What the clause requires
Clause 8.3 applies whenever the organization creates or defines the characteristics of a product or service instead of simply making what the customer has already specified in full. The design process has to be planned, covering the stages, the review, verification and validation activities, responsibilities and authorities, the internal and external resources needed and the involvement of the customer where relevant. It also has to be fed by complete inputs: functional and performance requirements, information from previous similar designs, statutory and regulatory requirements, standards the organization has committed to apply, and the potential consequences of failure.
During the project the organization applies controls. Reviews evaluate whether the results achieved so far meet the requirements; verification confirms that the outputs meet the input requirements, through calculation, drawing checks, simulation or prototype testing; and validation confirms that the resulting product or service is able to meet the requirements for the specified application or intended use, through a field trial, a pilot with a customer or a trial run of the new service. Any problem found in these activities generates action, and the records have to show what was decided and done about it.
Design and development outputs have to meet the input requirements, be adequate for the provision of products and services that follows, include or reference monitoring and measuring requirements and acceptance criteria, and specify the characteristics that are essential for the intended purpose and for safe and proper provision. Changes made during or after the design, whether they come from a customer request, a supply problem or an internal improvement, are identified, reviewed and controlled. The organization keeps documented information on the changes themselves, on the results of the reviews, on who authorized them and on the actions taken to prevent adverse impacts.
What the auditor asks to see
- Design plan showing stages, control activities, responsibilities and resources
- Inputs recorded, including requirements, applicable standards and lessons from previous designs
- Records of design review, of verification and of validation, each with its conclusion
- Approved outputs carrying acceptance criteria and the characteristics essential for safe use
- Control of design changes with an assessment of the impact and evidence of authorization
Where companies most often get it wrong
- Declaring clause 8.3 not applicable while the organization clearly develops the product
- Confusing verification, which asks whether the output meets the input, with validation, which asks whether it works in use
- Design change made with no record and no assessment of the impact on the product
- Incomplete inputs, missing a statutory requirement or an applicable standard
Example of a nonconformity
- Requirement
- ISO 9001, 8.3.4 d): carry out validation activities to ensure that the resulting products and services meet the requirements for the specified application or intended use.
- Evidence
- Design of the SP-300 bracket, launched in April 2026: there is a calculation report and a static load test on the prototype, which is verification, but no validation under real conditions of use; by June 2026 three customers had reported loosening caused by vibration.
- Finding
- The design was released for production without validation for the intended use.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
When can clause 8.3 be excluded?
Only when the organization builds or delivers products and services whose characteristics are entirely specified by the customer or by an external standard. If the organization adapts, develops or defines any characteristic itself, clause 8.3 applies.
Do services have design and development too?
Yes. Creating a new service, a new course or a new way of serving customers is design and development, and it needs planning, inputs, controls and outputs in the same way as a physical product.
What is the difference between verification and validation?
Verification confirms that the output meets the input, for example that the drawing meets the specification. Validation confirms that the product meets the intended use, that it actually works in the real application.