Most of the cleanroom conversations I have with OEMs start in the wrong place. A director of operations calls, tells me the last contract manufacturer couldn't hold the environment, and asks what class of cleanroom we run. Fair question. But it's the third question, not the first. The first question is what the device actually needs, and I've watched a lot of companies spend money answering the third question before they ever answered the first.
I've onboarded a lot of medical device programs over the years, and the pattern with cleanroom assembly is consistent. Teams either over-classify, paying for an ISO Class 5 environment a Class 8 device would sit in comfortably, or they under-specify and get caught when an auditor asks why a product with a bioburden limit is being built in a room with no classification at all. Both mistakes come from skipping the risk decision and jumping straight to the room.
This article walks the decision the way I've seen it work in practice: start with device risk, pick a cleanliness class you can defend, design the process and the people around it, build a monitoring program that proves the room stays where you said it would, handle the kitting, and then know what to look for when you're evaluating someone else's cleanroom during supplier qualification. This is the pillar for our cleanroom assembly and kitting hub, and it links down to the deeper pieces as we publish them.
Start With Device Risk, Not the Cleanest Room You Can Afford
Here is the thing nobody tells you at the start: no standard tells you which cleanroom class your device requires. People assume ISO 14644 does. It doesn't. ISO 14644-1 classifies cleanroom air cleanliness by the maximum allowable concentration of airborne particles per cubic meter at specified particle sizes, defining classes from ISO Class 1 (cleanest) through ISO Class 9, and it specifies how you determine and demonstrate that classification, including sampling locations and statistical evaluation (ISO 14644-1:2015). What it does not do is tell you that a spinal implant needs Class 7 or a wound dressing needs Class 8. That decision is yours.
Where does the requirement actually come from? Under the FDA Quality Management System Regulation (QMSR), effective February 2, 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference (QMSR final rule). The work-environment obligation now flows through ISO 13485:2016 Clause 6.4, which requires you to document the requirements for the work environment needed to achieve product conformity, and where the environment can adversely affect product quality, to establish documented requirements for the health, cleanliness, and clothing of personnel, plus arrangements for controlling contaminated or potentially contaminated product (ISO 13485:2016 Clause 6.4).
Read that carefully. Clause 6.4 states an outcome: control the environment so it doesn't compromise the product. It does not prescribe an ISO 14644 class or a numeric particle limit. You get to Clause 6.4 conformity by doing a risk assessment that ties your device's contamination sensitivity to a controlled environment, and then justifying the environment you chose. That justification is the document an auditor wants to see. The class is the conclusion, not the starting point.
So the real first question is: what does contamination do to your device and your patient? A device that will be terminally sterilized in its final package has a bioburden requirement, not a sterility-at-assembly requirement. A device with tight internal geometries or optical surfaces cares about particulate. An implant cares about both, and about the patient consequence if control slips. When I hear a team say "we just want the cleanest room to be safe," I know they haven't done this work yet, because the risk assessment almost always points to a more specific and usually more affordable answer.
Controlled, Classified, or Something in Between
There's a distinction that trips up more programs than any other, and it's the one that quality forums argue about constantly: the difference between a controlled but not classified environment and a true ISO 14644-classified cleanroom.
A controlled environment has defined and monitored conditions, gowning, cleaning, access control, maybe positive pressure, but it is not held to a numeric ISO 14644 particle class and is not classified through the ISO 14644-1 method. A classified cleanroom is measured and certified to a specific ISO class using the sampling and statistical evaluation the standard defines (ISO 14644-1:2015). Both can satisfy Clause 6.4. Which one your device needs depends entirely on whether your product's contamination or microbiological specification actually compels a classified environment.
In my experience, this is where money gets saved or wasted. A lot of Class II devices that get terminally sterilized are built perfectly well in a controlled environment with a documented bioburden control program, and classifying that room to ISO 7 buys the program nothing except a bigger certification and monitoring bill. On the other side, a device with a low bioburden limit and exposed critical surfaces belongs in a classified room, and trying to run it "controlled" invites an observation the first time an investigator asks for your classification data and you don't have any.
