What a traceability procedure has to reach, and how much further for implants

A traceability procedure is often built as one generic promise: every unit carries a lot or serial number, and that number gets recorded at receipt, in process, and at shipment. ISO 13485:2016 Clause 7.5.9 doesn't ask for one promise at one depth — it splits the requirement in two, and the second half is stricter and more specific than most procedures built for the first half ever anticipate. Clause 7.5.9.1 requires a documented procedure for traceability, with the extent of that traceability and the records it requires defined by the organization, based on applicable regulatory requirements. Clause 7.5.9.2 doesn't leave that definition open at all once the device is implantable: it names, specifically, what has to be traceable and how far the chain has to reach. A procedure written once, for ordinary product, and applied unmodified to an implant line is running the wrong half of the clause.

General traceability is a definition exercise, not a fixed depth

Clause 7.5.9.1 doesn't tell an organization how far back to trace. It requires the organization to decide, document the decision, and base it on applicable regulatory requirements, then maintain whatever records that decision requires. A traceability SOP that states “lot-level traceability maintained” without stating why that depth was chosen, or which regulatory requirement it's satisfying, has skipped the documented determination the clause actually asks for — it has recorded a practice, not the reasoning behind it.

Implantable devices don't get to make that call

Clause 7.5.9.2 removes the organization's discretion for implants. It requires records identifying the components, materials, and work-environment conditions used in the device's manufacture, wherever any of these could cause the device not to meet its specified requirements, plus records that let the device be traced through distribution to the specific consignee — and it requires the organization to obligate its distributors to keep the records needed to make that tracing possible and to have them available for inspection. Ordinary product traceability can stop at the organization's own shipping dock. Implant traceability is written to reach past it, into records the organization itself doesn't generate.

Two retention clocks, and they don't start from the same place

ISO 13485's own retention default, set at Clause 4.2.5 and inherited by the records 7.5.9.2 requires, is the lifetime of the device as the organization defines it, or applicable regulatory requirements if longer, but not less than two years from that device's own date of release. That clock runs per device. A separate obligation lands on top of the same implant traceability record for anyone placing devices on the EU market: MDR Article 10(8) requires manufacturers to keep technical documentation, the EU declaration of conformity, and related records available to competent authorities for at least ten years after the last device covered by that declaration has been placed on the market — and at least fifteen years for implantable devices specifically. That's not the same clock as Clause 4.2.5's. It doesn't start at any individual device's release; it starts at the retirement of the entire product line under that declaration. A retention schedule that applies 4.2.5's per-device math to the EU obligation, instead of Article 10(8)'s fleet-wide one, will mark an implant record eligible for disposal years before the regulation actually allows it.

Where this record and the UDI are supposed to meet

The traceability chain Clause 7.5.9.2 builds and the identifier a UDI is supposed to carry through the same downstream records are meant to close on each other — the UDI is what a distributor's consignee record and a service record actually key on, and a traceability procedure that can't point to the specific identifier field carrying that link is tracing product without a reliable handle to trace it by.

A traceability procedure built around this split — the organization's own defined extent for ordinary product, the reach Clause 7.5.9.2 fixes for implants, and both retention clocks kept straight rather than merged — is previewed in the launch catalog. If your program runs the implant retention math differently, the shelf takes that correction directly.