How long should training records be retained?

In the United States, 21 CFR 820.180 specifies that records must be maintained for a period equivalent to the design and expected life of the device, but not less than two years from the date of release of the medical device by the manufacturer, or as specified in the firm's quality system procedures. ISO 13485:2016 clause 4.2.4 requires records to be maintained for a period at least equivalent to the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, whichever is longer.

What kind of information should be included in a training record?

A comprehensive training record should include the trainee's name, the date of training, the topic or procedure covered, identification of the trainer, methods used for training, and evidence of successful completion or demonstrated understanding, such as a signature or quiz results.

All terms

Quality & RiskQuality System

Training Records

Documented evidence personnel have the education, training, and experience for assigned tasks.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

Definition

21 CFR 820.25 and ISO 13485 clause 6.2 require establishing competency needs, providing training, and maintaining records that demonstrate personnel are qualified for their roles. Effective training programs define competence requirements per role, train against current procedure revisions, evaluate whether training worked, and retrain when procedures change. Records typically show who was trained, on what revision, when and by what method. Inspectors often check that people performing a task were trained on the effective version, and that personnel understand the defects that can result from doing their job wrong.

What the regulation says

Training records are essential for demonstrating that personnel are qualified for their assigned duties, a requirement explicitly stated in regulations such as 21 CFR 820.25 for the United States and ISO 13485:2016 clause 6.2 internationally. These records serve as objective evidence during audits that MedTech manufacturers have established competency needs, provided necessary training, and evaluated training effectiveness, especially for roles impacting product quality and patient safety, as further detailed in guidance from bodies like the IMDRF.

What this means in practice

Common audit gaps include missing read-and-understood records for new SOP versions and lack of effectiveness evaluation for safety-critical training.

Examples

A medical device company implements a new software for automated testing, and all engineers involved in testing complete a mandatory training course, with their completion certificates and competency assessments filed as training records.
During an FDA inspection, an auditor requests training records for production line operators demonstrating their proficiency in assembling a high-risk surgical instrument, reviewing documentation of initial training and annual refreshers.
A MedTech firm updates its cybersecurity policy for connected devices, and all relevant R&D and post-market surveillance personnel attend a workshop, with attendance logs and acknowledgments of understanding recorded.

Common pitfalls

•A common pitfall is failing to document that personnel have read and understood new or revised Standard Operating Procedures (SOPs), particularly in electronic Quality Management Systems.
•Another frequent mistake is neglecting to evaluate the effectiveness of training, especially for critical roles or tasks that directly impact product quality or patient safety.
•Manufacturers often err by not conducting periodic refresher training or assessing ongoing competency, leading to skill degradation over time.
•Inadequate training record retention, or records that do not clearly link training to specific job functions, can be a significant audit finding.
•Failing to include specific cybersecurity training for personnel involved in the design, development, or maintenance of connected medical devices is a growing compliance issue.

Frequently asked questions

The primary purpose is to provide objective evidence that all personnel are adequately trained and competent to perform their assigned responsibilities, thereby ensuring product quality, safety, and regulatory compliance.

Cross-references

Part of

A larger framework or document this term belongs to.

ISO 13485

Grouped by theme

Editor's picks

· Hand-selected related concepts

Quality & Risk

Quality System Regulation(QSR / 21 CFR 820)

FDA's current good manufacturing practice (cGMP) requirements for medical devices.

Standards

ISO 13485

International standard for medical device quality management systems.

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 1Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

eCFR·1MDIC·1FDA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Quality & Risk0 / 39

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Quality & Risk
Sources: 3
Updated: 9/19/2026

Compare with another term

Learn in 60 seconds

Documented evidence personnel have the education, training, and experience for assigned tasks.

·Common audit gaps include missing read-and-understood records for new SOP versions and lack of effectiveness evaluation for safety-critical training.
·Effective training programs define competence requirements per role, train against current procedure revisions, evaluate whether training worked, and retrain when procedures change.
·Records typically show who was trained, on what revision, when and by what method.

Remember this

Watch out: A common pitfall is failing to document that personnel have read and understood new or revised Standard Operating Procedures (SOPs), particularly in electronic Quality Management Systems.

Related terms

You may also need

Auto-suggested from Quality & Risk and shared keywords.

All Quality & Risk terms

From the Blue Goat network

Related resources and services on this topic.

MedTech Truths
Common misconceptions about medical device development - debunked.