Deterministic In-Browser Spreadsheet Qualification
Solutions
For medical device and IVD manufacturers · QA/RA · CSV · production and test engineering
Your lot-release spreadsheet is software. ISO 13485 says so three times.
ISO 13485:2016 requires software used in your quality system, your production and your measurements to be validated before first use and, as appropriate, after changes, proportionate to risk. A lot-release, Cpk or test-method spreadsheet is exactly that software. NormXL recalculates every formula with an independent engine, proves your acceptance criteria at their boundaries and seals the workbook with SHA-256. The result is a risk-based Validation Dossier your BSI, TÜV SÜD, DEKRA or MDSAP auditor can verify by hand, produced inside your browser with 0 KB of design or lot data uploaded. About three minutes. €149 + VAT.
No installation · No admin rights · Your CAD dimensions and lot data never leave your workstation
The sample is produced in the ISO/IEC 17020 profile; the ISO 13485 profile has the same structure, with the clause mapping shown below.
Your release formulas, recalculated independently and tested at the limit that releases product.
Structured for Notified Body, Approved Body and MDSAP audits, and ready for export
Named only to identify the regulatory and certification frameworks NormXL dossiers are structured for. NormXL is independent and is not affiliated with, endorsed by or approved by any of these organisations.
ISO 13485:2016 says the same thing three times, for three places a spreadsheet can sit. In Europe it is harmonised as EN ISO 13485:2016+A11:2021 under the EU MDR and IVDR, so this is the text your Notified Body audits against.
Document procedures for validating the application of computer software used in the QMS. Validate it before initial use and, as appropriate, after changes to the software or its application. Keep records.
Spreadsheets in scope: complaint trending, CAPA effectiveness checks, supplier scoring, internal-audit sampling, training matrices.
Mostly about process validation. Its final paragraph applies the same software requirement to software used in production and service provision, with the risk judged against the product's ability to conform to specifications.
Spreadsheets in scope: lot release, Cpk and process-capability calculators, process-validation statistics, sterilisation and accelerated-ageing calculations.
The same requirement again, for software used to monitor and measure requirements.
Spreadsheets in scope: dimensional inspection evaluation, tensile and burst test evaluation, incoming-inspection sampling plans.
Validation records are controlled under 4.2.5; the template itself is a controlled document under 4.2.4.
All three clauses say the validation approach shall be proportionate to the risk associated with the use of the software. A Cpk calculator that releases implant lots and a spreadsheet that schedules training do not need the same evidence. The Dossier's risk assessment (§2) classifies every calculation by its effect on product conformity, then scales the testing accordingly. That is exactly the reasoning an auditor expects you to be able to explain.
Note the wording: you validate the application of computer software. Nobody expects you to validate Microsoft Excel. You are expected to validate what your organisation built with it, for the use you put it to: the template, its formulas, its limits and its decisions. Which clause applies depends on that use:
100% in-browser · VAT invoice in your organisation’s name · For business customers
Notified Body and MDSAP auditors pick a lot, trace it to its release decision, and ask how the spreadsheet that made that decision was validated. "It's Excel" is not an answer. "Here is the validation record for version Rev3, identified by its SHA-256 fingerprint, approved on 14 March, with the boundary tests at Cpk 1.33" is.
"The organisation could not demonstrate validation, prior to initial use, of the spreadsheet used to calculate process capability for lot release (ISO 13485:2016, 7.5.6)."
"Software used in the quality management system (complaint-trending workbook) has not been validated, and no documented procedure defines the validation approach (ISO 13485:2016, 4.1.6)."
Illustrative wording, typical of findings raised against unvalidated spreadsheets.
Notified Bodies audit your QMS under EU MDR Annex IX, or under the IVDR. UK Approved Bodies do the same for UKCA under the UK Medical Devices Regulations 2002. MDSAP Auditing Organisations carry out one audit on behalf of the participating regulators. The MDSAP audit model looks at software validation chiefly within its Production and Service Controls process. Its nonconformity grading (derived from GHTF/SG3/N19:2012) starts higher for clauses that directly affect product realisation, and escalates further if there is no documented procedure or if nonconforming product was released. The spreadsheet that releases product is the one to validate first.
Proportionate to risk means two things. The spreadsheets that decide whether product reaches a patient get the most rigorous testing. And the evidence is fit for an auditor to read, rather than heavy enough to impress one. Spreadsheet validation usually misses in one of two directions: a 100-page protocol for a training-matrix sheet, or a one-line statement for the sheet that releases implant lots.