In practice, many medical device assembly programs land in the ISO Class 7 to ISO Class 8 range as a classified environment, with tighter local protection where the product is most exposed — but that range is a starting observation, not a prescription. But I won't give you a class off a phone call, and you should be suspicious of anyone who does. The class is an output of your risk assessment, and the risk assessment is the thing that has to survive the audit.
One more caution. ISO 14644 governs airborne particles. It does not address microbial contamination, which is covered separately. If your device has a viable-contamination concern, particle classification alone is not enough, and I'll come back to that in the monitoring section.
Designing the Process: Manual, Automated, and Everything Between
Once you've settled the class, the process design decisions start, and this is where the buyer's experience and the engineer's experience have to meet. I'm not the person who programs the pick-and-place cell. But I've sat through enough tech transfers to tell you where these decisions go sideways.
Manual vs. Automated Assembly
The manual-versus-automated question rarely has a clean answer at the volumes most OEMs are actually running. Automation makes sense when the volume is high, the process is stable, and the tolerances are tight enough that a human hand introduces more variability than a machine. It also reduces the single biggest contamination source in the room, which I'll get to in a second. The catch is that automation is capital that doesn't flex. If your forecast is soft or your design is still moving, a fixed automated line becomes an expensive way to build the wrong thing efficiently.
Manual assembly flexes. It absorbs design changes, mixed product, and uncertain volume without a capital rewrite. It costs more per unit at scale and it puts more people in the cleanroom, which is a contamination tradeoff you manage with gowning and flow rather than eliminate. The customers who get this right treat the manual-versus-automated decision as a five-year question about their product roadmap, not a next-quarter question about unit cost. The ones who get it wrong lock in automation against a forecast that never materializes, or stay fully manual well past the volume where variability starts costing them in yield. We cover this tradeoff in more depth in a dedicated piece within this hub.
Personnel and Material Flow
Flow is the part of cleanroom design that looks like a floor plan and behaves like a quality system. The principle is separation: clean people and clean material move one direction, waste and used gowning move the other, and the two don't cross. A well-designed room has a gowning entry that steps personnel from a lower-classification space into the cleanroom in stages, and a separate exit path so nobody de-gowns back through the clean entry.
Material flow follows the same logic. Incoming components get cleaned, inspected, and staged before they cross into the classified space, and finished product moves out through a controlled pass-through rather than back through the door people entered. When I walk a prospect's line and see a single door doing double duty as entry, exit, material-in, and product-out, I already know what the environmental monitoring trend is going to look like. Layout decisions made to save a few square feet at build-time show up as excursions for the life of the room.
Gowning Protocols
Here's the fact that should anchor every gowning decision. FDA's aseptic processing guidance identifies personnel as the most significant source of contamination in cleanroom operations, and emphasizes that slow, deliberate movement and proper gowning technique are essential to preserving protection over exposed product (FDA Aseptic Processing Guidance, 2004). That guidance was written for sterile drug manufacturing, not device assembly, so its specific classifications don't map one-to-one onto ISO 14644 device work. But the underlying principle absolutely translates: the people in the room are the problem you're managing, and gowning is how you manage them.
Gowning rigor scales with the class. A controlled or ISO 8 environment might use a coat, hairnet, beard cover, and gloves. A tighter classified environment adds full coverall, hood, boot covers, and a formal donning sequence performed in a segregated gowning room with a defined clean-side and dirty-side transition. The donning order matters, the training matters, and the requalification of gowning technique matters, because a perfectly designed garment system defeated by sloppy technique gives you the contamination you were trying to gown out. In my experience, gowning discipline is also the single clearest tell of whether a manufacturer's cleanroom culture is real or theater. You can see it in thirty seconds of watching people enter the room.
Environmental Monitoring: Proving the Room Stays Where You Said
Classifying a cleanroom once, at build, proves it can hit the class. Monitoring proves it stays there while you're actually building product. Those are two different obligations and auditors treat them as such.
