ISO 17664: Reprocessing Instructions for Reusable Devices

Introduction

ISO 17664 exists because a reusable medical device is only as safe as the worst reprocessing cycle a hospital will ever run on it, and it is the manufacturer, not the hospital, who has to prove that the cycle printed in the instructions works. Most reprocessing instructions are still written the other way round: the text is adapted from a competitor's leaflet, and the validation is commissioned afterwards to match it, or never commissioned at all. A Notified Body reviewer or an FDA lead reviewer reads the same page as a list of claims, and asks for the evidence behind each temperature, each contact time and each number of cycles.

The standard is short and its consequences are not. It decides what goes into Section 2 of the EU MDR technical documentation, which rows of the GSPR checklist can be closed with a harmonised standard, how a class I reusable surgical instrument ends up in front of a Notified Body, and what a 510(k) for a reusable device has to contain. Since 2021 it has been a series rather than a single document, and in June 2026 it gained a third part that most technical files have not caught up with.

This guide covers what the series regulates, how to choose between Part 1 and Part 2, the validation and the risk analysis that Clauses 4 and 5 demand, the ten processing activities of Clause 6, the interface with the EU MDR and class Ir, why the FDA recognises Part 1 only in part, the new ISO/TS 17664-3:2026, and the six gaps reviewers find most often.

Table of Contents

• What ISO 17664 regulates, and what it leaves to the hospital
• From one document to a three-part series
• Processing, reprocessing and the vocabulary that trips up files
• ISO 17664-1 or ISO 17664-2: which part applies
• Clause 4: every instruction is a validated claim
• What the evidence looks like, step by step
• Product families and the master product
• Clause 5: the risk analysis sets the depth of the instructions
• Clause 6: the ten activities and what each must state
• Limits, point of use and preparation
• Cleaning, disinfection and drying
• Inspection, packaging and sterilisation
• Storage, transport and presentation
• ISO 17664 and the EU MDR: Annex I, class Ir and the technical file
• The Annex I requirements the standard answers
• Class Ir and the Notified Body
• Where the evidence sits in the technical file
• Why the FDA recognises ISO 17664-1 only in part
• ISO/TS 17664-3:2026 and the review of the series
• The six gaps reviewers find
• Frequently asked questions
• Conclusions

What ISO 17664 regulates, and what it deliberately leaves to the hospital

ISO 17664 is the series of standards that specifies the information a medical device manufacturer must provide so that a device can be processed, meaning cleaned, disinfected and where necessary sterilised, to make it safe for its next use. It does not tell a hospital how to run a sterile processing department, and it does not contain processing instructions. The scope of Part 1 says so directly: the instructions themselves are not defined in the document. What it defines are the requirements a manufacturer has to meet when writing them.

Two groups of devices are in scope. The first is the obvious one: devices intended for reuse, which have to be taken from their state after clinical use back to a state that is ready for the next patient. The second is the one manufacturers forget: single-use devices that are supplied non-sterile and have to be processed before their one and only use. An orthopaedic screw delivered non-sterile in a tray is single-use, and it is still inside the standard. What is out of scope is narrow: textile devices used in patient draping systems or surgical clothing, and single-use devices that are supplied ready for use.

The introduction to Part 1 also places a responsibility on the manufacturer that is easy to read past. The design of the device has to make effective processing achievable, taking into account the validated processes that are commonly available to processors. That sentence moves the standard out of the labelling department. A lumen that no brush on the market can reach, a hinge that cannot be opened for the washer-disinfector, a polymer that crazes at 134 °C: none of these is fixed by better wording. ISO 17664 is usually filed under labelling. It belongs under design input.

Part 1 organises the instructions around ten activities, in the order a processor performs them: initial treatment at the point of use, preparation before cleaning, cleaning, disinfection, drying, inspection and maintenance, packaging, sterilisation, storage and transportation. The instructions have to address each activity that applies to the device, and Clause 6 gives every activity its own sub-clause.

