MDR Article 10(9) requires every manufacturer to have a QMS that covers "resource management, including selection and control of suppliers and sub-contractors." EN ISO 13485:2016+A11:2021 clause 6 is the harmonised standard's tool for meeting that obligation on the internal side. The people, the buildings, the equipment, and the conditions under which devices are designed and made. Clause 6 is structured into 6.1 Provision of resources, 6.2 Human resources (competence, training, awareness), 6.3 Infrastructure (buildings, workspace, equipment, supporting services), and 6.4 Work environment and contamination control. For a startup, resource management is not a theoretical chapter. It is the answer to the question an auditor asks out loud: does this company actually have the people, the rooms, and the equipment to build this device safely?

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR Article 10(9) names resource management as one of the mandatory aspects of every manufacturer's QMS. It is not optional, and the Notified Body tests it on site.
  • EN ISO 13485:2016+A11:2021 clause 6 operationalises the obligation through four sub-clauses: provision of resources, human resources, infrastructure, and work environment.
  • Clause 6.2 requires documented competence. Education, training, skills, and experience. For every person whose work affects product quality, plus records of effectiveness of training.
  • Clause 6.3 covers buildings, workspace, utilities, and process equipment, including maintenance and validated software used in the QMS.
  • Clause 6.4 covers the work environment and, for sterile or particulate-sensitive devices, contamination control. This is where cleanroom classification, monitoring, and gowning procedures live.
  • A Subtract to Ship resource plan describes what the company actually has and uses. Borrowed cleanrooms, shared equipment, and contracted services are allowed. But they have to be real, controlled, and documented.

Why resource management is an auditor's first on-site question

An auditor can read a QMS on paper from anywhere in Europe. They fly in to see the things paper cannot show. When they arrive on site, the first substantive question after management responsibility is usually some version of: show the auditor where the work happens, show the people who do it, and show how the company knows they are qualified. That is resource management in a single sentence, and it is the part of the QMS that cannot be faked with a template.

A startup with a beautiful procedure library and no matching reality fails resource management fast. An assembler operating a critical process with no training record. A cleanroom whose last particle count is from before the device was even designed. A "head of regulatory" who turns out to be the founder's cousin reviewing documents on weekends. These are not hypothetical. They are the findings that show up in first audits when resource management was treated as paperwork rather than as a description of the organisation's actual capacity.

The legal anchor sits in MDR Article 10(9), which lists "resource management, including selection and control of suppliers and sub-contractors" as one of the thirteen named QMS aspects every manufacturer must cover. (Regulation (EU) 2017/745, Article 10, paragraph 9.) The standard turns that sentence into a process.

EN ISO 13485:2016+A11:2021 clause 6. The scope

Clause 6 of EN ISO 13485:2016+A11:2021 is structured into four sub-clauses.

  • 6.1 Provision of resources. The organisation shall determine and provide the resources needed to implement the QMS and maintain its effectiveness, and to meet applicable regulatory and customer requirements.
  • 6.2 Human resources. Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills, and experience. The organisation shall document the process for establishing competence, providing needed training, and ensuring awareness of personnel. Training effectiveness shall be evaluated and records maintained.
  • 6.3 Infrastructure. The organisation shall document the requirements for the infrastructure needed to achieve conformity to product requirements, prevent product mix-up, and ensure orderly handling of product. Infrastructure includes, as applicable, buildings, workspace and associated utilities, process equipment (hardware and software), and supporting services such as transport, communication, and information systems. Requirements for maintenance activities, including their frequency, shall be documented when these activities or their absence can affect product quality.
  • 6.4 Work environment and contamination control. The organisation shall document the requirements for the work environment needed to achieve conformity to product requirements, and shall document arrangements for the control of contaminated or potentially contaminated product for devices where contamination could have a negative effect on the quality of the product.

Each sub-clause maps back to Article 10(9). Following clause 6 correctly gives presumption of conformity with the resource-management aspect of the MDR under Article 8. The depth of implementation is proportionate to the risk class and the type of device. A Class I non-sterile tool and a Class IIb implantable do not need the same cleanroom, but both need a clause 6 answer.