ISO 14644-2 specifies the minimum requirements for a monitoring plan that demonstrates continued compliance of a cleanroom with its designated air cleanliness class, and it bases that plan on a risk assessment of the intended use rather than a fixed re-test interval alone (ISO 14644-2:2015). That risk-based framing is the modern expectation. You don't monitor everything everywhere at the same frequency; you monitor hardest where the product is most exposed and the risk is highest, and you justify the plan against use.
A monitoring program that holds up has a few things in it. It has defined sampling locations tied to where product is exposed and where contamination is most likely, not just where a probe is convenient. It has alert limits and action limits that are separated on purpose: an alert limit is the early-warning trend that says something is drifting, and an action limit is the line that triggers investigation and response. And it has a written excursion response, so that when a location goes past an action limit, the operator isn't improvising. This is exactly the operational detail that generic Clause 6.4 summaries skip, and it's the detail an investigator will drill into.
Particle monitoring under ISO 14644 is only half the picture for anything with a microbial concern. Where microbial contamination matters to the product, you need viable monitoring too. ISO 14698 provides the principles and methodology for biocontamination control, including formal risk assessment and routine microbiological monitoring of air and surfaces (ISO 14698-1:2003). If your device has a bioburden limit feeding a downstream sterilization process, your monitoring program has to see viable contamination, not just particles, and the two programs run together. A room that's beautifully particle-classified but has no viable monitoring is a program with a blind spot, and I've seen that blind spot become a finding.
All of this rolls back up to Clause 6.4. The clause tells you to control the environment and document how; ISO 14644-2 and ISO 14698 are how you demonstrate the control is real and continuous. The monitoring data is the evidence that your Clause 6.4 requirements are actually being met day to day, which is precisely what a QMSR-era investigator will ask to see (ISO 13485:2016 Clause 6.4). We go deeper on building the monitoring plan in a separate article in this hub.
Kitting Sterile Devices: Where Assembly Meets the Sterile Barrier
Kitting is where a lot of programs discover that the cleanroom decision and the packaging decision are the same decision, they just didn't realize it. You've assembled the device in a controlled environment, and now you're combining it with other components into a convenience kit or a procedure tray that will be terminally sterilized and shipped as a sterile product. The environment you kit in, the sequence you kit in, and the barrier you kit into all have to line up.
The governing standard on the barrier side is ISO 11607-1, which specifies requirements and test methods for materials, preformed sterile barrier systems, and packaging systems intended to maintain the sterility of terminally sterilized devices to the point of use (ISO 11607-1:2019). That standard governs the sterile barrier your kit goes into, but notice its scope: it applies to terminally sterilized devices and it does not itself set the cleanroom classification for the assembly or kitting environment. So kitting sits at an intersection. The barrier is governed by ISO 11607, the environment is governed by your Clause 6.4 risk assessment, and the bioburden you seal into that barrier is governed by whatever your sterilization validation assumes.
That last point is the one I watch customers miss. If your sterilization cycle was validated against a bioburden assumption, the kitting environment has to keep the product at or below that bioburden going into the package. Kit in a dirtier environment than your cycle assumed and you've quietly invalidated your sterilization validation without changing a single thing about the cycle itself. The kitting room, the packaging, and the sterilization cycle are one connected system, and the smart move is to design them together rather than hand them off in sequence to three teams that never talk. Our packaging validation and sterilization validation hubs go deep on those two ends of the same problem.
There's an operational dimension too. Kitting sterile devices means controlling component sequence, lot traceability across every item in the kit, and inspection at the point of assembly, because a kit is only as clean and as traceable as its worst component. When a single kit pulls together items from multiple suppliers and multiple lots, the traceability discipline has to hold across all of them. Convenience-kit recalls arise from both directions: a single nonconforming component that propagates a kit-level action, and assembly- or process-control failures that affect traceability or integrity across every unit produced. Building the kitting process with both failure modes in mind is cheaper than discovering either one in a recall. Building the kitting process with that failure mode in mind is cheaper than discovering it in a recall.
