ISO 17025: A Comprehensive Guide for Labs

ISO/IEC 17025:2017 is the international standard that sets requirements for the competence, impartiality, and consistent operation of testing and calibration laboratories. The current edition was published in 2017 and reviewed and confirmed by ISO in 2023, so it remains current.

Its primary laboratory requirements are organized into five areas:

• Clause 4: General requirements
• Clause 5: Structural requirements
• Clause 6: Resource requirements
• Clause 7: Process requirements
• Clause 8: Management system requirements

These requirements touch nearly every part of laboratory operations, including personnel competence, equipment, metrological traceability, sample handling, technical records, data management, corrective actions, internal audits, and management review.

If your lab is preparing for ISO 17025 accreditation, the challenge is not simply creating more documentation. You need to demonstrate that your people, methods, equipment, records, technical processes, and management system work together consistently.

In this guide, we'll break down what ISO 17025 requires, what changed in the 2017 edition, how accreditation works, and where a QMS or LIMS can support your lab.

What Is ISO/IEC 17025?

ISO/IEC 17025 is an international standard for organizations performing testing and calibration. Its scope also covers sampling when it is associated with subsequent testing or calibration.

For accreditation, an accreditation body evaluates whether your laboratory meets applicable management and technical requirements and is competent to perform the activities included within its defined scope.

That makes ISO 17025 different from a general quality management standard. Accreditation is about more than documented procedures. Your lab also needs the people, methods, facilities, equipment, technical controls, and records necessary to perform its work competently.

Is ISO 17025 Mandatory?

ISO 17025 is not universally mandatory for every laboratory. Whether accreditation is required depends on your industry, location, testing scope, customer requirements, contracts, and applicable regulatory or accreditation programs.

Environmental laboratories, for example, may also face state-specific or NELAP accreditation requirements depending on where they operate and the testing they perform.

Rather than assuming every laboratory has the same obligation, determine which regulators, programs, customers, or contracts apply to your work.

ISO 17025 Accreditation vs. Certification

Laboratories are accredited to ISO 17025, not certified. Accreditation evaluates whether a laboratory is competent to perform specific testing or calibration activities within a defined scope.

Certification is different. ISO 9001 certification, for example, evaluates an organization's quality management system rather than establishing technical competence for specific laboratory activities.

Why Do Labs Pursue ISO 17025 Accreditation?

ISO 17025 accreditation provides independent evidence that your laboratory has been assessed for competence within a defined scope.

It can also create clearer controls around:

• Personnel competence and training
• Equipment and calibration records
• Methods and technical procedures
• Sample handling
• Technical records
• Measurement uncertainty
• Result review and reporting
• Nonconforming work
• Corrective actions
• Document and record control
• Internal audits
• Management review

In practical terms, laboratories need to be able to answer questions such as:

• Who performed this work?
• Which method did they use?
• What equipment was involved?
• Which procedure version applied?
• What happened when something went wrong?

ISO 17025 gives laboratories a structured framework for answering those questions.

Which Labs Should Consider ISO 17025?

ISO/IEC 17025 is relevant to organizations performing testing, calibration, and applicable sampling activities. That can include commercial testing laboratories, calibration laboratories, environmental laboratories, manufacturers' internal laboratories, government laboratories, and university laboratories.

For environmental and manufacturing laboratories, accreditation can be closely connected to customer requirements, regulatory programs, contracts, or specific testing scopes.

Environmental laboratories can learn more in our guide to choosing a LIMS for an environmental testing lab. Manufacturing laboratories can also review our LIMS buyer's guide for manufacturing labs.

What Are the Requirements of ISO 17025?

Clause 4: General Requirements

Clause 4 covers impartiality and confidentiality.

Your laboratory needs to conduct activities impartially, identify risks to impartiality, and protect confidential information created or obtained during laboratory work.

In practice, consider:

• Who can access customer and laboratory information?
• How are conflicts of interest addressed?
• Could commercial pressure influence laboratory work?
• How is confidential information protected?

Software access controls can support confidentiality, but policies, responsibilities, and employee practices matter too.

Clause 5: Structural Requirements

Clause 5 addresses your laboratory's organizational structure and responsibilities.

Your organization needs clearly defined responsibility and authority for laboratory activities. If your laboratory is part of a larger organization, its role and relationships should also be clear.

