Medical device traceability: reconstructing the complete genealogy of a lot
A lot ships to a customer. Six months later, a complaint comes in, or a supplier reports an anomaly. On that day, traceability is not judged by how much data you kept, but by how long it takes you to answer. Here is what the regulations expect, and what you need to put in place to keep that promise.
What do the regulations require?
Several texts overlap depending on your markets, and they differ in both legal nature and scope. Before comparing them, three words deserve a definition, as they are often used interchangeably.
- Backward traceability
- Starting from a delivered finished product and working back up the chain: which material lots, which components, which equipment and which operators went into making it. This is the direction of an investigation, when a complaint comes back from the field.
- Forward traceability
- Starting from an incoming lot, a material or a component, and working down: which finished products contain it, and where they were shipped. This is the direction of a recall, when a supplier reports an anomaly on a lot that has already been used.
- Audit trail
- A system-generated log of the events that affect a record (creation, modification, deletion), with the author and the date, in which a correction never erases the previous value. 21 CFR Part 11 sets specific requirements for the records within its scope.
| Framework | What it requires in practice |
|---|---|
| ISO 13485 | Define how far you trace and keep the records that prove it, lot by lot. The standard distinguishes general traceability from the stricter requirements for implantable devices. |
| MDR 2017/745 | Identify the economic operators in your supply chain (Article 25), apply the UDI system, keep the technical documentation (Article 10(8)). Regulatory traceability of the supply chain and internal production genealogy remain two distinct requirements. Note: these articles do not apply to IVDs, which are governed by the IVDR (2017/746). |
| 21 CFR Part 11 | For electronic records within FDA scope: secure audit trail, access control, data integrity, electronic signatures. The scope is determined by the records concerned, not merely by the fact that you sell in the United States. |
Operational summary: it replaces neither reading the texts nor the opinion of your regulatory affairs lead.
What should you do?
Compliance does not depend on the volume of data you keep, but on your ability to answer a question about a lot quickly and correctly. That comes down to a few requirements your organization has to meet, whatever tool it chooses.
- Link every consumption to an identified incoming lot, partial consumptions included.
- Navigate the whole chain in both directions, with no manual reconstruction and no intermediate export.
- Time-stamp every action with the identity of its author, so that no value can be silently overwritten by another.
- Link equipment and its metrology status to the production runs it served: if an instrument drifts, you must be able to find the lots concerned.
- Record deviations when they occur, with their justification, rather than reconstructing them from memory later.
- Keep the destination of shipped lots linked to the manufacturing data, so that a recall does not force you to cross-check two systems by hand.
Traceability you browse instead of reconstructing
Arianis links inventory, protocols, production runs, inspections and shipments in a single system. A lot's genealogy is therefore not a report you have to produce: it is a view you open.
- Backward and forward navigation across the whole life cycle of a lot, from raw material to customer.
- Immediate identification of the lots affected by a deviation, a faulty piece of equipment or a change of supplier.
- Time-stamped audit trail with the operator's identity on every action.
- Batch record exportable as PDF, native CSV exports: your data remains yours.
The Cerebellis software related to this topic
Further reading
Computerized system validation (CSV) according to GAMP 5
Software categories, V-model, risk analysis and traceability matrix: how GAMP 5 structures a risk-proportionate computerized system validation.
Software for regulated production: ISO 13485, MDR and 21 CFR Part 11
No software is "ISO 13485 certified": what the frameworks require concerns your records and a validation you remain responsible for.
A finding from notified bodies, critical consequences for MedTechs, a situation you can anticipate
A 2024 survey conducted for the European Commission shows that fewer than half of the files received by MDR notified bodies are complete on receipt, and a lack of traceability is a major cause.