A sterility assurance level is a probability, not a promise

A sterile device is not one that has been proven sterile. It is one that went through a process validated to make survival of a microorganism vanishingly unlikely. The distinction sounds like pedantry until an auditor asks how you know a given lot is sterile, and the honest answer is that you never tested it — you validated the process that made it, and released the lot on the strength of that validation. A sterility assurance file that reads as if it proves each unit sterile is describing something that cannot be done. What it can prove is a probability, and that is the whole game.

Terminal sterilization — sterilizing the device in its final packaging, after assembly — is governed by method-specific international standards: ISO 11135 for ethylene oxide, ISO 11137 for radiation, and ISO 17665 for moist heat. They differ in mechanism, but they share a target, and the target is not sterility. It is a sterility assurance level.

You cannot test your way to sterile

A sterility test is destructive: to know whether a unit is sterile, you have to culture it, which consumes it. Testing an entire lot for sterility would leave nothing to sell, and testing a sample tells you only about the sample, with a sensitivity too coarse to catch the rare survivor that matters. Sterility is not a property you can inspect into a finished lot — which is exactly why sterilization sits among the processes that have to be validated rather than inspected. The validation is the evidence; the released product is never the test article.

The number is 10⁻⁶, and it is a probability

A sterility assurance level of 10⁻⁶ means the probability that any single unit carries a viable microorganism is no greater than one in a million. It is not a guarantee that every unit is sterile; it is a bound on how often one might not be. That framing is what makes the whole discipline honest. The claim on the label is not “this is sterile” in the sense of certainty — it is “this was produced by a process demonstrated to hold the survival probability at or below one in a million.” For devices with direct contact with compromised tissue or the bloodstream, 10⁻⁶ is the expected level; less demanding contact can justify a higher probability, but the reasoning always runs through a number, not an absolute.

The validation qualifies the process, not the lot

Each standard has its own route to the number, and each starts from the actual microbial burden on the product. Moist-heat and ethylene-oxide validations commonly use an overkill or half-cycle approach: demonstrate lethality at conditions well beyond what the natural bioburden requires, so the margin itself carries the assurance. Radiation validation runs the other way, setting or verifying a sterilizing dose against the measured bioburden and confirming it with dose audits over time. All of them lean on biological indicators — deliberately resistant spore populations placed in the hardest-to-reach location in the load — because a process that kills the resistant challenge in the worst position kills the real bioburden everywhere easier. What the validation qualifies is the cycle and the load configuration. The specific lot inherits the assurance from the process it passed through, not from a test performed on it.

The number is not a one-time claim

A validation is a snapshot of a process under defined inputs, and the inputs drift. Bioburden rises when a supplier changes a raw material or a cleanroom loosens; a packaging change alters how sterilant reaches the device; a load pattern shifts when production scales. So the assurance level is a claim that has to be maintained, not banked: routine cycle monitoring, biological-indicator trending, periodic requalification, and a change-control gate that asks of every process change whether it touches the basis of the sterilization claim. This is the same discipline that keeps contamination control proportionate to risk rather than performed for its own sake — the control exists to protect a specific claim, and when the claim's basis moves, the control has to be re-earned.

What the file has to show

A sterility assurance file that stands up names the method and its governing standard, states the SAL it claims and why that level fits the device's contact, ties the validated cycle parameters to that SAL, and shows the requalification cadence that keeps the claim current. It never asserts that the product was tested sterile, because it wasn't. A sterilization-validation summary structured to make those elements explicit — method, standard, SAL, cycle basis, requalification — is previewed in the launch catalog. If your team maintains this differently, the shelf takes that correction directly.