Your team should know who owns processes, approves changes, reviews work, and has authority to respond when problems occur.

Clause 6: Resource Requirements

Clause 6 covers:

• 6.2 Personnel
• 6.3 Facilities and environmental conditions
• 6.4 Equipment
• 6.5 Metrological traceability
• 6.6 Externally provided products and services

Clause 6.2: Personnel

Your lab needs to define competence requirements for personnel whose work can affect laboratory activities and maintain evidence of that competence.

Depending on the work, this can involve education, qualifications, training, knowledge, skills, experience, and authorization.

For QA/QC teams, the practical challenge is keeping those records controlled and traceable.

Clause 6.3: Facilities and Environmental Conditions

Facilities and environmental conditions can affect the validity of results.

Depending on your activities, you may need to specify, monitor, control, and record conditions such as temperature, humidity, contamination, or separation of incompatible activities.

Clause 6.4: Equipment

Your laboratory needs appropriate controls for equipment that can influence laboratory activities and results.

Depending on the equipment and its intended use, that can include:

• Identification and status
• Calibration or verification where required
• Maintenance
• Handling and storage
• Supporting documentation
• Records of damage, malfunction, or repair where applicable

When equipment information is spread across spreadsheets, service reports, paper records, calendars, and email, answering basic questions can require significant manual reconciliation.

For a deeper look, read How a LIMS Helps With Lab Equipment Maintenance & Scheduling.

Clause 6.5: Metrological Traceability

Metrological traceability is a property of a measurement result that allows it to be related to a reference through a documented, unbroken chain of calibrations, with each calibration contributing to measurement uncertainty.

The important distinction is that traceability belongs to the measurement result, not simply to an instrument or calibration certificate.

Clause 6.6: Externally Provided Products and Services

Your laboratory also needs controls around external products and services that can affect laboratory activities.

That may include calibration providers, proficiency testing providers, reference materials, outsourced laboratory activities, and other suppliers.

Clause 7: Process Requirements

Clause 7 follows work through the laboratory:

• 7.1 Review of requests, tenders, and contracts
• 7.2 Selection, verification, and validation of methods
• 7.3 Sampling
• 7.4 Handling of test or calibration items
• 7.5 Technical records
• 7.6 Evaluation of measurement uncertainty
• 7.7 Ensuring the validity of results
• 7.8 Reporting of results
• 7.9 Complaints
• 7.10 Nonconforming work
• 7.11 Control of data and information management

Requests, Methods, and Samples

Before work begins, your laboratory needs to determine whether it can meet customer requirements and whether the selected method is appropriate. Where sampling is part of your laboratory activities, appropriate plans, methods, and records are required.

Once samples or calibration items enter the laboratory, their identity and condition need to be maintained. This is where chain of custody becomes important for many environmental laboratories.

For a deeper look at that process, see How to Implement a Chain of Custody Program in Your Lab.

Technical Records

A final result alone does not tell the complete story of how laboratory work was performed. Technical records need to preserve enough information to understand the work and identify factors that could affect the result. Depending on the activity, that can include raw data, observations, calculations, personnel, methods, equipment, and changes.

Measurement Uncertainty and Validity of Results

Your laboratory needs to evaluate measurement uncertainty where required and where it is relevant to the validity or interpretation of a result.

You also need processes for monitoring the validity of results. Depending on your work, this can include quality control activities, reference materials, replicate testing, proficiency testing, or interlaboratory comparisons.

Reporting, Complaints, and Nonconforming Work

Results need to be reviewed and reported accurately, clearly, and with the information required for the work being performed.

Your laboratory also needs controlled processes for complaints and nonconforming work. When work does not meet your procedures or agreed customer requirements, your lab may need to control affected work, evaluate its impact, review previous results, and determine what action is necessary.

Clause 7.11: Data and Information Management

Clause 7.11 addresses the systems used to collect, process, record, report, store, and retrieve laboratory information.

ISO 17025 does not require a LIMS. The requirements apply whether information management is computerized, non-computerized, or a combination of both.

For computerized systems, laboratories need to consider:

• Who can access or change information?
• How is information protected from unauthorized access, tampering, or loss?
• How are system changes controlled?
• Are calculations and data transfers checked where required?
• What happens if the system becomes unavailable?

