ISO 13485 requires you to keep quality records for at least the lifetime of the medical device, as you define it, and never for less than two years from the date the organization releases the product. If a regulation sets a longer period, the longer period wins. Since February 2, 2026, the FDA's Quality Management System Regulation (QMSR) has applied this standard to US manufacturers directly, so the rule now governs your FDA inspections as well as your certification audits.
This guide explains how to turn that sentence into a retention schedule you can defend: how to set the device lifetime, which records fall under it, where EU and UK rules differ, and how to prove records are still retrievable.
TL;DR
- The ISO 13485 floor is the device lifetime you define, and never less than two years from release. Regulatory requirements override it when they are longer.
- The QMSR took effect on February 2, 2026. It incorporates ISO 13485:2016 by reference, and internal audit, supplier audit and management review records are no longer shielded from FDA inspection.
- The two-year floor is a safety net, not a target. Justify your device lifetime in writing and record it in the Medical Device File.
- Electronic records must be validated, backed up and retrievable for the whole retention period. Test retrieval before an auditor does.
Table of Contents
- What ISO 13485 says about record retention
- What changed in the US on February 2, 2026
- How to define the "lifetime of the device"
- Which records the retention rule covers
- Outside the US: EU and UK periods
- Building a retention procedure that passes audit
- Electronic records: validation and retrieval
- Our perspective
- Keeping inspection records together with QA-Report
- A retention schedule starter you can adapt
- FAQ
- Sources
What ISO 13485 says about record retention
Clause 4.2.5 (control of records) asks for a documented procedure covering six things: identification, storage, protection, retrieval, retention time and disposition. The retention requirement is the lifetime of the medical device as defined by the organization, or whatever applicable regulations specify, whichever is longer. The same clause sets a minimum of two years from the date of product release.
Three points are easy to miss.
- The standard does not give you a number. You define the device lifetime, and an auditor will test whether your definition is reasonable.
- The period runs per device, not per document type. A training record for a technician who built an implant may need to outlive the technician's employment by decades.
- Records must stay legible, readily identifiable and retrievable for that whole period. Retention without retrieval does not meet the clause.
Note that the clause sets a floor and a method. It does not set a ceiling. Keeping records longer than needed is not a nonconformance, though it can carry cost and privacy exposure, so your procedure should state when and how records are disposed of.
What changed in the US on February 2, 2026
The FDA's revised Part 820 took effect on February 2, 2026. It replaced the former Quality System Regulation and its inspection techniques, and it incorporates ISO 13485:2016 by reference.
For record retention, this has three practical consequences.
- The retention rule is now ISO 13485's own. Under the old QSR, 21 CFR 820.180(b) required records to be kept for the design and expected life of the device, and never less than two years from commercial release. Under the QMSR, the same logic comes from clause 4.2.5, with section 820.35 adding FDA-specific content requirements, such as unique device identifiers in complaint records, according to a crosswalk of the two regulations.
- The old inspection carve-out is gone. The FDA now has authority to inspect records it previously excepted, including internal audit reports, supplier audit reports and management review records. Those records need the same retention discipline as a device history record.
- An ISO 13485 certificate is not a shield. The FDA says that manufacturers should not assume conformance to the standard exempts them from inspection, and that it assesses compliance with the QMSR on a risk basis. Third-party auditors work on a three-year certification cycle. The FDA does not.
Tracked devices carry an additional rule. Under 21 CFR 821.60, persons who must keep records under the tracking regulation keep them for the useful life of each tracked device they manufacture or distribute. If you make a tracked device, check whether that part applies to you in addition to the QMSR.
How to define the "lifetime of the device"
The lifetime is an organization-defined parameter. It is not simply the warranty period, and it belongs in your Medical Device File. Auditors look for a rational justification, and common supporting evidence includes shelf-life studies, component degradation and expected servicing intervals.
The range is wide. A single-use disposable with a short shelf life may have a lifetime of under two years, in which case the two-year floor applies. An implantable device may have a lifetime measured in decades. The mistake that causes trouble is defining the period too narrowly, which leads to premature disposal of records you will later need during a complaint investigation or recall.
A workable method:
- Start with the longest of: labeled shelf life, intended service life, and the longest expected servicing or reuse interval.
