What the clause requires
Clause 7.1.3 asks the company to determine, provide and maintain the infrastructure needed to operate its processes and to achieve conforming products and services. Infrastructure here includes buildings and utilities such as power, water and compressed air, equipment including machines, tools, hardware and software, transport, and information and communication technology. The list is deliberately broad, because what counts as infrastructure depends entirely on what the company makes. In a machine shop it is the machines; in a software company it is the servers and the development environment; in a haulage company it is the fleet.
The word that carries the most weight in an audit is maintain. Having the machine is not enough; the company has to be able to show it is in a condition to produce conforming output. The standard does not require a formal maintenance plan, but equipment whose failure affects product quality effectively demands planned preventive maintenance with a record of what was done and when. A short list of critical equipment, a frequency for each item and a record of each intervention covers the requirement for most companies, and run-to-failure on a critical machine is very hard to defend when the defect rate follows the breakdowns.
Software is infrastructure too: the system that stores the quality records, the program running the CNC machine, the file server. Backup, access control and continuity belong here. Auditors commonly cross-reference machine downtime and nonconformities against the maintenance history to see whether the maintenance actually prevents problems or merely records them after the fact. A preventive plan that is permanently three months late is worse than no plan, because it documents the company's own failure to follow it.
What the auditor asks to see
- A list of the equipment and facilities that are critical to product quality
- A preventive maintenance plan for the critical items, with a defined frequency
- Records of the preventive and corrective maintenance actually carried out
- Backup and access control for the systems that hold the quality records
- Analysis of downtime and of recurring failures, with action taken
Where companies most often get it wrong
- Only corrective maintenance on a piece of equipment that is critical to quality
- A preventive plan running late with no replanning and no justification
- The system that stores the quality records with no backup routine
- A repeated equipment failure with no root cause analysis
Example of a nonconformity
- Requirement
- ISO 9001, 7.1.3: the organization shall maintain the infrastructure needed for the conformity of products and services.
- Evidence
- The maintenance plan calls for quarterly preventive maintenance on injection moulding machine INJ-04; the last one recorded is from 09/2025. Between 03 and 06/2026 there were 4 stoppages caused by hydraulic leaks and 2 batches with flash associated with that machine.
- Finding
- Planned maintenance on equipment critical to quality was not carried out.
Ready-made templates for this clause
Frequently asked questions
Does ISO 9001 require a preventive maintenance plan?
Not under that name. It requires the infrastructure to be maintained. For critical equipment, a preventive plan is the most common way to demonstrate that.
Is software part of the infrastructure?
Yes. Hardware, software and information technology are among the examples given in the standard itself.
Do I have to record every maintenance job?
Clause 7.1.3 does not require a specific record, but without one it is hard to demonstrate that maintenance happened. Critical items almost always have a history.