ISO 13485 document control: a practical guide
What clause 4.2 actually asks for, the traps teams fall into, and how a controlled version model with approval and immutable snapshots meets it without the manual overhead.
What clause 4.2 expects
Document control in ISO 13485 lives in clause 4.2. In plain terms, controlled documents must be approved before use, reviewed and re-approved when they change, identified by revision status, available at the point of use, and protected so that obsolete versions are not used by mistake. Records, a related requirement, must be controlled and retained for a defined period.
Within clause 4.2, documentation requirements, clause 4.2.4 covers control of documents and clause 4.2.5 covers control of records.
In the United States, the FDA Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference since 2 February 2026, so the same clauses apply in an FDA inspection.
Where teams struggle
- Approval evidence lives in email, not with the document.
- Revision status is a filename convention, so obsolete versions circulate.
- There is no immutable record of exactly what was approved.
- Records are scattered, so retrieval for an audit is slow.
How to meet it without the overhead
A tool built for controlled documents removes most of this by construction. A published, draft, and fix version model keeps revision status unambiguous. Gated approval with electronic signatures keeps the sign-off with the document. An immutable PDF snapshot on publish is the exact record of what was approved. A change log makes every change attributable. Together, these turn document control from a manual discipline into something that produces its own evidence. See document control software and how it fits medical device teams.
Related guides
This guide is educational and does not certify any product or organisation.
Common questions
What does ISO 13485 require for document control?
ISO 13485 (clause 4.2.4 for documents, 4.2.5 for records) requires that documents be approved before use, reviewed and re-approved when changed, identified by revision, available where needed, and protected from unintended use of obsolete versions. Records must be controlled and retained.
Does document control apply to electronic documents?
Yes. The requirements are format-neutral. Electronic document control must still provide approval, revision identification, change control, and protection against use of obsolete versions.
How does software help with ISO 13485 document control?
A controlled version model, gated approval with e-signatures, a change log, and immutable snapshots produce the evidence clause 4.2 expects as a by-product of normal work. Traceable is built to support this. Certification depends on your quality system and your auditor, not on any tool.
Meet ISO 13485 document control by construction
Publish a controlled document with e-signatures and an immutable snapshot in minutes.