There is another important responsibility here: your laboratory needs to confirm that the software it uses performs correctly for its intended use. That means software should not be treated as validated simply because the vendor provides it or because it worked in another laboratory. Your team needs to understand what the software is expected to do in your specific workflow and verify that it performs those functions appropriately.

For example, automated calculations need to produce the result required by the method your laboratory is actually following. A2LA's guidance on ISO/IEC 17025 and laboratory automation provides additional context on this responsibility.

QBench's Security & Compliance controls include role-based user access, HTTPS encryption for transmitted data, regular backups, and audit trail functionality.

For more on data controls, read What Every Lab Needs to Know About Data Integrity.

Clause 8: Management System Requirements

Clause 8 addresses the management system supporting your laboratory's work.

Under Option A, the laboratory addresses Clauses 8.2 through 8.9, including:

• Management system documentation
• Document control
• Record control
• Risks and opportunities
• Improvement
• Corrective actions
• Internal audits
• Management reviews

Under Option B, a laboratory operates a management system in accordance with ISO 9001 that supports consistent fulfillment of ISO 17025 Clauses 4 through 7 and the intent of the management system requirements.

Using Option B does not remove ISO 17025's technical requirements.

What Changed in ISO/IEC 17025:2017?

ISO/IEC 17025:2017 replaced the 2005 edition and introduced several important changes.

Broader Scope

The scope more clearly addresses testing, calibration, and sampling associated with subsequent testing or calibration.

Greater Focus on Information Technology

Clause 7.11 more directly reflects computerized systems, electronic information, and data transfers.

Risk-Based Thinking

The 2017 edition places greater emphasis on identifying and addressing risks and opportunities rather than relying on a standalone preventive-action requirement.

More Process-Oriented Requirements

The revision places greater emphasis on laboratory processes and outcomes rather than prescribing one specific way to manage them.

ISO 17025 vs. ISO 9001

ISO 9001 is a general quality management system standard that can apply across industries.

ISO 17025 includes management system requirements but adds technical requirements specifically for laboratories, including competence, equipment, metrological traceability, methods, technical records, measurement uncertainty, and reporting.

A laboratory can use an ISO 9001-based management system under Clause 8 Option B, but it still needs to meet ISO 17025's laboratory-specific technical requirements.

What Software Helps Labs Manage ISO 17025?

ISO 17025 does not require an ELN, QMS, LIMS, or any other specific software category.

Software can support your accreditation processes, but your laboratory remains responsible for its competence, procedures, records, and the way its systems are configured and used.

The better buying question is:

Which laboratory and quality processes are difficult for your team to control today?

For a deeper look at software options specifically for ISO 17025 laboratories, see our guide to the best lab software for ISO 17025.

Capabilities vary significantly by product.

If the distinction between the two systems is part of your evaluation, see LIMS vs. QMS: What's the Difference and When Do You Need Each?.

When evaluating software for an ISO 17025 laboratory, focus on a few practical questions:

• Configurability: Can the system support your sample types, methods, workflows, approvals, and reports? Learn more about what makes a LIMS configurable.
• Implementation: What needs to be configured, migrated, tested, validated where applicable, and taught to your users? Our LIMS implementation guide provides more context.
• Data controls: How are access, changes, backups, audit history, and software validation handled?
• Deployment: What do cloud or on-premise options mean for your security, IT resources, business continuity, and other requirements?
• Quality integration: Can your team manage quality records alongside the laboratory activity they relate to?

QBench combines LIMS functionality with an integrated laboratory QMS. Its QMS supports configurable training sets, document storage, issues and CAPA, and recurring equipment maintenance and calibration records. QBench also provides role-based access controls, encrypted data transmission, regular backups, and audit trail functionality.

What LEX Scientific's 29-Day Implementation Tells Us

LEX Scientific provides useful context for how implementation scope and experience can affect a project.

The environmental testing laboratory was preparing for an ISO 17025 accreditation audit while replacing a 20-year-old custom LIMS. After evaluating approximately five platforms, LEX selected QBench and was fully operational 29 days later. That timeline came with important context.

LEX Lab Manager Tom Keeling had already implemented QBench at four previous organizations. He knew the platform before the project began and did not need to start with basic platform discovery.

He also kept the scope deliberately constrained. Rather than redesigning the laboratory's operation during implementation, Tom recreated its established fields, report structures, and workflow logic closely enough to support the transition.

Those conditions made the project very different from a laboratory implementing QBench for the first time or redesigning its workflows at the same time.