The Risk & Traceability Matrix in §2 of the Dossier classifies every calculation by what it does, and scales the assurance to match:
| What the formula does | Example | Assurance in the Dossier |
|---|---|---|
| Makes an accept/reject or release decision | =IF(G4>=1.33,"RELEASE","HOLD") | Scripted boundary vectors at, just inside and just outside the limit · operands at full precision · display-versus-decision audit · independent recalculation |
| Calculates a value that feeds a decision | Cpk, mean, σ, peak force | Independent recalculation of every cell · negative vectors on its inputs |
| Supporting calculation, no decision downstream | Counts and totals for reporting | Inventory and independent recalculation |
| Formatting and presentation | Headers, colour rules with no logic | Inventoried and documented, not tested |
| Record-keeping with no calculation affecting product | Training log, document index | Usually not a validation target. The fit check says so, and no Dossier is sold |
The reasoning follows the risk-based approach of ISO/TR 80002-2:2017 (Medical device software — Part 2: Validation of software for medical device quality systems): critical thinking first, testing where it matters, and records generated by the tool rather than assembled from screenshots. It is the same harm-based reasoning as your ISO 14971 risk management file: what harm follows if this sheet releases a lot it should have held?
GAMP® 5 (Second Edition, 2022) gives the scale, and its Appendix S3 deals with end-user applications such as spreadsheets:
The second edition treats the categories as a continuum rather than boxes. In §1 of the Dossier you declare what the spreadsheet decides and its effect on product conformity. NormXL sets the depth of testing accordingly and records the rationale in §2.
The examples use illustrative values. Every Excel result quoted was reproduced in Microsoft Excel 16.0.
Process capability is a common acceptance gate in MedTech lot release, and its formula is unforgiving to spreadsheets. It subtracts two nearly equal numbers, a specification limit and a mean, and divides the small difference by a small standard deviation. Subtracting nearly equal numbers is exactly where binary floating-point residues stop being invisible.
Machined implant component, Ø 10.00 ± 0.04 mm USL = 10.04 · LSL = 9.96 · = 10.0001 · s = 0.0100 (STDEV.S, n = 30)
Cpu = (10.04 − 10.0001) / (3 × 0.0100) = 1.33 (exact decimal arithmetic)
Cpl = (10.0001 − 9.96) / (3 × 0.0100) = 1.3367
Cpk = min(Cpu, Cpl) = 1.33
In Excel:
=(10.04-10.0001)/(3*0.01) → displays 1.33, stores 1.3299999999999794
=IF((10.04-10.0001)/(3*0.01)>=1.33,"RELEASE","HOLD") → HOLD
=IF(ROUND((10.04-10.0001)/(3*0.01),2)>=1.33,"RELEASE","HOLD") → RELEASE
A capable lot, held by a residue of two hundred-trillionths. The cost is not only the hold. It is the investigation that follows, and the temptation to "fix" the formula with >=1.3299: a buried constant that will one day release a lot it should not.
The same lot can produce three answers:
The opposite failure is quieter. A Cpk of 1.3251, formatted to two decimals, displays as 1.33. A reviewer reading the printed record releases the lot, while the decision cell, comparing the stored value, says HOLD. Which is correct is not a matter of opinion. It is whatever your procedure documents. NormXL makes you declare it, for example "Cpk calculated to full precision, rounded to two decimals, released if ≥ 1.33", and proves that the spreadsheet implements it, at 1.33 exactly and one step either side.
None of these is a software bug. Each is a choice that has to be visible, documented and tested at the boundary.
What NormXL checks
Boundary vectors injected
Cpk exactly 1.33 · n = 1 (σ undefined) · n = 2 · all-identical measurements (σ = 0, division by zero) · a measurement exactly on USL or LSL · text in the measurement column
ISO 10555-1 sets the minimum peak tensile force by the smallest outside diameter of the tubular portion of the test piece:
| Smallest outside diameter of test piece | Minimum peak tensile force |
|---|---|
| ≥ 0.55 mm and < 0.75 mm | 3 N |
| ≥ 0.75 mm and < 1.15 mm | 5 N |
| ≥ 1.15 mm and < 1.85 mm | 10 N |
| ≥ 1.85 mm | 15 N |
Check these values against the edition cited in your technical documentation (ISO 10555-1:2023, Table 1).
In a spreadsheet, the table usually becomes a nested IF:
=IF(D5<0.75,3,IF(D5<1.15,5,IF(D5<1.85,10,15)))That formula buries three thresholds and four forces, and the decision turns on comparison operators. Write <= where the table means <, and a test piece measuring exactly 0.75 mm is judged against 3 N instead of 5 N. Feed it an OD of 0.50 mm, below the table altogether, and the formula returns 3 N without complaint.