Personnel and competence. Clause 6.2 in practice

Clause 6.2 is the sub-clause auditors spend the most time on, because people are the variable that changes fastest and the variable that affects product quality most directly.

For every role whose work affects the device. Design engineers, software engineers, risk managers, production operators, QA reviewers, internal auditors, the PRRC, the management representative. The QMS needs to document four things.

Required competence. A short role profile stating the education, training, skills, and experience needed to perform the role at the quality the device requires. For a software developer on a Class IIa SaMD, that might be: a degree in computer science or equivalent, training in EN 62304:2006+A1:2015, two years of medical-device software experience or equivalent supervised work, and familiarity with the company's coding standard. The profile is written once and updated when the role changes.

Actual competence of the person in the role. A record. CV, certificates, training history. Showing that the specific individual meets the profile, or the gap analysis showing what training is needed to close any delta.

Training delivered and records kept. Whatever training the person needed to close their gap, performed, documented, and signed off. New-hire onboarding, procedure-specific training when an SOP is revised, standard-specific training when a new harmonised standard lands, regulatory training when the MDR text or a relevant MDCG guidance updates.

Effectiveness evaluation. Clause 6.2 specifically requires evaluation of the effectiveness of training, not just delivery. This does not have to be a formal exam for every topic. It can be a supervised task sign-off, a documented peer review, a practical test, or a structured discussion. But it has to exist in the record. Training delivered without any effectiveness check is a standard finding.

For a startup, the trap is to skip the role profiles entirely and write training records only after they are demanded. The inverse trap is to import a forty-role competence matrix from a consultant's template for a twelve-person company. Both fail the same test. The matrix has to match the actual roles in the actual company, at the depth the device class requires.

Infrastructure. Clause 6.3 in practice

Infrastructure covers the physical and digital environment the company uses to design, produce, test, and distribute the device. It includes four things.

Buildings and workspace. The premises where design, production, testing, and storage happen. For a software-only SaMD startup the "workspace" may be an office or even distributed remote workstations; the QMS describes what the workspace requirements are and how they are met. For a hardware startup, it is the lab, the assembly area, the storage rooms, and the separation of incoming goods, quarantine, released product, and rejected product.

Utilities. Power, compressed air, water, HVAC, gases, communications. Whatever the processes depend on. If a utility affects product quality (compressed air touching a sterile product, water used in cleaning, temperature control in a reagent store), the QMS has to specify the requirement, how it is monitored, and what happens if it goes out of spec.

Process equipment, including software. The tools and machines used to build and test the device. For hardware: assembly jigs, soldering stations, environmental chambers, test rigs. For software: the CI/CD pipeline, the issue tracker, the static analysis tools, the test-management system. Clause 6.3 includes "hardware and software" explicitly, and the A11:2021 amendment keeps the requirement to validate software used in the QMS or for production whose correct functioning affects product conformity. Validation of QMS software is a specific, often-missed obligation.

Supporting services. Transport, communication, information systems. The services that glue the operation together. For a startup, this usually means the IT stack (Git, cloud services, backup, identity management) and logistics (shipping of devices, controlled transport for temperature-sensitive goods).

Clause 6.3 also requires documented maintenance for infrastructure where maintenance or its absence can affect product quality. A calibration log for a critical measurement tool. A service record for a sealing machine. A patch and backup log for a QMS database. The maintenance plan does not have to be elaborate, but it has to exist, be followed, and produce records the auditor can open.

Work environment and contamination control. Clause 6.4 in practice

Clause 6.4 is the sub-clause that makes or breaks first audits for sterile devices, invasive devices, and any device where particulates, microbes, or residuals can affect the finished product. The sub-clause has two parts.

Work environment requirements. The organisation documents the requirements. Temperature, humidity, lighting, cleanliness, personnel behaviour. Needed to achieve product conformity, and controls them. For a non-sterile electronic device, this may be a short statement about ESD control and office-level cleanliness. For a sterile, single-use product, this is a classified cleanroom, environmental monitoring, garbing procedures, and routine particle and microbial counts.

