Training Management for Medical Devices: ISO 13485, FDA QMSR, and Effective Competency Systems

Training Management Is Not Optional — It Is a Regulated Activity

In medical device manufacturing, training is not a human resources perk — it is a quality system requirement with direct regulatory consequences. ISO 13485:2016 Clause 6.2 dedicates an entire sub-clause to competence, training, and awareness. FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485 by reference, making these training requirements enforceable FDA requirements. EU MDR 2017/745 requires that personnel involved in device manufacturing and quality activities have the necessary qualifications and training.

When FDA investigators arrive at your facility under Compliance Program 7382.850, they will request training records for specific employees who performed regulated activities. If those records are incomplete, missing effectiveness evaluations, or show that training was completed after the work was performed, you have a finding. Training management failures consistently appear in FDA Warning Letters and 483 observations.

This guide covers everything you need to build, operate, and audit a training management system that satisfies global regulatory requirements and genuinely ensures personnel competency.

What the Regulations Require

ISO 13485:2016 Clause 6.2 — Competence, Training, and Awareness

ISO 13485 Clause 6.2 contains five explicit requirements, each of which must be addressed:

a) Determine necessary competence: The organization must identify what competence is required for each role performing work affecting product quality. This means defining, for every position, the knowledge, skills, and abilities needed to perform the job correctly.

b) Provide training or other actions: Where gaps exist between required competence and actual competence, the organization must provide training or take other actions (mentoring, supervised practice, external courses) to close those gaps.

c) Evaluate effectiveness: Training actions must be evaluated for effectiveness. This is the requirement that most organizations struggle with, and it is the one auditors scrutinize most closely. Simply recording that training occurred is not sufficient — you must demonstrate that the training achieved its objective.

d) Ensure awareness: Personnel must understand the relevance and importance of their activities and how they contribute to quality objectives. This goes beyond task-level training to include quality culture and systems thinking.

e) Maintain records: Records of education, training, skills, and experience must be maintained per Clause 4.2.5.

A critical note in the standard states: "The methodology used to check effectiveness is proportionate to the risk associated with the work for which the training or other action is being provided." This means your effectiveness evaluation should be scaled — rigorous for high-risk activities, simpler for low-risk activities.

FDA QMSR — Training Requirements

With the QMSR effective February 2, 2026, FDA's training expectations now align with ISO 13485. Key QMSR training requirements include:

• Documented procedures: Manufacturers must establish and maintain procedures to ensure personnel performing work impacting quality are competent
• Training on current processes: Employees must be trained on the specific tasks they perform, including manufacturing, quality control, and design processes
• Training updates: Training must be kept current as processes, work instructions, or risk management protocols evolve
• Objective evidence: Manufacturers must maintain training records demonstrating that employees were trained before performing work impacting product quality
• Assessment and competence: The QMSR aligns closely with ISO 13485's expectation that training effectiveness and employee competence must be evaluated, not merely tracked

EU MDR 2017/745 — Training Expectations

EU MDR does not have a dedicated training clause equivalent to ISO 13485 Clause 6.2, but training requirements are embedded throughout:

• Article 10(8): Manufacturers must ensure staff have the requisite expertise
• Article 15: The Person Responsible for Regulatory Compliance (PRRC) must have specific qualifications
• Annex I GSPR: Personnel involved in design, production, and testing must be qualified
• Notified Body expectations: Auditors evaluate training as part of QMS assessments

Comparison of Training Requirements Across Frameworks

Building a Training Management System

Step 1: Define Competence Requirements

Start by creating a competence matrix that maps every role in your organization to the knowledge, skills, and abilities required. This is the foundation — without defined competence requirements, you cannot identify gaps, deliver targeted training, or evaluate effectiveness.

Competence Matrix Structure:

For each competence requirement, define:

• Initial qualification: What training, education, or experience qualifies a person to begin the role
• Ongoing maintenance: What continuing training or requalification is needed
• Requalification triggers: What events require retraining (procedure changes, quality events, extended absence)

Step 2: Establish the Training Procedure

Your training procedure (typically SOP-QA-006 or equivalent) should address:

Scope and purpose: Which personnel and activities are covered

Competence assessment: How competence requirements are defined and maintained for each role

Training delivery methods: Approved methods for delivering training:

Training triggers: Events that require new or refresher training:

• New employee onboarding
• New or revised SOPs, work instructions, or forms
• Process or equipment changes
• Quality events (CAPA findings, complaints, nonconformances)
• Regulatory changes
• Periodic refresher (typically annual or biennial)
• Return from extended leave
• Transfer to a new role or function

Documented training plan: For each employee or role, a plan that lists all required training items, due dates, and completion status.