Other places these sheets go wrong:
SLIP, silently drops out of the mean.What NormXL checks: boundary vectors at exactly 0.55, 0.75, 1.15 and 1.85 mm, plus one below the table · thresholds, forces, tolerance factors and conversion factors in the Constant Ledger, with every occurrence listed · text results ("invalid", "fixture slip") and a reduced n injected into every range
Four-parameter logistic calibration: y = d + (a − d) / (1 + (x/c)b)
Precision: %CV = 100 · s /
Detection capability (CLSI EP17-A2, parametric): LoB = blank + 1.645 · sblank
LoD = LoB + cp · sL, cp = 1.645 / (1 − 1 / (4 · (L − K)))
Here L is the total number of low-level results across K low-level samples. LoQ is the lowest concentration that meets your total-error goal.
Where IVD spreadsheets go wrong:
For IVD manufacturers under the EU IVDR, these sheets sit directly behind the analytical performance claims in your technical documentation.
What NormXL checks: independent recalculation of every curve point, CV and limit · 1.645, cp and pasted 4PL parameters in the Constant Ledger · negative vectors (negative blanks, text results, empty replicates) against every input
Example. A two-year shelf-life claim, aged at 55 °C against an ambient of 25 °C with Q₁₀ = 2:
=ROUND() gives 91 days, so every sample is under-aged by six hours of chamber time: two days of real-time equivalent.=ROUNDUP() gives 92, which is conservative.The same template, reused at another temperature. Run the chamber at 50 °C and the correct AAF is 22.5 = 5.66, or 64.5 days per year. A sheet with the AAF typed as 8 gives 45.6 days per year, so every study is under-aged by 29 %.
Q₁₀ = 2 and TRT = 25 °C are typed constants that need a documented justification. ASTM F1980-21 advises keeping the ageing temperature at or below 60 °C, and expects real-time ageing to confirm accelerated results.
What NormXL checks: every rounding step on the path, with its direction, so your reviewer confirms that ageing durations round up · Q₁₀, TAA and TRT extracted into the Constant Ledger if they are typed into formulas · the calculation tested for TAA ≤ TRT, non-integer durations and the real-time follow-up schedule if present
TAA equal to TRT (AAF = 1) · TAA below TRT · Q₁₀ of 1 · durations producing exact half-days
55 °C → 8
1 · Display and binary rounding at the release decision. A Cpk of 1.3251 that displays as 1.33. A Cpk that is exactly 1.33 on paper and is held. NormXL tests every decision at its boundary and prints both operands to full precision.
2 · Unlocked limits. Specification limits, Q₁₀ and conversion factors sit in unlocked cells, or worse, inside formulas. One keystroke changes a release criterion, and nothing changes colour. Excel's "Locked" format does nothing until sheet protection is switched on.
3 · Constants without a source. 1.33, 1.645, 2, 25 and 6.89, typed into formulas. When the drawing, the protocol or the guideline changes, the literals stay.
4 · Inputs that aren't numbers. "Retest", "SLIP" or "N/A" in a measurement column. AVERAGE and STDEV skip text silently and change n. A blank counts as zero in a "not more than" comparison, and text ranks above every number in a "not less than" one.
5 · No cryptographic identity. Clause 4.2.5 requires records to stay legible, readily identifiable and retrievable, and your Notified Body will want to know which version of the release calculator released lot 24-117. A SHA-256 fingerprint in the Dossier identifies the exact validated file. On the Annual Register, a logic fingerprint also matches a completed lot workbook back to the validated template, even though it contains that lot's data.
QA directors are rightly sceptical of anyone who claims a spreadsheet can be made "Part 11 compliant". A validation dossier cannot make it so, and NormXL does not try. The distinction that resolves the question is between two layers.
Layer A: the calculation template. An engineer opens the validated template, enters today's measurements and checks the result. Then they print a signed report, or transfer the verified output into your ERP, eQMS or LIMS. The spreadsheet is a calculator, and the record of truth lives in your QMS. This is what validation under Clauses 4.1.6, 7.5.6 and 7.6 covers, and NormXL qualifies it completely.
Layer B: the runtime record. Here the spreadsheet is itself the live primary record, edited over weeks, and every change needs an authenticated user, a reason and an append-only audit trail. That is the territory of runtime controls: 21 CFR Part 11 in the US and, for medicinal products, EU GMP Annex 11. A validated database, eQMS or LIMS handles it, not a spreadsheet tool. NormXL does not pretend otherwise, and the fit check on our home page will tell you before you buy.