Contamination control for contamination-sensitive devices. For devices where contamination could harm the product, clause 6.4 requires documented arrangements to control contaminated or potentially contaminated product. This covers gowning, cleaning and disinfection of surfaces, routing of materials, segregation of clean and dirty areas, bioburden monitoring, and sometimes endotoxin testing. The arrangements live at the interface between clause 6.4 and the product realisation process and are cross-referenced in both.

For a startup, the honest question is: does the device need a cleanroom, and if so, what class? The classification flows from the product risk and the process. It is not a marketing decision. A Class IIb implantable almost always needs a classified environment. A Class I reusable instrument usually does not. A software-as-a-medical-device has no physical work environment to classify at all, and clause 6.4 reduces to a short statement that contamination is not a relevant risk for the product.

Borrowed cleanrooms are acceptable. Many MedTech startups do their early assembly in a partner lab, a university facility, or a contract manufacturer's cleanroom. The QMS has to describe the arrangement, the controls, the monitoring, and the auditability. An auditor is comfortable with a borrowed cleanroom that is documented and controlled. They are not comfortable with one that only exists in a photograph in the founder deck.

Scaling resource management with team growth

A three-person founding team does not run the resource-management process the same way a thirty-person company does. Clause 6 does not require a human resources department, a facilities manager, and a calibration coordinator. It requires that the four things (provision of resources, competence, infrastructure, work environment) are covered proportionately.

At team size three to ten, resource management usually sits on one person, often the management representative, who owns the competence matrix, the equipment list, and the environmental controls as part of their broader QMS role. At size ten to thirty, the load splits. QA still owns the competence matrix, but engineering leads own the equipment and the test environment, and an office manager or operations lead owns the physical space. At thirty and above, the roles are distinct and the matrices get bigger.

The scaling trap is not under-building. It is over-building early and then under-maintaining. A forty-row competence matrix that has not been updated in a year is worse than a ten-row matrix that is current. The Subtract to Ship test applies: every artefact in the resource-management chapter of the QMS has to describe something the company actually does at a useful level of detail. If it does not, it comes out and something simpler goes in its place.

Common mistakes startups make

  • The copied competence matrix. A consultant template with forty roles, most of which the company does not have. The auditor reads it, asks to meet the "Head of Sterilisation Validation," and there is nobody. Finding.
  • Training records without effectiveness evaluation. People were trained, the attendance sheets are in the folder, and nothing in the record shows whether any of them understood the training. Clause 6.2 explicitly requires effectiveness evaluation.
  • Unvalidated QMS software. The company runs its design controls, risk management, or document control in a SaaS tool and assumes the vendor's certification is enough. Clause 6.3 (with the A11:2021 amendment) requires the manufacturer to validate the software for its intended use in the QMS. Vendor certifications are input, not output.
  • The cleanroom nobody measured. A classified space exists on paper, the gowning procedure is written, but nobody has taken a particle count since commissioning. Environmental monitoring is part of clause 6.4 when the device requires it.
  • The invisible maintenance plan. Critical equipment is in use, there is no calibration schedule, and the last service was whenever it broke. Clause 6.3 requires documented maintenance for equipment whose condition affects product quality.
  • Treating "resources" as a one-time chapter. Resource management is not a document you write once. It is updated when people join or leave, when equipment changes, when the product risk profile shifts, and when the work environment evolves. Management review is where the updates get reviewed and decisions taken.

The Subtract to Ship angle

Resource management is the chapter of the QMS where founders most often either over-build or under-build, and both failure modes come from copying instead of describing.

Keep: a role-by-role competence profile for the roles that actually exist, real training records with honest effectiveness checks, a list of the buildings and equipment the company actually uses with documented maintenance for the pieces that matter, and a work-environment description proportionate to the product. For a sterile product, that includes the classified environment and the monitoring. For a SaMD, it includes the IT infrastructure, the validated tooling, and an honest note that physical contamination is not a relevant risk.

Cut: the forty-role matrix with thirty empty rows, the cleanroom SOP for a product that does not need a cleanroom, the calibration schedule for equipment the company does not own, the training plan for a regulation the company is not subject to, and the infrastructure description copied from a contract manufacturer's website. None of it traces to an Article 10(9) obligation the company actually has to meet. It is theatre and it makes the real resource-management story harder to find.