From one document to a three-part series

The first edition, in 2004, was written for resterilisable devices and said so in its title. The second edition, ISO 17664:2017, widened the scope to every device that needs processing, including devices that are only cleaned and disinfected, and adopted the title the series still carries. In 2021 the document was split. ISO 17664-2 was published in February 2021 for non-critical devices, and ISO 17664-1 followed in July 2021 for critical and semi-critical devices, replacing the 2017 edition.

The foreword of Part 1 describes it as a minor revision of ISO 17664:2017, and it means it: the changes are editorial, confined to the title, the introduction and the scope, and made only to reflect the existence of a second part. A validation package built against the 2017 edition therefore stands. What has to change is the reference cited in the file and, for non-critical devices, the part it is cited against. The third document arrived on 30 June 2026 as a Technical Specification on cleaning classification, and it is covered in its own section below.

Processing, reprocessing and the vocabulary that trips up technical files

The series speaks of processing, not reprocessing, and the choice is deliberate: the word covers both the preparation of a new device before its first use and the preparation of a used device before its next one. The FDA and most hospitals say reprocessing for the same thing, which is why the word appears in the title of this article and in most search queries.

The EU MDR is where the vocabulary becomes dangerous. The Regulation uses the term reprocessing for one situation only, the reprocessing of single-use devices under Article 17. For reusable devices it avoids the word and refers instead to the appropriate processes for allowing reuse. A technical file that describes the routine cycle of its own reusable instrument as reprocessing in accordance with Article 17 has just described that instrument as a reprocessed single-use device, with a different legal manufacturer and a different set of obligations. In the instructions for use and in the file, use processing, as the harmonised standard does.

ISO 17664-1 or ISO 17664-2: the intended contact decides, and a sterilisation claim overrides it

The split between the two parts follows the Spaulding classification, which sorts devices by the tissue they touch. A critical device enters normally sterile parts of the body. A semi-critical device contacts mucous membranes or non-intact skin. A non-critical device contacts intact skin only, or does not touch the patient at all. Part 1 covers the first two classes. Part 2 covers the third.

There is one override, written into both scopes. Part 1 applies to any medical device that is intended to be sterilised, whatever its contact, and Part 2 excludes those devices explicitly. The claim sets the scope, not the contact. A manufacturer who decides that a non-critical positioning aid should be steam sterilised between patients has moved it into Part 1, with everything Part 1 asks for.

Three decisions go wrong repeatedly. The first is classifying by product type instead of intended use. An ultrasound transducer used on intact skin is non-critical; the same transducer design used inside a body cavity is semi-critical, and the instructions have to cover the most demanding use the manufacturer claims. The second is treating a system as one device. A console that never touches the patient and a handpiece that contacts mucosa sit under different parts of the series, and the instructions need a processing section for each rather than one generic paragraph about wiping surfaces.

The third is reading non-critical as no evidence required. Part 2 drops sterilisation and the separate point-of-use step, and keeps everything else: preparation before processing, cleaning, disinfection, drying, inspection and maintenance, packaging, storage and transportation. A statement that the housing can be wiped with a hospital-grade disinfectant is a processing instruction, and the manufacturer needs to know which disinfectant chemistries the housing, the display and the seals survive over the service life. Annex E of Part 2 gives examples of devices and how they relate to each part; Part 1 itself points to that annex for scope questions, so read it before arguing a borderline case.

A non-critical device that the manufacturer chooses to have sterilised is a Part 1 device. Check the claims in the instructions before checking the contact category: the claim is what a reviewer will hold the file to.

Clause 4: every sentence in the processing instructions is a validated claim

Clause 4 is one of the shortest clauses in the standard and it generates most of the nonconformities. It requires the manufacturer to validate each process identified in the information provided with the device, and to hold objective evidence that the device, processed as directed, comes out clean, disinfected or sterile as claimed. The instructions are not advice to the hospital. They are a specification, and the manufacturer has to show that the specification works.

Two consequences follow, and both are routinely missed. The parameters in the instructions have to be the parameters that were validated: the same temperature, the same time, the same chemistry type and concentration, the same packaging. And the validation has to be run at the least favourable end of whatever the instructions permit. If the text allows a detergent concentration between 0.5 and 1 per cent, the study uses 0.5. If it says clean within one hour of use, the soil is left to dry for at least an hour before the study begins. An instruction that says follow the detergent manufacturer's recommendations has delegated the specification to a third party, and nothing has been validated at all.

