Standard 17025 — A map of requirements for a testing laboratory
ISO/IEC 17025 is one standard but twenty separate areas, each assessed differently. We laid them out the way a laboratory sees them: what it is about, what has to be shown and where a nonconformity most often falls. Each area will be developed separately.
- 8 — clauses of the standard
- 20 — requirement areas
- A / B — management system options
- 2017 — edition, confirmed in 2023
How the standard is built
Eight clauses, but the requirements — what an assessor checks — only begin in clause 4. The first three say what the standard covers, which documents it refers to and how to read its terms. That is why the map below runs from 4 to 8.
- 1. Scope (no requirements) — Who the standard is for: any testing or calibration laboratory, whatever its size or field.
- 2. Normative references (no requirements) — Documents needed to read the standard — above all the vocabulary of metrology and the requirements for conformity assessment.
- 3. Terms and definitions (no requirements) — How the standard understands impartiality, complaint, interlaboratory comparison, validation or decision rule.
4. General requirements
⚖️ clause 4.1 — Impartiality
The laboratory has to be impartial and be able to show it: no pressure from the owner, a client or its own sales department may influence a result. Risks to impartiality must be identified on an ongoing basis, not once at accreditation.
What the assessor wants to see:
- A recorded analysis of risks to impartiality — from ownership, personal ties and the way people are paid.
- Evidence that management committed to impartiality and that staff signed up to it.
- An example of how the laboratory handled a specific threat, e.g. testing for a company in the same group.
Most common nonconformity: The risk analysis reduced to a single sentence "no risks identified" — without considering own clients and ownership structure.
🔒 clause 4.2 — Confidentiality
Everything the laboratory knows about a client and its samples is confidential — including the fact that a test was ordered at all. The exception is a legal duty, of which the client must be informed unless the law forbids it.
What the assessor wants to see:
- Confidentiality undertakings signed by staff, subcontractors and outsiders who have access to data.
- Permissions in the IT system: who sees which client’s results and how access is withdrawn.
- The rule for informing a client when results must be disclosed by law.
Most common nonconformity: A shared system account for the whole shift — impossible to show who saw and who changed client data.
5. Structural requirements
🏛️ clause 5 — Structure and responsibility
The laboratory must be a legal entity or a defined part of one, have management responsible for the whole of its laboratory activities and a clearly described range of those activities. The structure has to show who makes technical decisions and who keeps the management system running.
What the assessor wants to see:
- An organisation chart with the laboratory’s place in the company and its relation to departments that might press for a result.
- The range of laboratory activities written so that it can be compared with the scope of accreditation.
- Deputies for key functions — who authorises reports when the manager is away.
Most common nonconformity: The person authorising reports reports to the sales department, and the laboratory cannot explain how the independence of decisions is protected.
6. Resource requirements
👩🔬 clause 6.2 — Personnel
For every activity that influences a result the laboratory defines the required competence, checks it before allowing independent work and supervises afterwards. Authorisation for a specific method is a separate act — it does not follow from employment.
What the assessor wants to see:
- A competence matrix: person × method × status (in training, authorised, supervising) with dates.
- Records of competence monitoring — replicate tests, blind samples, observation at the bench.
- Evidence that the person performing a test on the day of the visit was authorised for that method on that day.
Most common nonconformity: Authorisations issued "for the laboratory" instead of per method — a new method in the scope and nobody authorised for it.
🌡️ clause 6.3 — Facilities and environmental conditions
The conditions under which tests are performed must suit the method and must not invalidate results. The laboratory itself decides which conditions matter, monitors them and acts when they leave the permitted range.
What the assessor wants to see:
- A list of conditions relevant to each method with limits — temperature, humidity, cleanliness, electromagnetic field, noise.
- Monitoring records and evidence of what was done with results obtained while a condition was exceeded.
- Separation of areas that could contaminate one another and the access rules for them.
Most common nonconformity: The thermometer in the balance room shows an exceedance for a week and the weighing records show no trace of any reaction.
🔬 clause 6.4 — Equipment
Every piece of equipment that influences a result has to be checked before use, calibrated where accuracy matters and controlled throughout its life. If equipment failed, the laboratory has to assess what happened to earlier results.
What the assessor wants to see:
- An equipment register with identification, location, calibration and check dates and acceptance criteria.
- A programme of intermediate checks between calibrations — what, how often, with which reference.
- Handling of equipment after a failure: labelling, withdrawal from use, assessment of the impact on earlier tests.
