A field service engineer is a one-person quality system visiting a device in its clinical environment. Under EN ISO 13485:2016+A11:2021 clauses 7.5.4 and 6.2 and MDR Annex I Section 23.4, the engineer's competence, tools, parts and reports must all be controlled and traceable. The service report is simultaneously the closing of a work order and an input to post-market surveillance.

By Tibor Zechmeister and Felix Lenhard.

TL;DR

  • EN ISO 13485:2016+A11:2021 clause 7.5.4 requires planned, documented, and analysed servicing activities whenever servicing is a specified requirement.
  • Clause 6.2 requires competence to be determined, ensured and recorded for every person whose work affects product quality, including field engineers.
  • MDR Annex I Chapter III Section 23.4 requires the instructions for use to contain servicing information, including maintenance frequency and calibration where relevant.
  • Every service report is evidence in two directions: it closes the work order and it feeds the post-market surveillance system under Articles 83 to 86.
  • The most common field service audit findings are missing training records, untraceable spare parts, uncalibrated test equipment and service reports that never reach the PMS loop.

Why field service is where audits get hard

A notified body auditor has limited time on site. When they arrive at a startup that sells a device requiring field service, they usually ask for three things in the first hour: the list of service events in the last twelve months, the training records for every engineer who performed them, and the calibration records of the test equipment used. Those three stacks of paper (or screens of records) reveal more about the real quality system than any procedure document.

Field service engineering is where the quality system meets the messy world. The engineer is alone in a clinical environment, under time pressure, using tools that must be calibrated, installing parts that must be traceable, making decisions that might be safety-relevant, and writing reports that someone else will read weeks later. Each of those moments is a regulated activity. The only way to survive an audit is to design the work so that the records write themselves.

This post walks through what the regulation actually requires, what a minimal compliant field service operation looks like, and the findings that show up repeatedly when it is not built right.

What MDR and ISO 13485 actually say

Three anchors matter for field service.

EN ISO 13485:2016+A11:2021 clause 7.5.4 — Servicing activities. "If servicing is a specified requirement, the organization shall plan servicing activities and perform them to verify that they meet specified requirements. The organization shall analyse records of servicing activities carried out by the organization or its supplier, as appropriate, to determine if the information is to be handled as a complaint and to provide input to the improvement process. Records of servicing activities carried out by the organization shall be maintained." Three obligations: planning, performing, and analysing. All three must be visible.

EN ISO 13485:2016+A11:2021 clause 6.2 — Human resources. Personnel performing work affecting product quality must be competent on the basis of appropriate education, training, skills and experience. The organisation must document the process for establishing competence, providing needed training and ensuring awareness. It must maintain appropriate records of education, training, skills and experience. A field engineer is unquestionably someone whose work affects product quality.

MDR Annex I Chapter III Section 23.4. The instructions for use must include, where applicable, the information needed to verify the device is correctly installed and is ready to be used safely, the nature and frequency of preventive and regular maintenance, any information regarding cleaning and disinfection, and any calibration required. If the IFU states that calibration is required annually, the service operation must be able to deliver calibrated service and record it.

Two secondary anchors matter.

Clause 7.6 — Control of monitoring and measuring equipment. Test equipment used in service events (multimeters, flow calibrators, pressure test rigs) must be identified, calibrated against traceable standards, and records of calibration status maintained. An engineer using an expired calibration cert is a finding waiting to happen.

Clause 8.2.2 — Complaint handling. Information arriving through service events often meets the definition of a complaint. The service procedure must define how the engineer recognises and escalates this.

A worked example: field-installed capital equipment

Consider a startup selling Class IIb capital equipment to hospitals: install, commission, annual calibration, corrective maintenance on call. There are two internal engineers and one regional partner covering three countries. The IFU requires annual calibration and specifies the test parameters.

What does the operation look like?

Engineer competence. Each engineer has a competence file listing their training against every service task category: installation, commissioning, annual calibration, common corrective repairs. Each entry lists the procedure version they were trained on, the date, the trainer, and the competence check (supervised first service with sign-off). The partner company has equivalent records for their engineers, held by the partner but available to the manufacturer under the quality agreement. Annual refresher training with a short assessment keeps records current. When a procedure changes, affected engineers are re-trained and the record updated.

Test equipment. Each engineer carries a defined tool kit. Every instrument in the kit is listed in an equipment register with a calibration due date. Before a service visit, the engineer verifies calibration status. If anything is out of date, the visit is rescheduled. Calibration certificates are stored centrally and referenced by instrument serial number. The startup uses a single shared spreadsheet and a monthly review. The notified body is fine with that — what matters is that the record exists and the process is followed.

Spare parts. Replacement parts are held in a small bonded stock at the startup's office and shipped to the engineer for each visit. Each part carries a lot number. The service report captures the lot number of every part installed. If a lot is later found defective, a field safety corrective action can target exactly the devices that received that lot.

Service report as a PMS feed. The service report template has fields the engineer cannot skip: device serial number, date, engineer name, work performed, parts installed with lot numbers, calibration results (values, not just pass/fail), observations about device condition, and a flag for "possible complaint — escalate". Every report is reviewed within 48 hours by a named person who classifies it, triggers complaint handling if needed, and files it against the device serial number. Quarterly, the PMS owner analyses service reports for trends: calibration drift patterns, frequently replaced parts, recurring observations. Findings flow into the PMS plan and the PSUR.