What the evidence looks like, step by step

ISO 17664 does not prescribe test methods or acceptance criteria; it requires validation and leaves the method to the state of the art. For cleaning, the state of the art is set by two documents. ANSI/AAMI ST98:2022 is the first standard dedicated to cleaning validation by device manufacturers: it expects simulated-use soiling with a clinically relevant test soil applied to the worst-case locations, a validated extraction method, and for critical and semi-critical devices at least two quantitative, clinically relevant analytes in addition to visual inspection. ISO 15883-5:2021 is written for washer-disinfector testing and gives alert and action levels for the same analytes. European reviewers accept either as the reference, provided the file says which one was used and why.

None of these numbers is in ISO 17664. They are the criteria the laboratories apply and the reviewers recognise, and a cleaning validation report that sets its own limits without reference to either document will be asked to justify them.

For disinfection the evidence depends on the method. Thermal disinfection is expressed through the A0 concept of the ISO 15883 series, which converts a time at temperature into an equivalent lethality: 90 °C held for five minutes gives an A0 of 3000, and one minute at the same temperature gives 600. The study has to show that every surface, including the inside of lumens, reaches the stated temperature for the stated time. Chemical disinfection needs efficacy data for the named agent at the lowest concentration, shortest contact time and lowest temperature the instructions allow, followed by a rinse that is shown to remove the residue.

For sterilisation by moist heat the reference is ISO 17665:2024, which replaced ISO 17665-1:2006 and its companion technical specifications and has been cited as a harmonised standard under the MDR since January 2026. The usual approach is overkill at half cycle: the device, inoculated at its hardest-to-reach location and packed exactly as the instructions specify, is exposed for half the claimed time, and complete kill at half cycle supports a sterility assurance level of 10⁻⁶ at the full one. Devices that cannot take steam need the same demonstration for a low-temperature method, with ISO 11135 for ethylene oxide or ISO 22441 for vaporised hydrogen peroxide as the reference.

Drying and packaging carry lighter wording and are still claims. Clause 6.8 asks for a verified drying method rather than a validated one, and the packaging named in Clause 6.10 has to be the packaging used in the sterilisation study, selected against ISO 11607. The last piece of evidence is the one most often absent: what the processing chemistry leaves behind. The biological evaluation has to consider the device as it reaches the patient after repeated processing, residues of detergent and disinfectant included, and not as it left the factory.

Product families and the master product

No manufacturer of surgical instruments validates four thousand catalogue numbers one by one, and Clause 4 does not ask for it. Where devices share common attributes, validation may be carried out for a product family, on condition that the manufacturer demonstrates the commonality and that the studies address the worst-case attributes of the family. The device chosen to represent the family is the master product.

The weak point is the rationale. A sentence stating that the forceps with the longest shaft was selected as worst case is an assertion. A defensible rationale is a matrix: every member of the family against every feature that makes processing harder, such as lumen length and internal diameter, blind holes, mated surfaces, hinges and box locks, surface roughness, materials, and mass. It also has to accept that the worst case is specific to the process. The hardest device to clean is usually the one with the longest, narrowest lumen or the most occluded joint; the hardest to sterilise by steam is often the heaviest, because of its heat-up time, or the one with the least accessible mated surface. One master product for everything is rarely the right answer, and reviewers know it.

Until 2026 the series used the terms product family and master product without saying how to establish either. ISO/TS 17664-3:2026 was written to close exactly that gap.

Clause 5: the risk analysis decides how much the instructions have to say

Clause 5 requires the manufacturer to carry out a risk analysis in order to determine the content and the level of detail of the processing information. The analysis is not a separate exercise. It is part of the ISO 14971 risk management process for the device, with processing treated as a phase of the life cycle like any other. The inputs that matter are the design of the device, the contamination it will meet in its intended use, the processing equipment a typical processor realistically has, the training of the people who will do the work, the foreseeable ways in which they will deviate, and the number of cycles the device is expected to survive.