- Add the period during which units made in the last production lot remain in the field. A device made for ten years with a ten-year service life means records for the earliest units must last roughly twenty years after first release.
- Compare the result with every regulation that applies in your markets, and take the longest.
- Write the number and the reasoning into the Medical Device File, with a named owner and a review date.
Experts stress that the two-year figure is a safety net, not a target. Relying on it when the clinical life is longer is a reliable way to be cited in an audit or caught short in a recall.
Which records the retention rule covers
Clause 4.2.5 applies to every record the quality management system requires. In practice, group them by what drives their retention clock.
| Record group | Examples | What sets the clock |
|---|---|---|
| Product records | Device history records, inspection and test results, first article inspection reports, batch and serial traceability | Device lifetime, counted from release of each unit |
| Design records | Design and development files, verification and validation, design transfer | Device lifetime, from the last unit released |
| Post-market records | Complaints, servicing, adverse event reports, CAPA | Device lifetime; complaint records add UDI content under 820.35 |
| System records | Internal audits, supplier audits, management review | Defined in your procedure; now inspectable by the FDA |
| People and equipment | Training, calibration, maintenance | Tied to the products the person or equipment touched |
On the product side, the device history record is where most retention questions land. Our Device History Record guide covers what it should contain, and our Design History File article explains how to keep legacy files while closing QMSR gaps. If you are building the wider documentation set, the ISO 13485 documentation guide for quality managers walks through it clause by clause. Teams still working through design control expectations will also find this overview of FDA design controls useful.
Outside the US: EU and UK periods
If you ship to other markets, the longest applicable period governs the shared records.
- European Union: under EU MDR 2017/745, manufacturers are generally expected to retain technical documentation for at least 10 years after the last device has been placed on the market.
- United Kingdom: the Medical Devices (Northern Ireland Protocol) Regulations 2021 require a liquidator or trustee in bankruptcy of a manufacturer to retain specified conformity assessment documentation for the required period. That period is 15 years for implantable devices and 10 years for other devices, as summarized in our research.
These periods are counted from the last device placed on the market, not the first. For a long-running product, that makes them longer than they look. Confirm current periods with your notified body, UK Approved Body or regulatory counsel before you finalize a schedule that spans markets.
Building a retention procedure that passes audit
A frequent audit finding is the fragmented records procedure. Retention rules sit in the training SOP, the CAPA SOP and the design control SOP, each with different wording. ISO 13485 expects a single overarching procedure that covers the full lifecycle of a record.
Your procedure should define, for each record type:
- Identification: a document or case number, such as NCR-0179 for a nonconformance, that links the record to the product, lot or serial number.
- Storage: where it lives, in which system, and who has access.
- Protection: backup, access control, and protection against deterioration or loss.
- Retrieval: who retrieves it, how, and within what time.
- Retention: the period, the trigger that starts the clock, and the regulation behind it.
- Disposition: formal shredding or certified digital deletion, with a record that disposal happened and who approved it.
Link retention to the product, not the calendar. A rule such as "keep seven years" fails for long-life devices. A rule such as "device lifetime plus any regulatory minimum, counted from last release" holds up.
Electronic records: validation and retrieval
Moving from paper to a digital system does not mean scanning and shredding. The software, the migration process and the data integrity controls, such as backups and audit trails, must be validated to show that records remain legible, secure and retrievable for the full retention period. For the electronic record and signature side, see our guides on 21 CFR Part 11 evidence and electronic signatures in manufacturing.
Several risks are specific to long retention periods:
- File formats and viewers can disappear before the retention period ends. Plan for export and migration, and validate each migration.
- Backups that are never restored are unproven. Schedule restore tests.
- Measurement data is only useful with its context. Inspection results stored without the drawing revision, balloon numbers and gauge identification are hard to defend. A discussion of scan data integrity shows why the metadata matters as much as the measurements.
- Stored records should be reachable by the people who need them. The FDA expects records at the manufacturing site or a location reasonably accessible to responsible officials, and available for review and copying, according to FDA training material on the earlier regulation. Check how that expectation is carried into your QMSR procedures.