Most common nonconformity: The calibration certificate is in the binder, but nobody assessed whether the reported errors fit the method requirements.
🔗 clause 6.5 — Metrological traceability
A measurement result has to be linked through an unbroken chain of calibrations to an SI unit, with a known uncertainty at every link. Where reference to the SI is not possible, the laboratory demonstrates traceability to a certified reference material or an agreed method.
What the assessor wants to see:
- Calibration certificates from accredited laboratories or national metrology institutes — with the uncertainty stated.
- Reference material certificates with value and uncertainty, plus records of their use and expiry dates.
- A description of the chain for measurements where reference to the SI does not exist, e.g. in microbiology.
Most common nonconformity: Calibration by a supplier without accreditation, "because it has always been so" — the chain breaks at the first link.
🚚 clause 6.6 — Externally provided products and services
Reagents, standards, calibrations, subcontracted tests — everything that comes from outside and influences a result is evaluated by the laboratory before purchase, checked on receipt and controlled over time. For a subcontractor’s result it is as responsible as for its own.
What the assessor wants to see:
- Supplier evaluation criteria and records of applying them — not just a list of "approved" ones.
- Receipt records: reagent batch, certificate, date, who checked and against what.
- For subcontracting: the subcontractor’s scope checked for the specific method, not merely the fact of accreditation.
Most common nonconformity: A test subcontracted to a laboratory that is accredited, but not for that method — and the report does not mark the result as external.
7. Process requirements
📝 clause 7.1 — Review of requests, tenders and contracts
Before accepting an order the laboratory has to check that it understands what the client wants and that it has the method, resources and competence to do it. If the client asks for a statement of conformity, the decision rule must be agreed at this stage.
What the assessor wants to see:
- A review record for non-standard orders: who assessed feasibility, what was agreed with the client, when.
- Evidence that the client chose the method knowingly when several are available — or that the laboratory informed it of the choice.
- The agreed decision rule in orders that are to include a statement of conformity.
Most common nonconformity: A report stating "meets requirements" with no trace in the order of any agreement on how to treat uncertainty at the limit.
📐 clause 7.2 — Selection, verification and validation of methods
A standard method is verified by the laboratory — it confirms it can perform it with the declared parameters. An in-house, modified or out-of-scope method is validated — the laboratory proves it is fit for purpose. A change in the method starts this over.
What the assessor wants to see:
- Verification reports for standard methods and validation reports for the rest — with parameters, criteria and result.
- A current list of methods with standard versions; evidence that staff work to the edition in force.
- For a modified method: what exactly was changed and why the validation covers that change.
Most common nonconformity: A new edition of the standard has been in force for a year and the laboratory still verified the method against the previous one — without assessing what changed.
🧴 clause 7.3 — Sampling
If the laboratory takes samples itself, it has a sampling plan and method based on statistics rather than habit, and records everything that could influence the result: place, time, conditions, person, deviations. A badly taken sample invalidates the best test.
What the assessor wants to see:
- The sampling plan: how many samples, from where, in what order and why that way.
- Field records with conditions, identification of the sampler and their authorisation.
- A record of deviations from the plan — and whether the client was told about them in the report.
Most common nonconformity: The client took the sample and the report says nothing about it — the result looks fully accredited.
📦 clause 7.4 — Handling of test items
From receipt to disposal a sample must be unambiguously identified, protected from damage, mix-up and contamination, and doubts about its condition cleared with the client before testing. Identification has to survive splitting the sample and moving it between rooms.
What the assessor wants to see:
- An identification system that cannot confuse two samples from the same client on the same day.
- A record of the sample’s condition on receipt and the decision when the condition departs from what is required.
- Storage conditions with temperature records and evidence that exceeding the holding time is caught.
Most common nonconformity: A water sample for microbiology tested after the holding time had passed — without a note in the report.
🗂️ clause 7.5 — Technical records
Records must allow a test to be reconstructed years later: who, when, on what equipment, with which intermediate result and who checked. A correction does not erase the original entry — the new value, date and signature stand next to it.
What the assessor wants to see:
- A randomly chosen report from a year ago and the full path to raw data: sample, equipment, reagent, person.
- The way records are corrected — on paper and in the system — and who is allowed to do it.
- In the IT system: a change log with date, person and the value before the change.
Most common nonconformity: A spreadsheet of results where anyone can overwrite a number without a trace — the assessor asks how you know it is the original value.
