How does document automation fit ISO 13485 records control?
Updated October 2026 · By Scott Thompson, Founder
The short answer
ISO 13485 clause 4.2.5 requires quality records to be identifiable, protected, retrievable, retained, and disposed of under control, with changes to a record remaining identifiable; clause 4.1.6 requires software used in the quality system to be validated for its use. DynamoDocs keeps every record with its original file, a tamper-evident history of every change, a retention date, and role-based access, and documents each control with automated tests to support your validation. The same applies to the records clauses of ISO 9001, AS9100, and IATF 16949.
Clause 4.2.5, control of records
Identification: each document carries its own ID, type, and source. Storage and protection: access is limited by role, and the history is append-only in the database itself. Integrity: the history is hash-chained, so an altered entry shows. Retrieval: any record, archived ones included, can be found and printed as an inspection copy. Retention: each record carries a retention date; set it to the longer of your device lifetime and your regulatory minimum. Changes remain identifiable: every edit keeps the value before and after, with who and when.
Clause 4.1.6, validating the software
ISO 13485 expects a documented, risk-based validation of software used in quality processes, before first use and after changes. DynamoDocs supplies what that validation needs from the vendor: a description of each control and the named automated tests that prove it, run on every release. The validation for your intended use, and its revalidation after updates, is yours.
Purchasing records (clause 7.4)
Purchase orders, supplier confirmations, and receiving documents are purchasing records under clause 7.4. With separation of duties on, the person who enters or changes an order cannot also release it, and with signatures on, each release is signed. Supplier scorecards built from those documents can feed supplier evaluation.
AS9100, IATF 16949, and ISO 9001
Clause 7.5.3 of ISO 9001, and of AS9100 and IATF 16949 that build on it, asks for the same things for documented information: protected, retrievable, retained, with changes controlled. The controls above apply unchanged.
Related questions
Is DynamoDocs ISO 13485 certified?
No. ISO 13485 certifies a manufacturer's quality management system, not a vendor's software. DynamoDocs provides controls and validation evidence that fit inside your certified system.
Can the retention period match our device lifetime?
Yes. Retention is set per customer in years; records are never deleted by the application, so the retention date marks when disposal may be considered, not when it happens.
Go deeper
See it on your documents
Bring a real invoice, PO, or RFQ and watch DynamoDocs take it from inbox to posted in your ERP in about 30 minutes.
More answers