The hazards are familiar once they are written down. Residual soil shields microorganisms from the disinfectant or the steam, and the next patient is infected. Residual process chemistry reaches tissue and causes a toxic or irritant reaction. Repeated thermal and chemical stress degrades materials until an insulation layer cracks, a jaw fractures or a seal leaks. A device reassembled wrongly after cleaning fails in use. Each of these has a sequence of events that starts in the processing department, and each needs a risk control that is more than a sentence in the instructions.

That is where Clause 5 connects to the order of risk control measures. Information for safety is the weakest control available, and processing instructions are information for safety. If the only thing standing between a narrow lumen and a contaminated patient is an instruction to brush thoroughly, the residual risk argument is thin, and the file should show that design options, such as a detachable tip, a flushing port or a larger bore, were considered first. The instructions are then allowed to carry what the design could not remove.

Processing is also a use scenario. The technician at the sink and the operator loading the washer-disinfector are users of the device, the processing instructions are part of the user interface, and the critical tasks among the processing steps belong in the usability engineering file under IEC 62366-1. For a device with complex disassembly or channel flushing, a summative evaluation in which processing staff follow the instructions without help is the only convincing evidence that the instructions can be followed. After launch, complaints about staining, corrosion, retained debris or wet packs are post-market data about the processing instructions, and they go back into the same risk file.

Clause 6 of ISO 17664-1: the ten activities and what each one has to state

Clause 6 is the body of the standard. Its opening sub-clauses set the general rule: for every activity that applies, the instructions give at least one validated method, and they state the steps, the equipment and accessories, and the process parameters with their tolerances wherever these matter to the function of the device or the safety of patients and staff. The sub-clauses that follow take the activities one by one.

Limits, point of use and preparation: Clauses 6.3 to 6.5

Clause 6.3 deals with limitations and restrictions. If processing as instructed degrades the device to the point of limiting its useful life, the manufacturer has to say so, either as a number of processing cycles the device normally tolerates or as another indication that it has reached the end of its ability to perform safely. The same clause is where known incompatibilities belong: a maximum temperature, a pH range, a ban on ultrasonic baths or on a class of disinfectant.

Clause 6.4 covers initial treatment at the point of use, and it is the activity instructions most often skip. Soil that dries on a device is far harder to remove than fresh soil, so the instructions should state the maximum time between use and cleaning, any wiping or flushing to be done in the operating room, and how the device is to be contained and transported. There is a direct link to the validation here: the time for which the test soil was left to dry in the cleaning study is the time that should appear in this section. An instruction with no limit has claimed that the device can be cleaned after any delay.

Clause 6.5, preparation before cleaning, is where disassembly is specified, with drawings if the sequence is not obvious, together with the opening of valves and ports, any leak test, and any pre-soak or ultrasonic treatment. If the device was disassembled for the validation, it must be disassembled in the instructions.

Cleaning, disinfection and drying: Clauses 6.6 to 6.8

Clause 6.6 contains the requirement that shapes the whole validation programme. Clause 6.6.1.1 requires at least one validated automated cleaning method, which may include a validated manual step as part of it, unless the device cannot withstand any such process, in which case the instructions must carry a statement alerting the user. Manual cleaning alone is therefore the exception, and it has to be declared as one. For the automated method, Clause 6.6.2 expects the instructions to identify the accessories needed, such as flushing adaptors and load carriers, the type and concentration of process chemicals, the water quality, the temperatures and times of each phase, and the rinsing. For manual cleaning under Clause 6.6.3 the detail is of a different kind: brush type and dimensions, number of passes, flush volumes, soak time and water temperature.

Clause 6.7 repeats the logic for disinfection. Clause 6.7.1.1 requires at least one validated automated disinfection method where the device is intended to be disinfected, with the same exception and the same warning statement. In European hospitals that method is normally thermal disinfection in a washer-disinfector, and the instructions should state the parameters as temperature and time or as an A0 value. Heat-sensitive devices need a chemical method, with the agent, concentration, contact time, temperature and the quality of the final rinse water.