📊 clause 7.6 — Measurement uncertainty
The laboratory has to identify the contributions to the uncertainty of every measurement and evaluate it so that all significant ones are included — sampling included, if it performs it. Where a rigorous calculation is not possible, an estimate based on knowledge of the method and quality control data is enough.
What the assessor wants to see:
- An uncertainty budget for every method in the scope — with sources, type A or B evaluation and the coverage factor.
- Evidence that the estimate is reviewed after a change of equipment or method, or after proficiency testing results.
- The way uncertainty is stated on the report and whether the client understands what it means.
Most common nonconformity: One uncertainty budget copied from a textbook example for all matrices — without the laboratory’s own replicate data.
🎯 clause 7.7 — Ensuring the validity of results
The laboratory monitors its results in two ways: internally — with control charts, blanks, replicates, reference materials — and externally, through proficiency testing and interlaboratory comparisons. Monitoring data must be analysed, and a trend outside the criterion is a reason to act before a result reaches the client.
What the assessor wants to see:
- A proficiency testing participation plan that over time covers every method in the scope, with results and actions after questionable ones.
- Control charts kept up to date, with limits and a documented response to points outside them.
- Evidence that monitoring data is analysed as a trend rather than filed away.
Most common nonconformity: A "questionable" proficiency testing result from six months ago with no root cause analysis — and the method still in use.
📄 clause 7.8 — Reporting of results
A report must present the result accurately, clearly and unambiguously, with all the information the client needs to understand it: method, date, uncertainty where it matters, deviations, subcontractor results marked as such. A statement of conformity requires the decision rule to be stated.
What the assessor wants to see:
- The report template checked item by item against the list of required elements — and a random report compared with that template.
- The way an amended report is issued: a new document with an unambiguous reference to the one replaced.
- Marking of results outside the scope of accreditation and of subcontractor results.
Most common nonconformity: An amended report issued under the same number, with no trace that the previous version ever existed.
📮 clause 7.9 — Complaints
The laboratory has a documented process for receiving, evaluating and deciding on complaints, available to anyone who asks. A complaint is handled by people not involved in the matter, and the complainant is told the outcome and that the process is closed.
What the assessor wants to see:
- A complaints register with dates, the decision whether it is a complaint in the sense of the standard, and who handled it.
- Evidence that the person handling it was not involved in the disputed test.
- The reply to the complainant and the linked corrective action if the complaint was justified.
Most common nonconformity: The client’s complaint was settled by phone "as a favour" — the register is empty and the error in the method remains.
🚧 clause 7.10 — Nonconforming work
When anything — a result, a condition, a procedure — departs from requirements, the laboratory has settled who decides to stop work, what happens to results already issued and when work may resume. Assessing the significance of the nonconformity is a separate step, not a default "it is nothing".
What the assessor wants to see:
- A register of nonconforming work with the significance assessment and the decision to stop or continue.
- Evidence that the client was notified and the report recalled when the nonconformity concerned an issued result.
- The link to corrective action where the nonconformity could recur.
Most common nonconformity: An expired standard used for a month; results issued, clients not informed, nothing in the register.
💾 clause 7.11 — Control of data and information management
The IT system that collects, processes and stores results must be validated before use and after every change, protected against unauthorised access and data loss, and its calculations checked. That includes spreadsheets and the instrument manufacturer’s software.
What the assessor wants to see:
- Validation records for the LIMS and calculation spreadsheets — with test cases and outcome.
- Role-based permissions, a change log, backups with tested restore.
- The agreement with the system vendor describing who is responsible for infrastructure, updates and incidents.
Most common nonconformity: An uncertainty spreadsheet in which somebody overwrote a formula after an update — nobody checked, because the sheet "always worked".
8. Management system
📚 clause 8.1–8.4 — System option, documentation, documents and records
The laboratory chooses option A — its own management system built to the standard’s requirements — or option B, when it operates within a system conforming to ISO 9001. In both cases policies, procedures and records must be controlled: current versions available where they are used, records legible, protected and kept for a defined period.
What the assessor wants to see:
- A list of system documents with versions and approval dates; no obsolete editions at workstations.
- Record retention rules: how long, where, who has access and how destruction is done.
- For option B: evidence that the ISO 9001 system genuinely covers the laboratory activities.
Most common nonconformity: Procedure version 4 approved, while the printout at the bench is version 2 — staff work to the obsolete one.