You should list NormXL in your QMS software inventory and record a validation rationale proportionate to its risk, and that rationale is short. NormXL is a supporting tool whose every output can be checked independently. Each test vector in the Dossier prints:
A reviewer can check any of them with a calculator; your CSV engineer can re-verify a critical lot-release equation in half a minute before signing §7. Behind the vectors sit two further lines of evidence: two independent implementations agreeing on every cell, and a statistical engine benchmarked against NIST StRD certified values, with the engine version printed in every Dossier.
The principle is established. Safety-critical software standards require a tool to be qualified only where its output is not independently verified (DO-178C §12.2; ISO 26262-8, Clause 11). ISO/TR 80002-2 lets you scale the assurance of any QMS tool to its risk. European MedTech practice draws the same distinction between validating a tool and verifying its output. In your procedure, record NormXL as a supporting tool whose output is verified by review and spot calculation.
Tolerances, process windows and lot histories are some of the most valuable information a device manufacturer owns. Complaint workbooks can also hold personal data about patients and users. Uploading either to a cloud validation service creates three problems at once:
NormXL avoids all three. The engine runs inside your browser; the workbook is read into local memory and never transmitted. 0 KB of your workbook uploaded. We never receive your data, so we are not a processor of it, and there is no data-handling service to qualify. For cleanrooms and segregated networks, a single-file offline edition runs with no network connection at all.
About three minutes to the download, including your answers. Review and approval follow your own procedure, typically 30 to 60 minutes for a calculation template.
100% in-browser · VAT invoice in your organisation’s name · For business customers
| Requirement | What the auditor looks for | Where the Dossier answers |
|---|---|---|
| 4.1.6 / 7.5.6 / 7.6 | Validation of the application before initial use, proportionate to risk | §1 User requirements (intended use, effect on product conformity) · §2 Risk & Traceability Matrix · §4 OQ test vectors |
| "As appropriate, after changes" | Re-validation triggered by change | §7 re-validation triggers · version log · Annual Register diff and re-validation |
| 4.2.4 Control of documents | The template in use is a controlled, identified version | SHA-256 fingerprint in every page header · §7 version log |
| 4.2.5 Control of records | Validation records are maintained and retrievable | PDF and DOCX filed in your QMS, verifiable without NormXL |
| Decisions affecting product conformity | Acceptance logic tested where decisions are made | §5 Negative & boundary log · §6 display-versus-decision audit |
| Software identity | Which application and version produced the cached results | §3 IQ: SHA-256, application and version that last saved the file |
| GAMP® 5 categorisation | A defensible classification | §2: Category 4, or towards Category 5 where VBA is present |
| 7.4 (context) | No new data-handling supplier introduced | Local-processing statement: 0 KB of workbook data transmitted |
| On-the-spot verification | Evidence the auditor can check during the audit | App. B Quick-Verify card: three hand-checkable vectors and re-hash instructions |
NormXL produces evidence; your organisation approves it. The decision on any finding is always the auditor's. The Dossier is built to make that decision quick.
The sample Dossier uses the ISO/IEC 17020 profile; the ISO 13485 profile has the same structure, with the mapping above.
100% in-browser · VAT invoice in your organisation’s name · For business customers
The Medical Device Single Audit Program lets one audit against ISO 13485:2016, plus country-specific requirements, serve the regulators of Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW/PMDA) and the United States (FDA). Health Canada requires an MDSAP certificate for Class II–IV device licences, and the TGA uses MDSAP evidence in its conformity assessment. The UK's MHRA announced in June 2026 that it is moving to full MDSAP membership. Because the Dossier is mapped clause by clause to ISO 13485:2016, it serves the software-validation part of an MDSAP audit exactly as it serves a Notified Body audit. Country-specific requirements remain part of your wider QMS. Dates as published by each body at the time of writing.
Since 2 February 2026, the FDA's Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference, so a Dossier built for Clause 4.1.6 already speaks the language US investigators now use. Three QMSR-era details matter for spreadsheets:
Investigators write spreadsheets into the record. Two recent FDA warning letters to drug manufacturers: "A non-validated Excel spreadsheet was utilized to calculate finished thyroid, USP API assay results" (May 2022) and "Your firm has not validated the Excel spreadsheet for its intended use of calculating the final concentration of benzalkonium chloride" (August 2025).
NormXL is built first for ISO 13485 and your Notified Body. US readiness comes with it.
€149 + VAT
one-time · per spreadsheet
The release calculator your auditor will sample, or the nonconformity your CAPA has to close.
€490 + VAT
per year · up to 20 spreadsheets
Four Single Dossiers cost €596 + VAT. The Register covers up to 20 for €490 + VAT.
The QA/RA lead who owns every spreadsheet in the QMS, and the systemic corrective action.