Clause 6.8 requires at least one verified drying method wherever drying is necessary, with the maximum temperature and exposure time and the specification of the drying medium. It reads like housekeeping and is not: a wet lumen defeats low-temperature sterilisation, a wet pack is a failed steam cycle, and moisture left in an endoscope channel is where biofilm starts.

The automated-method rule cuts both ways. If a hospital will run your instrument through a washer-disinfector whether or not you mention one, validating only the manual method does not protect the patient, and under Clause 6.6.1.1 it does not satisfy the standard either.

Inspection, packaging and sterilisation: Clauses 6.9 to 6.11

Clause 6.9 covers inspection and maintenance, and it is the activity where vague wording does the most damage. Inspect before use tells the technician nothing. The instructions have to say what to look for and how: the areas to examine, whether magnification or a borescope is needed, the functional test and its pass criterion, the lubricant to be used and where, how the device is reassembled, and which parts are replaced at what interval. This is also where the end-of-life signs promised under Clause 6.3 become observable acceptance criteria.

Clause 6.10 requires a packaging method compatible with both the device and the sterilisation process where the device is to be sterilised in a sterile barrier system. The practical point is consistency: the wrap, pouch or rigid container named here has to be the configuration that was in the steriliser during the validation.

Clause 6.11 requires at least one validated sterilisation method where the device is intended to be sterilised. A usable instruction states the sterilising agent, the cycle type, the temperature and the exposure time, the drying time, and the limits the device must not exceed. Hospitals run steam, so a device that cannot be steam sterilised should say so in plain words and give a validated low-temperature method instead of leaving the processor to guess.

Storage, transport and presentation: Clauses 6.12, 6.13 and 7

Clauses 6.12 and 6.13 ask for any limits on the time and conditions of storage after processing and any specific requirements for transport. Most devices need a single sentence; devices with batteries, optics or moisture-sensitive components need more.

Clause 7 turns to how the information is presented. It has to be available to the people who do the processing, at the time they do it, in a form they can use. That allows a separate processing manual and an electronic format where electronic instructions are permitted, and in both cases the document is labelling, under document control and under the same change procedure as the instructions for use. The rest of the labelling rules still apply, so the processing information has to be consistent with ISO 20417:2026 on information supplied by the manufacturer and with the symbols of ISO 15223-1. Annex B of Part 1 gives an example layout that follows the ten activities in order. Use that order: it is what the processor expects and what the reviewer will check against.

Where ISO 17664 meets the EU MDR: Annex I, class Ir and the technical file

The Annex I requirements the standard answers

Three provisions of Annex I carry the obligation. Section 11.2 requires devices to be designed, where necessary, to facilitate their safe cleaning, disinfection and re-sterilisation. Section 23.4(m) requires sterilisation instructions for devices supplied non-sterile and intended to be sterilised before use. Section 23.4(n) is the central one: for reusable devices the instructions for use must contain information on the appropriate processes for allowing reuse, including cleaning, disinfection, packaging and, where appropriate, the validated method of re-sterilisation appropriate to the Member State or Member States in which the device is placed on the market, and information to identify when the device should no longer be reused, such as signs of material degradation or the maximum number of allowable reuses.

EN ISO 17664-1:2021 has been a harmonised standard for these purposes since Commission Implementing Decision (EU) 2022/6 of 4 January 2022 added it to the MDR list. EN ISO 17664-2:2023 followed with Implementing Decision (EU) 2024/815 of 6 March 2024, which is why the European edition of Part 2 carries a later year than the ISO text it reproduces. Compliance gives a presumption of conformity, limited to the Annex I requirements mapped in Annex ZA of each European edition. Read that table before claiming more than it covers.

Two phrases in Section 23.4(n) deserve more attention than they get. The first is appropriate to the Member State. Processing practice is not uniform across the Union. German hospitals work to the joint KRINKO and BfArM recommendation, which expects machine cleaning and thermal disinfection for most instruments and classifies them by processing difficulty. French hospitals routinely run steam cycles of 134 °C for 18 minutes as a precaution against prion transmission. A device validated only for 134 °C for three minutes will be run at 18 minutes in France regardless of what the instructions say, and its materials had better survive it. The validation plan should start from the list of markets.