Read How LEX Scientific Went Live With QBench in 29 Days for the full implementation story.

How Does ISO 17025 Accreditation Work?

The exact process depends on the accreditation body, program, and requested scope.

Most laboratories move through four broad stages:

1. Define your scope and assess gaps. Compare your current processes against the requirements that apply to the work you want accredited.
2. Implement the required processes and records. Put procedures into operation and generate evidence such as competence records, equipment records, technical records, internal audits, and management reviews.
3. Apply and complete the assessment. Choose an appropriate accreditation body or program and complete its application and assessment process.
4. Address findings and maintain accreditation. Resolve identified nonconformities and continue maintaining the applicable controls after accreditation.

In the United States, organizations such as A2LA provide ISO/IEC 17025 accreditation. NIST's NVLAP also accredits laboratories within specific Laboratory Accreditation Programs.

Our Inspection Readiness Guide for Labs goes deeper into maintaining readiness.

How Long Does ISO 17025 Accreditation Take?

There is no universal timeline. Timing depends on your laboratory's readiness, requested scope, accreditation body and program, assessment availability, proficiency testing requirements where applicable, and how quickly findings are resolved.

Be cautious of generic promises that every laboratory can become accredited within a specific number of weeks or months.

Common ISO 17025 Problems to Watch For

Document Control Gaps

Your team needs to know which procedure version is current, who approved it, and whether superseded versions are appropriately controlled.

Incomplete Competence Records

Training alone is not always evidence of competence. Maintain the records needed to demonstrate that personnel are competent and authorized for their assigned work.

Poor Control of Nonconforming Work

When problems occur, your laboratory needs to evaluate their impact, control affected work when necessary, investigate appropriately, and maintain records of what happened.

Equipment Records That Are Difficult to Trace

Calibration, maintenance, equipment status, and laboratory records often need to be reviewed together.

Weak Data Controls

Review access, software validation, data protection, calculations, data transfers, system changes, backups, record availability, and change history.

For more examples, see 7 Common Compliance Issues Labs Need to Watch Out For.

Preparing for ISO 17025 Is a Laboratory-Wide Project

ISO 17025 can look like a QA project from the outside. In practice, accreditation depends on what happens throughout your laboratory.

Analysts need controlled methods. Managers need clear responsibilities. Equipment records need to remain current. Personnel competence needs to be demonstrated. Technical records need to show how work was performed. Problems need to be evaluated and addressed.

Software can make those processes easier to manage, but the system still needs to fit the way your laboratory actually works.

For a broader view of compliance planning beyond this standard, see our Everything Labs Need to Know About Regulatory Compliance guide.

Download the ISO 17025 Guide

Download the ISO 17025 guide to save these requirements for reference and share them with your team as you plan your laboratory’s next steps

Frequently Asked Questions

‍

Is ISO 17025 Mandatory?

No. ISO 17025 is not universally mandatory for every laboratory.

Accreditation may still be required by regulators, accreditation programs, customers, contracts, or jurisdictions.

What Are the Main ISO 17025 Requirements?

ISO/IEC 17025:2017 organizes its primary laboratory requirements into five areas: Clause 4 general requirements, Clause 5 structural requirements, Clause 6 resource requirements, Clause 7 process requirements, and Clause 8 management system requirements.

What Is the Difference Between ISO 17025 and ISO 9001?

ISO 9001 is a general quality management system standard. ISO 17025 is specifically for testing and calibration laboratories and adds requirements for technical competence.

A laboratory can use an ISO 9001-based management system under Clause 8 Option B, but it still needs to meet ISO 17025's laboratory-specific requirements.

Is ISO 17025 Accreditation the Same as Certification?

No.

ISO 17025 uses accreditation because an accreditation body evaluates whether a laboratory is competent to perform specific activities within a defined scope.

Certification is a different type of conformity assessment.

How Long Does ISO 17025 Accreditation Take?

There is no standard timeline.

Timing depends on your laboratory's readiness, scope, accreditation body, assessment availability, proficiency testing requirements where applicable, and the time required to resolve findings.

Does ISO 17025 Require a LIMS?

No.

ISO 17025 does not require a LIMS or another specific software platform. If your laboratory uses computerized systems, you need appropriate controls around their intended use, access, changes, data integrity, and other applicable Clause 7.11 requirements.

‍