How Medical Device Manufacturers Validate Toolpaths for FDA Compliance

TL;DR: A toolpath is never validated on its own. Three separate activities do that work: the machining process is validated through IQ, OQ, and PQ; the CAM software is validated for production on a risk basis; and each program is verified in simulation before it cuts. Verification confirms a program. Validation proves a process.

Toolpath validation is shop shorthand, and it hides a distinction that matters the moment an auditor is in the building. No quality standard contains a clause requiring you to validate a cutter path. What the regulation attaches to is the manufacturing process and the software that runs it. Three separate activities get collapsed into that one phrase. They rest on different regulatory bases, they produce different records, and they fail inspections in different ways. Keeping them apart is the difference between a process that holds up and a folder of simulations that does not.

What Toolpath Validation Means Under FDA Rules for Medical Device Manufacturing

The phrase usually means one of three things. The first is software validation: confirming that the CAM application you run in production reliably does the things you depend on it to do. The second is process validation: showing through Installation, Operational, and Performance Qualification that a specific machine, running a specific program on a specific material and setup, produces conforming parts run after run. The third is toolpath verification: checking one program through cut simulation and first-article inspection before it touches real stock.

Only the first two are validation in the regulatory sense. The third is verification. Treating a passed simulation as if it were a validated process is one of the more reliable ways a machined-component supplier gets written up, because a drawer of clean simulations proves the programs were checked and proves nothing about whether the process making the parts is in a validated state.

What FDA-Compliant CNC Machining Requires Under the QMSR

Worth saying plainly, because vendors blur it: there is no FDA-compliant CAM software, and there is no FDA-compliant CNC machine. The FDA does not certify, approve, or register software or machine tools. Compliance is a property of a validated process and a documented quality system, not of anything you can buy. A tool can support a compliant process. It cannot confer compliance, and any product sold on the promise that it can is selling a misunderstanding of the regulation.

What moved the baseline is the Quality Management System Regulation, effective February 2, 2026. It amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, retiring the old Quality System Regulation, and it made risk management explicit across the quality system rather than concentrated in design. On the same date the FDA dropped the Quality System Inspection Technique and moved to the inspection program described in Compliance Program 7382.850. For a machining operation the practical effect is that process and software validation expectations now run through ISO 13485, and the justification for what you validate, and how hard, is expected to be risk-based.

The change is smaller than it sounds for shops already certified to ISO 13485, which is most established medical suppliers. But certification is not compliance. A certificate scoped to “design and assembly” does not cover machining, no QMSR certificates are issued, and a certificate does not stand in for an FDA inspection. The records still have to exist, and they still get read.

How to Run IQ, OQ, and PQ Process Validation for Machined Medical Components

The trigger for process validation is one question, drawn from ISO 13485 section 7.5.6: can the output of this process be fully verified by later inspection or test? If yes, inspection may be a legitimate control on its own. If no, the process has to be validated.

This is where I will push back on the reflex to validate everything, because machining is genuinely different from sterilization or molding. A large share of machined dimensions can be fully inspected. A bore, a thread, a flange thickness: a CMM can check them on every part if you are willing to pay for the cycle time. For those features inspection is a defensible control, and over-validating them spends qualification effort that should go to the features you cannot fully inspect, internal geometry a probe cannot reach, surface integrity and residual stress on a load-bearing implant, anything that would take destructive testing to confirm. Decide feature by feature, on risk.. The regulation now expects exactly that kind of reasoning.

H3: Installation Qualification

IQ records that the machine and its supporting systems are installed and configured to specification, controller, software version, calibration baselines, utilities, workholding. The output is a known, documented starting configuration. Without that baseline, every run after it is hard to defend, because you cannot show what state the equipment was in when it made the part.

H3: Operational Qualification

OQ exercises the process across its operating range, including the worst-case conditions you expect, and confirms it stays inside defined limits. For a machined part this is where feeds, speeds, tooling, and program parameters get run against their boundaries instead of a comfortable nominal. It is also where change control and program verification get tested rather than assumed.

