot inspection and release before shipment. Because receiving, assembly, inspection, and fulfillment are performed under one quality system, the records are maintained continuously rather than handed between suppliers.
We have held ISO 13485 certification since 2009 and operate a Class 7 cleanroom, with more than 30 years of manufacturing experience. As a contract manufacturer, we do not design or market our own devices; the records we maintain belong to the customer.
The record is how conformance is shown
Under ISO 13485 and the QMSR, records and traceability are how a manufacturer demonstrates that each device meets its requirements, and they are what the customer relies on. Kept complete and created as the work happens, they let both the manufacturer and its customer account for how any unit was built.
Frequently Asked Questions
What is a device history record (DHR)?
A device history record (DHR) is the production record for a specific batch or lot: the components used, the processes and inspections performed and by whom, and the lot identification. It is the record that demonstrates the device was built according to its documented requirements. The term comes from FDA's former Quality System Regulation; the same record-keeping is now required through ISO 13485, which the FDA's Quality Management System Regulation (QMSR) adopted on February 2, 2026.
How long do medical device manufacturing records have to be kept?
As of February 2, 2026, the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485 into 21 CFR Part 820, so retention follows ISO 13485's Clause 4.2.5: records are retained for at least the lifetime of the device as defined by the manufacturer, and in no case less than two years from the date the device is released. The exact retention period depends on the device and the manufacturer's procedures.
If we outsource production, do the records stay with us or with the contract manufacturer?
The contract manufacturer maintains the production records for the work it performs, and the Customer has access to them. The Customer is the legal manufacturer, so the records must meet the same requirements as if the device had been built in-house. A contract manufacturer builds the record to the customer's specification and keeps it available to them.