The second phrase is the maximum number of allowable reuses. Together with Clause 6.3 of the standard it turns end of life into a claim that needs data: a repeated-cycle study in which the device is processed to the stated limit and then tested for function, material integrity and legibility of its markings. Markings matter because Annex VI Part C Section 4.10 requires reusable devices to carry the UDI carrier on the device itself, permanent and readable after each processing cycle throughout the intended lifetime. For class I reusable devices that direct-marking obligation applies from 26 May 2027, and the durability of the mark belongs in the same study.

Class Ir: the one place a Notified Body reviews a class I device for its instructions

Article 52(7)(c) takes class I reusable surgical instruments out of pure self-declaration. The manufacturer applies Chapters I and III of Annex IX or Part A of Annex XI, and the involvement of the Notified Body is limited to the aspects relating to the reuse of the device: cleaning, disinfection, sterilisation, maintenance and functional testing, and the related instructions for use. Annex VIII defines a reusable surgical instrument as one intended for cutting, drilling, sawing, scratching, scraping, clamping, retracting, clipping or similar procedures, without connection to an active device, and intended to be reused after appropriate procedures.

Read against the standard, the scope of that review is a list of Clause 6 headings. A class Ir assessment is in substance an ISO 17664-1 assessment: the processing instructions, the validation behind them, the family rationale, and the quality system processes that keep the three aligned when a design or a supplier changes. Manufacturers with instruments that were self-declared under the Directive have until 31 December 2028 at the latest to complete it, provided they met the application and agreement conditions of Regulation (EU) 2023/607. Those who treat the review as a labelling check discover in the first round of questions that it is a validation review.

Where the evidence sits in the technical file

The processing evidence is spread over four sections of Annex II, and a reviewer follows it through all of them.

The test is simple and unforgiving: every number in Section 2 should be traceable to a report in Section 6.1, and every report should name the instruction revision it supports. When the instructions are revised and the reports are not re-examined, the file has drifted, and the drift is visible on the first page a reviewer compares.

Why the FDA recognises ISO 17664-1 only in part

The FDA added both parts to its list of recognised consensus standards on 30 May 2022, and it did not treat them alike. Part 2 is recognised as a complete standard under recognition number 14-579. Part 1, under recognition number 14-578, is recognised in part, and four provisions are excluded: Clause 6.6.1.1 on the automated cleaning method, Clause 6.7.1.1 on the automated disinfection method, Clause 6.8 on drying, and item i) of Clause 6.11.3, the pressure required for the sterilisation process.

The reason given is the same for each: the provision conflicts with the final guidance Reprocessing Medical Devices in Health Care Settings: Validation Methods and Labeling, issued in March 2015 with an appendix updated in June 2017. Three of the conflicts sit in the guidance's fifth criterion, on comprehensive instructions, at items D, I and K of Section VI.5, which the agency sets against the ISO clauses on cleaning, disinfection and drying. The fourth is with the passage on extended cycles in Section VI.4. The practical reading is that the ISO text makes automation the default and the guidance does not, and that the agency expects sterilisation parameters to match cycles that cleared sterilisers and their accessories actually run.

For a submission this means that a declaration of conformity to ISO 17664-1 covers the recognised clauses only, and that the guidance governs wherever the two diverge. The guidance is organised around six criteria for reprocessing instructions:

• the labelling reflects the intended use of the device;
• the instructions advise users to clean the device thoroughly;
• the instructions indicate the appropriate microbicidal process;
• the instructions are technically feasible and include only devices and accessories that are legally marketed;
• the instructions are comprehensive;
• the instructions are understandable.

Appendix E of the guidance lists the device types whose design makes them more likely to transmit infection if processing fails, and for those the 510(k) is expected to contain the validation protocols and complete test reports, not a summary. For every reusable device the validation is design validation of the labelling, and since the Quality Management System Regulation took effect in February 2026 it is examined against the design and development requirements of ISO 13485.

The two regimes can be served by one validation programme, and they cannot always be served by one table of parameters. Validate an automated and a manual cleaning method where the device tolerates both, which satisfies Clause 6.6.1.1 and gives the FDA a validated method for whichever the labelling offers. Then keep the sterilisation parameters market-specific: an 18-minute cycle that the French market needs is an extended cycle in the United States, and it does not belong in the labelling submitted to the FDA.

