What the clause requires
While it is under the control of the organization or being used by it, property belonging to a customer or to an external provider has to be looked after. The organization identifies, verifies, protects and safeguards that property, which was supplied for use or for incorporation into the products and services. The obligation starts when the property arrives and ends only when it is returned, consumed as agreed or formally disposed of, and it does not depend on whether the organization paid for it.
The standard makes clear that property goes well beyond raw material: it includes components, tools and equipment, customer premises, intellectual property and personal data. The mould the customer paid for and left in the factory, the machine that arrived for repair, the confidential drawing shared to allow a quotation, the patient data held by a laboratory: all of it falls under this clause. Personal data is also covered by data protection legislation, so the controls applied to it usually go beyond what ISO 9001 alone would require.
When the property is lost, damaged or otherwise found to be unsuitable for use, the organization has to report this to the owner and retain documented information on what occurred. Auditors typically ask for the list of customer moulds, tooling and equipment held on site, walk out to verify the physical identification of a few items, and then ask what happened the last time something was damaged and where the communication to the owner was recorded.
A practical safeguard is to deal with customer property at the moment it arrives: record the receipt, check and note the condition, and photograph what came in, exactly as a good repair shop does with an incoming machine. That initial record prevents an argument later about damage that was already there, and it shows the auditor that the organization really does verify the property it receives instead of assuming it arrived in perfect condition.
What the auditor asks to see
- List of customer property held on site, covering moulds, tooling and equipment
- Physical identification on the customer property itself, not only in a spreadsheet
- Incoming inspection of customer property with the condition recorded on arrival
- Access control over confidential drawings, specifications and data supplied by the customer
- Record of the communication sent to the owner whenever property was lost or damaged
Where companies most often get it wrong
- Customer mould held for years with no identification and no maintenance plan
- Damage to customer property resolved internally and never reported to the owner
- Confidential drawing circulated by e-mail with no control over who received it
- Personal data belonging to customers stored with no protection and no access control
Example of a nonconformity
- Requirement
- ISO 9001, 8.5.3: when property of a customer is lost, damaged or otherwise found to be unsuitable for use, report this to the customer and retain documented information on what occurred.
- Evidence
- Mould M-114, owned by customer X, had cavity 2 damaged in April 2026; the organization blocked that cavity and continued producing with the remaining ones, with no record of any communication to the customer.
- Finding
- Damage to customer property was not reported to the owner and was not documented.
Ready-made templates for this clause
Frequently asked questions
Is personal data customer property?
The standard itself gives personal data as an example of customer property. Beyond ISO 9001, it is also subject to the data protection legislation that applies where the organization operates.
Does equipment received for repair fall under 8.5.3?
It does. While it is with the organization it has to be identified, protected and returned in the agreed condition, and any damage has to be reported to the owner.
What about property belonging to a supplier?
The same rule applies: returnable packaging, borrowed tooling and consignment devices belonging to an external provider need the same identification, care and reporting.