🧭 clause 8.5–8.7 — Risks and opportunities, improvement, corrective actions
Instead of the old preventive actions the standard requires the laboratory to consider risks and opportunities related to its activities and to act in proportion to their impact on the validity of results. Every nonconformity has to lead to removing the cause, not just the effect, and the effectiveness of the action has to be checked.
What the assessor wants to see:
- A risk register with impact assessment and actions taken — reviewed, not created once before accreditation.
- A root cause analysis for audit nonconformities, not merely the removal of the identified gap.
- An effectiveness review of corrective actions after a set time, signed by the reviewer.
Most common nonconformity: The same nonconformity in three consecutive audits, each time "closed" by correcting a single record.
🔁 clause 8.8–8.9 — Internal audits and management review
The laboratory checks itself at planned intervals whether its system meets the standard’s and its own requirements, and management periodically looks at the whole: audit results, complaints, proficiency testing, risks, resources. The review has to produce decisions, not minutes for their own sake.
What the assessor wants to see:
- An audit programme covering in a cycle every clause of the standard and every section, with auditors independent of the audited area.
- Management review minutes with the full set of inputs required by the standard and specific decisions with deadlines.
- Evidence that decisions from the previous review were carried out.
Most common nonconformity: The quality manager audits their own department, and the management review minutes are a list of topics without a single decision.
Aspects of the standard we develop
🔀 Option A or option B — how to choose the management system
The standard offers two routes to the same goal. Option A is a stand-alone system built from its own requirements; option B — an ISO 9001 system that already exists in the company and that the laboratory merely adapts.
- Option A suits a stand-alone laboratory: eight clauses from 8.2 to 8.9 describe the minimum — documentation, control of documents and records, risks, improvement, corrective action, audits, review.
- Option B makes sense when the laboratory is part of a larger organisation certified to ISO 9001 — the parent system must genuinely cover the laboratory activities, not merely mention them.
- An ISO 9001 certificate is no proof of technical competence: the assessor will still check clauses 4–7 in full.
- Switching options is possible but costly: the documentation has to be remapped and it has to be shown that no requirement fell out of the system.
📈 Measurement uncertainty: type A, type B and a budget that survives an audit
A type A evaluation rests on statistics from repeated measurements; a type B evaluation — on knowledge: the calibration certificate, instrument resolution, manufacturer data, drift between calibrations, environmental effects. A good budget combines both and says where every number came from.
- Start with a cause diagram: sample, method, instrument, standard, environment, person — and at each branch ask whether the influence is significant or negligible.
- Express the components in the same form — standard uncertainty — before combining them; mixing standard deviations with "± from the certificate" is the most common arithmetic error.
- Expanded uncertainty is the combined uncertainty multiplied by the coverage factor, usually 2 for a confidence level of about 95% — and that is how it goes on the report.
- The budget lives: after a new calibration certificate, after a method change and after a proficiency testing result it has to be reviewed, and the review recorded.
✅ Decision rules and guard bands — when a result "meets the requirement"
When a result lies close to a limit, the number alone is not enough — you have to know how to treat the uncertainty. The standard requires the decision rule to be agreed with the client before testing and stated on the report with every statement of conformity.
- Simple acceptance: the result is compared with the limit directly, ignoring uncertainty — the risk of a wrong decision at the limit reaches 50% and the client has to know that.
- Guard band: the limit is moved inwards by part of the expanded uncertainty; a result inside the band is neither "pass" nor "fail" but "undetermined".
- The rule may come from a regulation or the client’s specification — then the laboratory does not choose it, but still has to state it on the report.
- Without an agreed rule a statement of conformity is a nonconformity in itself — one of the most frequent findings in audit reports.
🤖 Digitalisation, artificial intelligence and standard 17025
The standard contains no word "AI" and has no annex on artificial intelligence. Everything concerning digital tools follows from clause 7.11 and from the 2024 guidelines of the European laboratory federation: risk assessment, data security, system validation.
- An AI tool that reads a document or suggests a value is software in the sense of 7.11: it needs validation on the laboratory’s own data, control of version changes and access control.
- Responsibility for a result does not pass to the vendor: conformity assessment and authorisation of the report remain acts of the authorised person.
- The audit trail has to cover the reading itself: source document, time, model version, proposed value next to the approved one, accepting person.
- ISO/IEC 42001 on AI management systems is a separate, complementary certification path — it neither replaces accreditation nor forms part of it.