Run a retrieval drill
Many manufacturers treat "readily retrievable" as policy text. Auditors may expect a record in one to two hours, according to one QMS practitioner crosswalk. If your retrieval process means digging through an off-site warehouse, expect a citation. Put a drill in your internal audit schedule:
- Pick five records at random across product, design and system groups.
- Pick at least one that is older than five years.
- Time the retrieval from request to a legible copy.
- Log the result, and open a CAPA for anything that missed your target.
Our perspective
We build inspection software for manufacturers in aerospace, automotive and medical device production, and the retention problems we see are rarely about the number of years. They are about whether an inspection record can be connected, years later, to a drawing revision, a batch, a serial number and a measured result.
Broken traceability works like a broken chain: the links that survive are of no use if one in the middle is missing. That is why we think of retention as a data-structure question first. If your inspection results, ballooned drawings, batch records and route cards live in separate spreadsheets and folders, you can keep every file for thirty years and still fail a retrieval drill.
Three habits make the biggest difference in our experience:
- Keep the inspection report, the ballooned drawing and the measured values together as one record, tied to the part, batch and serial number.
- Decide the retention trigger when the product is released, not when someone asks for the record.
- Treat the retention schedule as a living document that follows the Medical Device File, so a change in device lifetime changes the schedule.
Regulated customers also ask where their data lives. That is why we offer both cloud and on-premise deployment for organizations with strict confidentiality requirements.
— Michael Chen
Keeping inspection records together with QA-Report
If your inspection and production records are scattered, a single system makes retention and retrieval easier to manage. QA-Report links ballooned drawing dimensions to measured results, flags out-of-tolerance values, imports CMM data, and tracks parts, batches and serial numbers, so a first article inspection report and its production history stay connected. It also provides a document vault, role-based permissions and report sharing.
Plans are published on the pricing page: Free at $0 per month, Basic at $49.99 per month and PRO at $149.99 per month. On-Premise and Enterprise Solutions are available without a published price. You can compare how inspection data tools differ in our guide to inspection data management software, and see how ERP and quality integration supports QMSR readiness.
Software does not replace your validation. You still need documented validation of any system that holds regulated records, and a retention schedule approved by your regulatory function.
A retention schedule starter you can adapt
Use this as a starting structure, then replace each entry with your own justified period.
- List every device family and its defined lifetime from the Medical Device File.
- For each record type, name the trigger: release of the unit, release of the last unit, or closure of the event.
- Add the longest applicable regulatory minimum for each market you serve.
- Assign an owner and a storage location to every record type.
- Define disposition and who approves it, and record each disposal.
- Review the schedule at least once a year and whenever a lifetime, market or regulation changes.
For wider practice, see our guides on inspection documentation and manufacturing QA.
FAQ
What is the minimum retention period under ISO 13485?
Records must be kept for at least the lifetime of the medical device as you define it, and not less than two years from the date the organization releases the product. If a regulation requires longer, follow the longer period. For many devices the lifetime far exceeds two years.
Does the FDA require the same retention period as ISO 13485?
Since February 2, 2026, the QMSR incorporates ISO 13485:2016 by reference, so the retention floor comes from clause 4.2.5. Under the previous 21 CFR 820.180(b), the rule was the design and expected life of the device and not less than two years from commercial release. The logic is the same, but your inspection exposure now includes audit and management review records.
Can I keep medical device records only in electronic form?
Yes, provided the system is validated. You need to show that records stay legible, secure and retrievable for the entire retention period, with backups, audit trails and a validated migration process. Run restore and retrieval tests to prove it.
Who decides what the device lifetime is?
Your organization does, and you must be able to justify it. Shelf-life data, component degradation and servicing intervals are typical evidence. Record the period and its rationale in the Medical Device File.
Sources
- ISO 13485 Clause 4.2, Documentation Requirements (NormGrid)
- FDA: Quality Management System Regulation, Frequently Asked Questions
- eCFR: 21 CFR 821.60, Retention of records
- Control of Records: Pre-QMSR 820.180 to ISO 13485 4.2.5 (Kelsey Quality)
- Managing Medical Device Records for ISO 13485 (Hardcore QMS)
- The Medical Devices (Northern Ireland Protocol) Regulations 2021
- FDA: Documents, Change Control and Records