Step 3: Implement Effectiveness Evaluation

This is where most medical device companies fall short. Recording that training occurred is necessary but not sufficient. You must also evaluate whether the training was effective — did the trainee actually learn and can they apply the knowledge or skill?

ISO 13485 Note to Clause 6.2 states that effectiveness evaluation methodology should be proportionate to risk. This creates a tiered approach:

Tier 1 — High-Risk Training (Direct impact on product quality or patient safety):

• Sterilization process operation
• Final product release and acceptance
• aseptic manufacturing operations
• Complaint handling and MDR reporting
• Design control activities
• Software validation

Effectiveness evaluation methods for Tier 1:

Tier 2 — Medium-Risk Training (Indirect impact on product quality):

• Document control procedures
• Internal audit methodology
• Supplier qualification
• Change control process
• Equipment calibration

Effectiveness evaluation methods for Tier 2:

• Written quiz (minimum passing score required)
• Case study exercise with review by trainer
• Practical exercise with documented results

Tier 3 — Low-Risk Training (Administrative or awareness-level):

• General quality policy awareness
• Company orientation
• General safety training
• Awareness of regulatory changes

Effectiveness evaluation methods for Tier 3:

• Read-and-understand with acknowledgment signature
• Brief verbal confirmation
• Completion certificate

Step 4: Maintain Training Records

Training records must be maintained per ISO 13485 Clause 4.2.5 (Control of Records). Records should include:

For each training event:

For each employee's training profile:

• Complete training history
• Current competence status for each required skill/SOP
• Overdue training items
• Upcoming training requirements
• Qualifications and certifications with expiration dates

Record retention must be at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements — whichever is longer.

Electronic Training Management Systems

Managing training records in paper binders or spreadsheet files quickly becomes unsustainable for any organization with more than a few dozen employees. Electronic training management — either as a module within an eQMS or as a standalone system — offers significant advantages.

Key Features to Evaluate

Implementation Considerations

If you are implementing an electronic training management system, validate it according to FDA's Computer Software Assurance (CSA) guidance (September 2025 final). The system is quality system software, so CSA applies. Key validation considerations:

• Intended use: Define exactly how you will use the system (training assignment, tracking, effectiveness evaluation, reporting)
• Risk assessment: Training management is typically not high process risk for most functions, but features like automatic training assignment based on document changes should be evaluated carefully
• Vendor assessment: Evaluate the vendor's QMS, SDLC practices, and validation documentation
• Part 11 compliance: If the system uses electronic signatures for training acknowledgment, ensure Part 11 requirements are met

Training and Document Control: The Critical Link

One of the most common audit findings is a disconnect between document control and training management. When an SOP is revised, all personnel who perform the activities described in that SOP must be trained on the revision before performing the activity. This sounds straightforward but creates several practical challenges:

Challenge 1 — Who needs retraining? Not everyone who was ever trained on the SOP needs retraining on every revision. The change impact assessment should determine which changes require retraining and for which roles. Minor editorial corrections may not require retraining; changes to acceptance criteria or process parameters almost certainly do.

Challenge 2 — Timing Personnel cannot perform activities under a revised procedure until they have been trained. This means you need a system that prevents untrained personnel from using the new revision — or at minimum, a process to verify training status before task performance.

Challenge 3 — Multiple sites If your QMS covers multiple sites, training on revised procedures must be completed at all sites before the revision takes effect. Consider a phased rollout approach with documented training completion milestones.

Best practice: Use your document control system's change notification workflow to automatically generate training tasks for affected personnel when a document is revised. This ensures that training is not missed and provides an audit trail linking the document change to the training event.

Common Audit Findings and How to Avoid Them

Finding 1: "No evidence of training effectiveness evaluation"

This is the most frequent training-related observation. The organization recorded that training occurred but did not evaluate whether it was effective.