ISO/TS 17664-3:2026 gives product families a method, and the rest of the series is under review

ISO/TS 17664-3:2026 was published on 30 June 2026. It is a twelve-page Technical Specification with no normative references, and it gives guidance on designating reusable devices to cleaning classification categories. Its introduction is candid about why it exists: product family and master product are used throughout ISO 17664-1, ISO 17664-2, AAMI TIR12 and ANSI/AAMI ST98, and none of those documents tells the manufacturer how to define a family or select a master product on objective evidence. ISO 17665 does so, and only for moist heat sterilisation.

The method has two steps: devices are designated to product families, and product families are designated to cleaning processes. Families are built on four groups of attributes, namely geometric design features, materials of construction, clinical use and the type of cleaning process. The classification itself has three categories for manual cleaning, M1 to M3, and three for automated cleaning, A1 to A3, and the document then describes the processing resources that correspond to each level. It is addressed to manufacturers devising cleaning methods and to processing facilities, which is new for this series: the same category that supports the manufacturer's choice of master product is meant to tell the hospital what workflow the device needs. Disinfection and sterilisation are outside the classification, as are single-use devices supplied sterile and textiles.

Its regulatory weight has to be read correctly. A Technical Specification is not a harmonised standard, even though CEN has adopted it as CEN ISO/TS 17664-3:2026, so it gives no presumption of conformity. It is, however, the published state of the art on a question every reviewer asks, and a family rationale that ignores it will look dated quickly. Nothing has to be revalidated. At the next planned update, restate the existing family rationale in the terms of Part 3 and record the category of each family in the processing instructions file.

The two older parts have reached their five-year systematic review. The review of ISO 17664-2 opened on 15 January 2026 and closed on 5 June 2026; the review of ISO 17664-1 opened on 15 July 2026. The outcome of a review is a decision to confirm, revise or withdraw, and neither decision has been published. A revision, if one is launched, takes years to reach publication. Work to the 2021 texts, and do not hold back a validation programme waiting for a new edition.

The six gaps reviewers find in ISO 17664 files

Processing files fail in a small number of ways, and the same ones appear whether the reviewer is a Notified Body assessing a class Ir instrument, a technical documentation assessor on a class IIb system, or the FDA reading a 510(k).

The three serious ones are all failures of Clause 4. Parameters that appear in the instructions and not in any report are the most common: the instructions were updated after a customer request, or translated with a different cycle, and the validation was never reopened. An unjustified family comes next, usually because the master product was chosen for convenience and the rationale was written afterwards. The missing end-of-life criterion is the one that also breaches the Regulation directly, since Annex I Section 23.4(n) asks for it in terms.

The two medium findings are specific to the text of the standard. Offering manual cleaning only, without the statement that the device cannot withstand an automated process, contradicts Clause 6.6.1.1. Naming a detergent by brand, with no description of its type, concentration and pH, leaves a hospital that cannot source the product without a validated method, and it fails the FDA's feasibility criterion for the same reason. Describe the chemistry generically and give the validated product as the example.

The last finding is rated low and is the cheapest to prevent. Instructions that have never been followed by an actual processing technician contain steps that cannot be performed with the equipment in the room. Putting the draft in front of two or three sterile processing staff, before the validation is commissioned and not after, removes most of the ambiguity and often changes what gets validated.

Frequently asked questions

What is ISO 17664?

ISO 17664 is the series of standards that specifies the information a medical device manufacturer must provide for the processing of a device: cleaning, disinfection, drying, inspection, packaging, sterilisation, storage and transport. It applies to reusable devices and to single-use devices supplied non-sterile. It requires the manufacturer to validate every process named in the instructions; it does not regulate how hospitals run their processing departments.

What is the difference between ISO 17664-1 and ISO 17664-2?