The test is the same as in every clause. Does the artefact describe something the company actually does, at the depth the device class requires? If yes, it stays. If no, it comes out. Proportionate to the risk class and type of device, not to the consultant's template.

Reality Check. Where do you stand?

  1. For every role whose work affects the device, is there a documented competence profile, a record of the actual person's qualifications against that profile, and a training history that has been evaluated for effectiveness?
  2. If the auditor walks into your workspace tomorrow, can you show them where design, production, testing, and storage happen, and explain the controls that apply to each area?
  3. Is every piece of equipment whose condition affects product quality on a documented maintenance or calibration plan, and are the records current?
  4. Has the software you use in the QMS and in production been validated for its intended use, or are you relying on the vendor's certifications without your own validation record?
  5. If your device is sterile, invasive, or contamination-sensitive, is the work environment classified, monitored, and documented at the level the risk requires. And does the environmental monitoring data actually exist?
  6. If you borrow a cleanroom, a lab, or a test facility, is the arrangement described in the QMS with real controls, monitoring, and audit access?
  7. When did you last update the resource-management chapter of the QMS. And does management review touch the resource data, or is it a silent section?

Any "not yet" is where the work is.

Frequently Asked Questions

What does "resource management" mean under MDR Article 10(9)? It means the manufacturer has to ensure the QMS covers the people, facilities, equipment, and environmental conditions needed to design and build the device safely, plus the selection and control of suppliers and sub-contractors. EN ISO 13485:2016+A11:2021 clause 6 covers the internal side. Personnel, infrastructure, work environment. Supplier control is addressed in clause 7.4 and in a separate post.

Does a software-only medical device manufacturer need a cleanroom? No. Clause 6.4 requires a classified work environment only where contamination could negatively affect product quality. For a SaMD, the contamination risk is not physical, so clause 6.4 reduces to a short statement to that effect. Clause 6.3 still applies. The software manufacturer has to document its development infrastructure, validated tooling, and IT environment.

Do you have to validate the SaaS tools you use in your QMS? Yes, where the correct functioning of the tool affects product or QMS conformity. EN ISO 13485:2016+A11:2021 clause 6.3 (with A11:2021) requires the manufacturer to validate software used in the QMS and in production for its intended use. A vendor's ISO certification is an input to your validation, not a replacement for it.

Can a startup use a borrowed cleanroom for assembly? Yes, provided the arrangement is documented in the QMS, the environmental controls and monitoring meet the product's requirements, the gowning and contamination-control procedures are in place and followed, and the space is available to the Notified Body auditor. Contract or shared cleanroom arrangements are common and accepted when they are real and controlled.

What is the most common clause 6 finding in first audits? Training records that show delivery but no effectiveness evaluation, and competence matrices copied from templates that do not match the actual roles in the company. Both trace back to treating clause 6 as paperwork rather than as a description of real capacity. Calibration and maintenance gaps on critical equipment are a close third.

How does clause 6 scale as the team grows? At three to ten people, one person usually owns the whole clause as part of their QMS role. At ten to thirty, the competence, equipment, and facilities sub-topics split across QA, engineering, and operations. At thirty and above, the sub-topics have dedicated owners. The obligations under clause 6 do not change with size. Only the internal ownership does.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10 (general obligations of manufacturers), including paragraph 9 listing "resource management, including selection and control of suppliers and sub-contractors" as a mandatory QMS aspect. Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016+A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes. Clause 6 (Resource management), including sub-clauses 6.1 Provision of resources, 6.2 Human resources, 6.3 Infrastructure, and 6.4 Work environment and contamination control.

This post is a deep dive within the Quality Management Under MDR cluster in the Subtract to Ship: MDR blog. Authored by Tibor Zechmeister and Felix Lenhard. The MDR is the North Star. EN ISO 13485:2016+A11:2021 clause 6 is the tool. Resource management is not a chapter you copy from a template. It is the honest description of the people, the rooms, and the equipment a Notified Body auditor is going to walk through on site.