Audit readiness. When the notified body arrives, they sample five service reports from the last year. For each sample, they trace the engineer's training record, the calibration status of the equipment used on that date, the lot numbers of installed parts, and the complaint handling decision (complaint or not). If any link is missing, it becomes a finding.

The Subtract to Ship playbook

Design the operation so records are produced as a by-product of the work. Do not try to reconstruct them later.

One service report template, with no optional fields. The template must force the engineer to enter device serial number, date, work category, parts installed with lot numbers, calibration results where applicable, observations, and a complaint-flag decision. If a field can be skipped, it will be skipped.

One competence matrix, always up to date. A single spreadsheet or simple tool listing every engineer (internal and partner) against every service task category, with training date, procedure version and assessment outcome. Review monthly. When a procedure changes, the matrix tells you who needs re-training.

One test equipment register. Every instrument the engineers carry, with serial number, calibration due date, and link to the latest certificate. Block a visit if anything is out of calibration.

One parts traceability rule. No part is consumed in a service event without its lot number being recorded against the device serial number in the same record. This is the minimum to support a field safety corrective action.

One triage step per report. Every service report is reviewed within a defined time window (48 hours is common) by a named person who classifies it as routine, complaint, or possible serious incident. The triage is logged. This is how service operations feed complaint handling and vigilance.

One quarterly analysis. Once a quarter, the PMS owner analyses service data for signals: failure rates, calibration drift, recurring observations, engineer-specific error patterns. The analysis is written up, even if brief, and feeds the PMS plan update and the PSUR input folder.

One quality agreement per external partner. If any field work is performed by a partner, the agreement must cover procedures, training, records ownership, complaint escalation, and the manufacturer's right to audit. The partner's engineers follow the same service report template.

Common audit findings in field service

From patterns observed across notified body surveillance audits, these show up repeatedly.

Training records that cover the procedure version in use two years ago. The engineer has been trained. The procedure has changed twice. The training was never refreshed. The record no longer reflects current competence.

Calibration certificates missing for one instrument in a tool kit. The other eight are fine. The one missing becomes the finding. Every visit where that instrument was used becomes suspect.

Service reports with "OK" as the calibration result instead of actual values. The IFU requires calibration to specific parameters. The report should show measured values. "OK" is not evidence.

Part lot numbers missing or captured separately from device serial numbers. The traceability link breaks. A field safety corrective action cannot be scoped cleanly.

Service reports that never feed PMS. The reports exist, the engineers are good, but the PMS plan does not list service data as an input and the quarterly analysis does not reference it. A systemic finding.

No triage record for complaint classification. The procedure says every report is reviewed for complaint potential. There is no record of the review. The notified body cannot see it, therefore it did not happen.

Reality Check

  1. Does your service report template force the engineer to enter every field required by clause 7.5.4 and Annex I Section 23.4?
  2. For every engineer performing service events in the last year, is there a current training record tied to the procedure version they followed?
  3. Is your test equipment register current, and has every service event in the last year been performed with in-calibration equipment?
  4. For every part consumed in a service event, is the lot number recorded against the device serial number in the same record?
  5. Does every service report go through a documented triage within a defined time window?
  6. Is service data named as a data source in your PMS plan under Annex III?
  7. When was your last quarterly analysis of service data for PMS, and what did it change?
  8. If your notified body sampled five service events from last year, could you produce the full chain of evidence in under an hour?

Frequently Asked Questions

Can field service be fully outsourced to a distributor? Yes, but you remain the legal manufacturer. The distributor's engineers work under your quality agreement, follow your procedures, use your service report template, and produce records you control. The notified body will audit your control over them.

Do field engineers need formal qualifications? The MDR does not prescribe qualifications. EN ISO 13485:2016+A11:2021 clause 6.2 requires competence based on education, training, skills and experience, documented in records. What qualifies varies by device complexity. A simple mechanical device may need a few hours of training; a capital equipment install may require weeks.

How do we handle remote diagnostic sessions — are they service events? If the session changes device configuration, updates firmware, or otherwise affects the device as placed on the market, yes. Treat it as a service event with the same record obligations. If it is pure support (explaining how to use a feature), it is complaint-adjacent but may not be a service event — define the boundary in your procedure.

What calibration standards apply to our test equipment? Calibration must be traceable to national or international measurement standards under EN ISO 13485:2016+A11:2021 clause 7.6. Most calibration labs issue certificates stating the standards used.

What if an engineer identifies a suspected serious incident on site? The engineer escalates immediately under your vigilance procedure. The Article 87 clock started when your organisation became aware, which is the moment the engineer observed it. Train every engineer to recognise and escalate within 24 hours.

Is a paper service report acceptable? Yes, if the controls around it meet the requirements: legibility, traceability, retrievability, protection from loss or damage. Most startups move to digital quickly because the traceability and retrieval requirements become painful with paper.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Annex I Chapter III Section 23.4, Articles 83 to 86.
  2. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes, clauses 6.2 (human resources), 7.5.4 (servicing activities), 7.6 (control of monitoring and measuring equipment), 8.2.2 (complaint handling).
  3. MDCG 2025-10 (December 2025) — Guidance on post-market surveillance under the MDR.