Part 1 covers critical and semi-critical devices, meaning devices that enter sterile parts of the body or contact mucous membranes or non-intact skin, and any device intended to be sterilised. Part 2 covers non-critical devices that contact intact skin only or do not touch the patient, and that are not sterilised. Part 1 addresses ten processing activities; Part 2 addresses eight and has no sterilisation clause.

Is ISO 17664 a harmonised standard under the EU MDR?

Yes, for both parts. EN ISO 17664-1:2021 was added to the list of MDR harmonised standards by Implementing Decision (EU) 2022/6 of 4 January 2022, and EN ISO 17664-2:2023 by Implementing Decision (EU) 2024/815 of 6 March 2024. The presumption of conformity is limited to the Annex I requirements listed in Annex ZA of each European edition. ISO/TS 17664-3:2026 is a Technical Specification and is not harmonised.

Does the FDA recognise ISO 17664?

Partly. ISO 17664-2:2021 is recognised as a complete standard under recognition number 14-579. ISO 17664-1:2021 is recognised in part under number 14-578: Clauses 6.6.1.1, 6.7.1.1 and 6.8 and item i) of Clause 6.11.3 are excluded because they conflict with the FDA's 2015 guidance on reprocessing medical devices in health care settings. Where the two differ, the guidance governs a US submission.

Does ISO 17664 require cleaning validation?

Yes. Clause 4 requires the manufacturer to validate each process identified in the processing instructions, cleaning included, and to hold objective evidence of it. The standard does not set the test method or the acceptance criteria. In practice laboratories and reviewers work to ANSI/AAMI ST98:2022 or ISO 15883-5:2021, with protein at no more than 6.4 micrograms per square centimetre as the best-known limit.

How many reprocessing cycles does a manufacturer have to validate?

ISO 17664 sets no number. Clause 6.3 requires the manufacturer to state how many processing cycles the device normally tolerates, or to give another indication of end of life, whenever processing limits its useful life, and EU MDR Annex I Section 23.4(n) asks for the same information. Whatever limit is stated has to be supported by a repeated-cycle study that tests function, materials and markings at that limit.

Does ISO 17664 apply to single-use devices?

It applies to single-use devices that are supplied non-sterile and have to be cleaned, disinfected or sterilised by the user before their one use, such as implants delivered in trays. It does not apply to single-use devices supplied ready for use. The reprocessing of used single-use devices is a separate matter, governed in the EU by Article 17 of the MDR and by national law.

What is ISO/TS 17664-3?

ISO/TS 17664-3:2026, published on 30 June 2026, is a Technical Specification giving guidance on how to assign reusable devices to product families and to cleaning classification categories: M1 to M3 for manual cleaning and A1 to A3 for automated cleaning. It supports the choice of master product for cleaning validation. It is guidance, not a harmonised standard, and it does not cover disinfection or sterilisation.

Conclusions

The standard asks for one discipline: nothing goes into the processing instructions that has not been validated, and nothing is validated that is not what the instructions say. Everything else in the series, from the ten activities to the product family rules, is a way of applying that discipline to a particular step.

In practice that means working in a fixed order. Decide the part from the claims, not from the product type. Run the risk analysis before the instructions are drafted, so that design carries what it can and the instructions carry the remainder. Build the family rationale as a matrix and accept that cleaning and sterilisation have different worst cases. Write the instructions in the order of Annex B, state the parameters with their tolerances, and validate at the unfavourable end of each. Put a number or an observable criterion on end of life. Then split the sterilisation parameters by market, because Europe and the United States do not accept the same cycles.

Two developments of 2026 should be on the agenda of the next file review: ISO/TS 17664-3 for the family rationale, and for class I reusable devices the direct-marking date of 26 May 2027, which adds the durability of the UDI carrier to the repeated-cycle study.

If the technical file around the processing instructions still has to be built, the EU MDR Technical Documentation Kit on MD Regulatory includes the templates for Labelling and Instructions for Use, the General Safety and Performance Requirements and Product Verification and Validation, all aligned with Annex II and immediately deployable in an existing ISO 13485 quality management system.

Related articles

• Biocompatibility Testing for Medical Devices: ISO 10993 Guide
• EU MDR Transition Deadlines 2027 and 2028
• 510k Submission: Substantial Equivalence and eSTAR