Qualifying a Contract Manufacturer's Cleanroom
If you're outsourcing cleanroom assembly, everything above becomes a supplier qualification problem, and this is the part of the conversation I actually live in. ISO 13485:2016 Clause 7.4 requires you to establish criteria for evaluating and selecting suppliers based on their ability to meet requirements and the effect of the purchased product on device quality, and to monitor and re-evaluate them over time (ISO 13485:2016 Clause 7.4). The clause tells you to qualify the supplier; it doesn't hand you the checklist. So here's the checklist I've watched separate the real cleanroom operations from the ones that photograph well.
Ask for classification data, not a class number. Anyone can tell you they run "ISO 7." Ask to see the current ISO 14644-1 classification report, the sampling locations, and the statistical evaluation. A real operation produces it without friction. If the number lives on a website but the report takes three weeks to surface, that tells you something.
Ask for the monitoring program, including excursions. The classification report proves the room can hit the class. The monitoring data proves it stays there. Ask for the monitoring plan, the alert and action limits, and, critically, the excursion history and how excursions were handled. A cleanroom with no excursions in its history isn't a perfect cleanroom, it's a cleanroom that isn't looking hard enough. What you want to see is that when a location drifted, the response was documented and closed. That's a mature quality system doing its job.
Walk the flow. Stand at the gowning entry and watch people enter. Trace the material path and the product path and confirm they don't cross the waste path. Ask where finished product exits. Thirty minutes on the floor tells you more about contamination control than any binder, because layout and gowning discipline are hard to fake in real time.
Confirm the QMS actually reaches the cleanroom. Being ISO 13485 certified as a company is not the same as having the cleanroom's monitoring, gowning requalification, and cleaning validation living inside that quality system. Ask how environmental monitoring excursions feed CAPA. Ask how gowning requalification is documented. Under the QMSR, the FDA framework now runs through ISO 13485:2016, so the supplier's quality system and their cleanroom controls should be one system, not two (QMSR final rule).
Check whether packaging and sterilization support live under the same roof. This is the consolidation question the OEMs I work with are usually really asking. If your assembly, kitting, packaging validation, and sterilization validation sit with four different vendors, every handoff is a place for the bioburden assumption to break and for traceability to fragment. A manufacturer that runs cleanroom assembly, kitting, packaging validation, and sterilization validation together, with an in-house packaging test lab, removes the handoffs where these programs usually fail.
One note on test data, because it matters more than most buyers realize during qualification. LSO's packaging test lab is accredited to ISO/IEC 17025:2017, the international benchmark for testing and calibration laboratory competence. The FDA does not mandate ISO/IEC 17025 accreditation for premarket submissions, but the agency consistently expects test data to be scientifically valid, reproducible, and defensible — and data from an independently assessed, accredited lab is held to a documented standard of method traceability and measurement validity that reduces the likelihood of follow-up questions during review. It is worth confirming whether a prospective partner's test data carries that foundation or whether gaps in lab qualification could require you to re-run work to satisfy a reviewer.
The Decision, In Order
If you take one thing from this, take the sequence, because the sequence is where the money and the audit risk live. Start with device risk and let it point you to a controlled or classified environment and a defensible class (ISO 14644-1:2015). Design the process, the flow, and the gowning around the people who are your biggest contamination source (FDA Aseptic Processing Guidance, 2004). Build a risk-based monitoring program that proves the room stays where you said, covering both particles and, where it matters, viable contamination (ISO 14644-2:2015; ISO 14698-1:2003). Treat kitting, packaging, and sterilization as one connected system so your bioburden assumption survives to the sterile barrier (ISO 11607-1:2019). And when you qualify an outside cleanroom, ask for the data, walk the flow, and confirm the quality system actually reaches the room (ISO 13485:2016 Clause 7.4).
The customers who work this in order almost never end up with the room they guessed at on the first phone call. They end up with the room their device actually needs, which is usually less than they feared and always easier to defend when the investigator shows up.