"We don't manufacture. Why are we being asked about process validation?"

Clause 7.5 is called "Production and service provision". The name makes distributors switch off. That is a mistake, because several of its parts apply to anyone who handles devices.

Here is the clause in plain English:

• Control of production and service provision (7.5.1). Work happens under controlled conditions. That means current procedures and instructions, suitable equipment, monitoring and measuring in place, and labelling and packaging done as defined. You keep a record for each device or batch that shows quantity made and quantity released for distribution.
• Cleanliness, installation and servicing (7.5.2 to 7.5.4). Only if you clean devices, install them or service them.
• Sterile devices (7.5.5). Records of sterilisation parameters for each batch, if you make sterile devices.
• Validation of processes (7.5.6). Where you cannot fully check the result afterwards, you validate the process first. Think sealing, sterilisation, some software. The standard asks for criteria, equipment qualification, defined methods, revalidation rules and records. It doesn't use the words "IQ, OQ and PQ". Those are the common way of doing it: installation, operational and performance qualification.
• Sterilisation and sterile barrier validation (7.5.7). The same idea, with more detail.
• Identification (7.5.8). You can identify product throughout, and you know its status: received, on hold, released, rejected or returned.
• Traceability (7.5.9). A documented procedure that defines the extent of traceability, and records that let you trace a device or batch. For implantable devices, 7.5.9.2 goes further and names distributors directly: they keep distribution records that allow traceability and make them available for inspection.
• Customer property (7.5.10). Care of anything that belongs to your customer while you hold it.
• Preservation of product (7.5.11). Protect product from damage, deterioration and contamination during processing, storage, handling and distribution. Packaging, shipping containers, and any special storage conditions like temperature, all controlled and recorded.

So here is the honest summary for distributors and importers. Your part of 7.5 is mostly preservation (7.5.11), identification (7.5.8) and traceability (7.5.9). Add validation of any process you do run, such as a cold chain, a heat sealer for repacking or a warehouse system that controls stock status.

When something goes wrong with a device, the first question is always the same. Where did that batch go?

A recall, a field safety notice or a serious complaint all depend on one answer. If you can't say which customers received a given lot (call it lot 4471), you can't reach them. That is a patient safety problem, not a paperwork one.

Preservation matters for the same reason. A device stored outside its conditions may look fine and fail in use. Your storage records are the only proof it didn't.

1. Are production and service processes carried out under controlled conditions with current instructions?

What "we do this" sounds like: "Our warehouse team knows the process. They've been here for years."

What you could put on the table: Current, signed-off work instructions for receiving, storage, picking, packing and dispatch, at the point of use. Calibration records for the thermometers and data loggers you rely on. A record for each batch received and released.

2. Are special or critical processes validated (e.g. IQ/OQ/PQ) with records?

What "we do this" sounds like: "The cold room works. We've never had a problem."

What you could put on the table: A list of processes whose output you can't fully check afterwards. For each one, a validation record. Installation: the equipment is set up as specified. Operation: it performs across its range. Performance: it holds conditions under real loads, over time, including a full cold room on a hot day. Revalidation triggers written down.

3. Is product identification and traceability maintained through realisation, including lot/batch?

What "we do this" sounds like: "It's all in the system. We could find it."

What you could put on the table: A traceability procedure. Pick any lot number, and within minutes show who supplied it, when it arrived, where it was stored, and every customer it went to, with quantities. Stock status visible at a glance: on hold, released, quarantined, returned.

• A traceability procedure that names the records you keep
• Distribution records by lot or serial number, kept for your defined retention period
• Stock status identification: physical labels, locations or system flags
• Storage condition records, such as temperature and humidity logs, with alarms and responses
• Calibration records for monitoring equipment
• A list of processes that need validation, with a reason for each
• IQ, OQ and PQ records for each process on that list
• Revalidation triggers: equipment change, relocation, repeated alarms
• Current work instructions for receiving, storage and dispatch
• Records of how you handle customer property, if you hold any
• Validation of any software that controls stock status or traceability

These are patterns I see, not statistics.

"Not applicable" written across the whole clause. The company decides 7.5 is for manufacturers. Preservation and traceability get skipped along with everything else. Those are the parts that matter most for a distributor.

The cold room nobody validated. It has a thermometer and a logbook. It has never been mapped. Nobody knows whether the back corner runs 4 degrees warmer when the door opens 40 times a day.

Traceability that works one way. You can trace from customer back to lot. You can't go forward from lot to every customer in time to act. A recall needs the forward direction.

Logs without responses. The data logger alarmed on a Saturday. The log shows it. Nothing shows what anyone did about it, or what happened to the stock.

Software assumed to be right. The warehouse system decides what is released for picking. Nobody has checked it does that correctly. The standard expects software used in production and service to be validated for its use.

SAHPRA is rolling out mandatory ISO 13485:2016 certification in 5 phases, set out in its MD01 notice dated 18 September 2025. Phase 1, from 1 April 2025, asked licence holders to declare a certificate, with no evidence asked for. Phase 2, from 1 June 2025, covered renewals for manufacturers and distributors or importers. Phase 3, from 1 April 2026, covers companies already holding a certificate: they "will be requested to submit", and SAHPRA describes the requirement as mandatory. Phase 4 covers amendments from 1 June 2027. Phase 5 covers all new applications from 1 April 2028.

Distributors and importers are named in those phases. This is not a manufacturer-only exercise.

If you import electromedical products, you already make an annual submission of compliance information (ASOCI) to SAHPRA's Radiation Control unit.

An inspector's job is to see evidence, not intentions. "We could find it" is an intention. A lot traced to every customer, live, is evidence.

Under 60 minutes. Do this today:

1. Run a mock trace (20 minutes). Pick one lot you received in the last 6 months. Using only your records, list every customer who got it, with quantities and dates. Time yourself.
2. Check the numbers add up (10 minutes). Received, minus dispatched, minus stock on hand. Does it reach zero? If not, where did the difference go?
3. List your processes (20 minutes). Write down every process whose result you can't fully check afterwards: cold storage, sealing, any repacking, the system that controls stock status. Mark each one "validated, with records" or "not yet".
4. Pick one (10 minutes). Choose the highest-risk "not yet" item. For many distributors, that is cold storage. Book the work to validate it.

Your trace time and your "not yet" list are your starting point.