H3: Performance Qualification

PQ shows that the whole process, run under production conditions by production staff, makes conforming parts consistently across multiple runs. This is where capability is established. Many medical programs target a process capability index near 1.67 on critical-to-quality features, tighter than the 1.33 common in general manufacturing, because the cost of an out-of-tolerance feature is measured in patient risk. Process validation has for years been among the most frequently cited findings in device inspections, which tells you how often PQ is treated as a formality instead of evidence.

Why CAM Software Validation Is a Separate, Risk-Based Requirement Under FDA Rules

Validating the CAM software is a different obligation from validating the machining process, and since September 2025 the FDA has been explicit that it is risk-based. The final Computer Software Assurance guidance, which supersedes the section of the agency’s older General Principles of Software Validation that covered automated production and quality-system software, tells manufacturers to scale assurance effort to the risk a given software function poses to product quality, instead of re-testing a vendor’s entire product as if they had written it. You confirm that the specific version, configured the way you use it, reliably performs the functions you rely on, and you control what happens when that configuration changes. ISO 13485 section 7.5.6 covers software used in production; section 4.1.6 covers software in the wider quality system.

One practical consequence is that a platform with a long installed base in regulated machining is easier to put through assurance than a novel one, because its behavior is well characterized and its output is predictable across versions and machines. That track record is itself part of the risk argument. It is one reason established CAM software for medical device manufacturing tends to come from vendors with years of work in the sector. The software still does not make the process compliant. It makes the part of the file that covers the software more straightforward to assemble.

What CNC Toolpath Simulation Verifies and What It Does Not Cover

Cut simulation is the most useful verification a programmer has, and on multi-axis work or expensive titanium and cobalt-chrome stock it pays for itself the first time it catches a collision. Good simulation models material removal, finds gouges, checks the full tool assembly, the holder, and extension and spindle, against the part and fixture, and extends to the machine envelope. It catches the geometry and clearance errors that would otherwise show up in metal.

What it does not do is model the things that actually push a part out of tolerance in production. Simulation assumes a rigid tool, nominal material, and a perfect setup. It does not see tool wear across a run, lot-to-lot variation in the stock, fixturing drift, thermal growth in the machine, or deflection under real cutting load. A program that simulates flawlessly can still produce parts that drift on the floor. That gap is the whole reason simulation verifies a program while PQ and in-process monitoring validate a process. They are not interchangeable, and a quality system that files a passed simulation as evidence of a validated process has documented the wrong thing.

How CAM Software Changes Invalidate a Validated Machining Process

The validation most shops get wrong is the revalidation after a change. A validated state is tied to a configuration, and several changes that feel routine move the process outside it: a CAM upgrade, a new or edited post-processor, a substituted tool, a reworked fixture, a changed parameter set. Each one is a candidate for revalidation, full or partial, and the decision is a risk decision.

The post-processor earns specific attention, because it is the step between a verified toolpath and the G-code the machine actually runs, and it is easy to treat as invisible plumbing. For shops running RhinoCAM or VisualCAD/CAM in medical machining, the post-processor is part of the validated configuration, and swapping it uncontrolled breaks the validated state. In a validated process, the post is part of the validated configuration. Swapping in an uncontrolled post, or hand-editing the output to make a stubborn job run, breaks the traceability that proves the validated state, because the code that cut the part no longer corresponds to anything you qualified.

The discipline that survives an inspection is the unglamorous one: for any given lot, the program revision, the post, the tool list, and the parameters that produced it are traceable to that lot, and the configuration that made the part is the one you validated.

What Separates a Validated Manufacturing Process from a Documented One

A binder of protocols is not a validated process. The shops that come through inspections cleanly are the ones whose records can answer one deceptively plain question about any finished lot, what produced this, and is that still the configuration we qualified?

That is the discipline the regulation actually rewards. Validation is more than an event you finish and file. It is the ongoing discipline of holding a process inside the conditions you proved it under, and catching it when it drifts out. The regulation, stripped down, asks for the same thing a careful engineer wants anyway: evidence that the part on the bench was made the way you said it would be, every time. On a component that goes into a patient, consistency is the entire point.