Prevention: For every training event, document the effectiveness evaluation method used and the result. Use the tiered approach described above — high-risk training gets practical demonstrations or written exams; low-risk training gets acknowledgment signatures.

Finding 2: "Employee performed activity before training was completed"

Records show that an employee performed a regulated activity (e.g., final product release, complaint intake) on a date before their training on the applicable procedure was documented as complete.

Prevention: Implement a verification step before task performance — either through the eQMS (role-based access that requires completed training) or through a supervisory check.

Finding 3: "Training records do not reference the correct document revision"

The employee was trained on Rev C of a procedure, but Rev D is the current effective revision, and the employee has been performing activities under Rev D without retraining.

Prevention: Link training records to specific document revisions. When documents are revised, verify that all affected personnel have been retrained before the revision goes effective.

Finding 4: "No training on regulatory changes"

Significant regulatory changes (e.g., the transition from QSR to QMSR, new EU MDR requirements) were not accompanied by training for affected personnel.

Prevention: Include regulatory change impact assessments in your change control process. When a regulation changes, identify which roles are affected and create targeted training.

Finding 5: "Training procedure does not address effectiveness evaluation"

The organization's training SOP describes how training is delivered and recorded but does not describe how effectiveness is evaluated.

Prevention: Ensure your training procedure explicitly addresses effectiveness evaluation methods, the risk-based tiered approach, and the documentation requirements for evaluation results.

Training Metrics and KPIs

Effective training management includes measuring performance. Key metrics include:

Report these metrics to management review as part of the quality system performance data (ISO 13485 Clause 5.6 and Clause 8.2.3).

Comparison: Paper vs. Electronic Training Management

FAQ

Does every employee need training on every SOP? No. Training should be role-based. Only personnel who perform activities described in a specific SOP need training on that SOP. Use your competence matrix to determine which SOPs are required for each role.

How do we handle training for contractors and temporary workers? Contractors and temporary workers who perform work affecting product quality must meet the same competence and training requirements as permanent employees. Include contractor training requirements in your training procedure and maintain records for contractors just as you would for employees.

What is the difference between training and qualification? Training is the process of delivering knowledge or skills. Qualification is the outcome — demonstrating that the person has achieved the required competence. Training is one path to qualification; education, certification, and prior experience are others. Your records should document both the training activities and the resulting qualification status.

Can we use vendor-provided training to satisfy ISO 13485 requirements? Yes, vendor-provided training (e.g., from equipment manufacturers, software vendors, or training organizations) can be used as part of your training program. You should still evaluate the effectiveness of vendor-provided training, at least at the Tier 2 level.

How do we evaluate training effectiveness for "read-and-understand" acknowledgments? For low-risk document updates where read-and-understand is the delivery method, consider adding a brief quiz (even 3-5 questions) to verify comprehension. If you use simple acknowledgment without any knowledge check, reserve this only for the lowest-risk training items and document the risk rationale.

What happens if an employee fails an effectiveness evaluation? Document the failure. Provide remedial training using a different method. Re-evaluate effectiveness. If the employee repeatedly fails, escalate to management and consider whether the person is suited for the role. Do not allow the employee to perform the regulated activity until competence is verified.

Do we need to train on the quality manual itself? Awareness of the quality manual and quality policy is required (ISO 13485 Clause 6.2d). This can be accomplished through onboarding training, annual quality awareness sessions, or read-and-understand with acknowledgment. It does not require the same rigor as procedure-specific training.

How does training management connect to CAPA? When a CAPA investigation identifies inadequate training as a root cause, the corrective action should include specific training interventions. The CAPA system should track the training to completion and verify its effectiveness. Training-related CAPAs should be analyzed for trends — if the same training gap recurs, the training program itself may need revision.

What records must we retain when an employee leaves the organization? Training records for former employees must be retained for the same period as other quality records — at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements. This ensures that you can demonstrate that the person was competent at the time they performed regulated activities.

Can we use AI-based training systems in our QMS? AI-based training platforms (adaptive learning, AI-generated assessments, intelligent tutoring systems) can be used, but the system itself — as software used in your quality system — should be validated under FDA's CSA guidance. The training content and effectiveness evaluation still need to meet the same regulatory requirements as traditional methods.