ISO 11135, 11137 and 17665 validation support for sterile devices you can defend at any audit.

What it is

What are ISO 11135, ISO 11137 and ISO 17665?

They are three process standards from ISO technical committee 198, one for each of the most common ways of sterilising medical devices. ISO 11135 covers ethylene oxide gas, in industrial plants and in health care facilities. The ISO 11137 series covers radiation, whether gamma, electron beam or X-ray. ISO 17665 covers moist heat, which in practice means steam. Each sets requirements for developing the process, validating it and controlling it every time it runs.

Sterility cannot be confirmed by testing every finished unit, because a test destroys what it tests and cannot prove the absence of every organism. The standards therefore ask for something else: a process whose lethality has been established, shown to deliver that lethality to the product in its packaging, and then proven, cycle by cycle, to stay inside the parameters that were validated.

Current editions. ISO 11135:2014, with Amendment 1:2018 on single batch release, is still the published edition; its third edition reached the final ballot stage on 16 September 2026, so a new edition is close but not yet dated. ISO 11137-1:2025 (April 2025) replaced the 2006 edition and its amendments, alongside ISO 11137-2:2013 on establishing the dose, ISO 11137-3:2017 on dosimetry and ISO/TS 11137-4:2020 on process control. ISO 17665:2024 (March 2024) brought the former Part 1 and the two technical specifications into a single document. Any transition expectations come from your notified body or regulator, not from ISO.

Who it is for

Who needs sterilisation validation to these standards?

Anyone who places a device on the market as sterile, or sterilises it for someone who does, needs a validated process and the file that proves it. The standard that applies follows the method: one product family may sit under ISO 11137 while another is steamed under ISO 17665. Manufacturers usually reach us from one of four directions:

• A customer or distributor wants the validation file. Hospital groups, OEM customers and distributors ask for validation reports, dose audit results or revalidation schedules before they list a sterile product.
• A tender makes sterile supply a condition. Public procurement for sterile consumables often asks for proof of a validated process and a certified device QMS; both need to be ready before the bid date.
• A regulator or notified body raised a finding. ISO 13485 carries specific requirements for sterile devices and validated processes, and gaps in validation, requalification or supplier control of the steriliser are frequent audit observations.
• A group company or new site starts sterile production. A plant taking over a product, switching steriliser or moving from ethylene oxide to radiation needs the process validated again, and group quality wants one consistent approach.

The benefit sought is confidence in every released batch. That comes from the process and the discipline around it, not from a document produced once.

Requirements

What do ISO 11135, ISO 11137 and ISO 17665 require?

The three standards share a title: requirements for the development, validation and routine control of a sterilisation process for medical devices. They follow the same broad life cycle, and the list below describes it by requirement area in plain language, not by clause number. Method-specific detail, such as dose setting under ISO 11137-2, differs and is checked against the edition that applies to you.

• Quality management system elements: documented procedures, assigned responsibilities, competent people, calibrated equipment and control of any work done by a contract steriliser or laboratory.
• Sterilising agent characterisation: what the agent is, how it kills microorganisms and what it does to the materials it touches.
• Process and equipment characterisation: the sterilisation process and the equipment that delivers it, defined and qualified.
• Product definition: the device, its packaging, its bioburden and how it is loaded, grouped into families where that can be justified.
• Process definition: the parameters and tolerances that deliver the required sterility assurance without damaging the product.
• Validation: installation, operational and performance qualification, reviewed and approved in a validation report.
• Routine monitoring and control: evidence from each cycle, or each dose, that the process ran inside its validated limits.
• Product release: a documented decision, based on that evidence, before any batch leaves as sterile.
• Maintaining process effectiveness: change control, requalification and, for radiation, periodic dose audits.

Validation route

How is a sterilisation process validated?

The route is validation, not certification. Your organisation, with its steriliser and test laboratories, develops and qualifies the process and owns the resulting data. Sterling supports the documentation and the quality system around it. The file is then examined by whoever audits your devices: the ISO 13485 certification body, a notified body or a regulator.

1. 01
   Confirm the method, products and responsibilities.Which families use which method, who sterilises, which laboratories test, and what each market's regulator expects to see.
2. 02
   Gap analysis: compare existing files with the current editions.Validation reports, procedures, agreements and routine records are reviewed; what is sound is kept, and missing or outdated elements are listed with owners and dates.
3. 03
   Write the plan, the protocols and the procedures.A validation master plan, protocol templates, release and change procedures, and a quality agreement with the steriliser, approved before any qualification run.
4. 04
   Run the qualification and close the reports.Your team, the steriliser and the laboratories execute the studies; deviations are investigated and the reports approved by the people accountable for release.
5. 05
   Operate, monitor and present the evidence.Routine release runs on the validated parameters, internal audit covers sterilisation, and the file is ready for the certification body, notified body or regulator.

Check the route before you sign. Ask each laboratory whether its accreditation covers the specific tests it will perform, confirm the steriliser's own quality system and audit rights in writing, and verify the certification body's accreditation for medical device QMS directly with the accreditation body. Nobody can sell you a validated process without running one. The certification buyer's checklist

Cost

What drives the cost of sterilisation validation support?

The largest costs of validation usually sit outside a consulting fee: steriliser time, product sacrificed in studies, dosimetry and microbiology testing. Our proposal covers the documentation and quality system work and shows those external costs as separate lines, so you see the full programme.

Timeline

How long does sterilisation validation take?

Timing is set by the studies more than by the paperwork: laboratory queues, steriliser slots and incubation periods all have their own clock. As an estimate, documenting and integrating a validation programme into the device QMS takes roughly three to nine months, shorter when only an edition update is needed and longer when new product families or a new method are involved.

Share any launch, tender or audit date at the start. We will show which studies sit on the critical path and which decisions must be made in the first weeks.

Your engagement

What your sterilisation validation engagement includes

Sterling does not validate, test or certify: the qualification data belongs to your organisation, your steriliser and the laboratories, and the audit decision to your certification body, notified body or regulator. Our work is everything around the data that makes it usable and auditable.

• Scope, gap analysis and plan

  Methods, product families and responsibilities agreed, with a dated plan and named owners.

• Validation master plan and protocols

  Protocol and report templates per method, written to the current edition with your engineers.

• Effivity ISO & GRC software

  The sterilisation file, changes and CAPA run in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Supplier and steriliser controls

  Quality agreements, audit checklists and requalification triggers for contract sterilisers and laboratories.

• QMS integration and audit readiness

  Links to the device file, release and CAPA, an internal audit of sterilisation and support through the external audit.

The work follows Sterling OS™. Design™ and Drive™ are alternative support levels, not steps: in Design™ we guide and your team writes, in Drive™ we manage the documentation with your team. Automate™ is Effivity from the first workshop. Once the file is accepted, Sustain™ keeps requalification, dose audits and edition changes on schedule.

Validation data and release decisions remain with your organisation; audit decisions remain with the certification body, notified body or regulator.

Often combined with

Standards organisations pair with ISO 11135 · ISO 11137 · ISO 17665

• 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
• EU IVDR 2017/746EU IVDR compliance consulting for IVD manufacturers: performance evidence, QMS, traceability and post-market follow-up prepared for your notified body.
• EU MDR 2017/745EU MDR compliance consulting for CE marking: QMS, technical documentation, traceability and post-market surveillance prepared for your notified body.
• FDA QMSR (21 CFR 820)FDA QMSR compliance consulting for device makers selling in the US: a quality management system ready for FDA inspection, wherever you manufacture.