External CSV support for a single lot-release spreadsheet typically costs €2,000–€5,000 and takes four to eight weeks; done in-house, it takes 30 to 40 hours of a specialist's time.
NormXL 7.0 is in final pre-release qualification. Orders placed now are reserved at the standard price; no card details are requested until release.
For business customers. All prices exclude VAT, GST and other local taxes, where applicable; they are added to your invoice.
Prices are in euro; your card issuer converts the amount.
Excel is commercial software. The template your engineers built, with its formulas, limits, look-ups and decisions, is an application of that software, and Clauses 4.1.6, 7.5.6 and 7.6 all speak of validating "the application of computer software". The open question is never whether to validate such a template, but how much evidence its risk justifies.
No. Excel as installed is GAMP® 5 Category 3 and is used widely enough to be leveraged rather than re-tested. What you validate is your application of it: the template, its formulas and the decisions it makes.
It means the depth of validation follows the consequence of the spreadsheet being wrong. A sheet that releases implant lots gets scripted boundary tests at its release limits, full-precision checks and independent recalculation. A sheet that totals training hours gets an inventory and a documented rationale. The Dossier's §2 records that reasoning cell by cell, so you can explain it to your auditor in the terms of ISO/TR 80002-2 and ISO 14971.
Notified Bodies do not pre-approve validation tools or documents, and you should be wary of any vendor who implies otherwise. They audit whether your organisation validated its software adequately for its intended use, proportionate to risk, and can demonstrate it. The Dossier gives them evidence they can verify in minutes, partly by hand, without relying on NormXL. Reviewed and signed by your QA lead, it is your organisation's validation record. Validation is your act, not ours, and the decision is always the auditor's.
Yes. MDSAP audits against ISO 13485:2016 plus the specific requirements of the participating regulators. The Dossier's evidence and clause mapping are ISO 13485-based, so it serves the software-validation part of an MDSAP audit directly. Country-specific requirements, such as particular record or reporting obligations, remain part of your wider QMS.
Record it in your software inventory with a short, risk-based rationale. NormXL is a supporting tool whose output is independently verifiable: every vector prints inputs, formula, Excel's value, NormXL's value and the difference. Safety-critical software standards require tool qualification only where output is not independently verified (DO-178C §12.2; ISO 26262-8, Clause 11). The Dossier gives you the material for that rationale.
It covers installation qualification (identity, configuration, formula inventory) and operational qualification (independent recalculation, boundary and negative tests). Performance qualification shows that the template performs as intended in your actual process, with your users and your data. That remains yours, and the Dossier tells you so.
Those rules govern electronic records and signatures at runtime. If your template is a calculator whose output is printed and signed, or transferred to your eQMS, the record lives in your QMS (Layer A), and NormXL validates the calculator. If the spreadsheet itself is the live primary record (Layer B), you need a validated system with user authentication and audit trails, and no spreadsheet validator can provide that. Sign the Dossier the way you sign any other controlled record: through your eQMS with its electronic signatures, or with wet ink on the printed PDF.
Yes, on two levels. For the correction, the Dossier is objective evidence that the spreadsheet named in the finding is now validated, protected and identified. For the corrective action, the Annual Quality Register brings every release and test spreadsheet under the same control: register, validate, re-validate on change. That addresses the root cause, not just the one sheet the auditor opened.
It depends on where the limits live. If they sit in locked, labelled input cells that the formulas reference, a new revision is a controlled data change: assess it under change control, update the inputs and record it. If they are typed into formulas, the revision is a software change and you re-validate. On the Annual Register, the version diff shows exactly which cells changed.
It is quality-system evidence: the validation record required by Clauses 4.1.6, 7.5.6 or 7.6, maintained under 4.2.5 and presented during QMS audits. If the spreadsheet also supports design verification, for example test-data reduction for a verification report, reference the Dossier from that report so the reviewer can see that the calculation tool was validated.
VBA is analysed statically and never executed. The Dossier lists every module and flags what matters for validation:
On Error Resume Next;Solver results are static values. NormXL lists them as constants without a live calculation behind them, so you document the Solver run as a controlled input.
No. NormXL verifies that your spreadsheet computes its chosen method correctly and robustly. Whether Cpk is the right index for your process, whether the data are normal, and whether n = 30 is enough are statistical and engineering decisions, and they stay with your team.
NormXL never receives product data: the workbook is processed in the browser and 0 KB of it is transmitted. Your InfoSec team can verify this in the browser's network monitor in a minute, and the security note sets out the architecture for your supplier file.
Only for manufacturers who export. The Dossier is built around ISO 13485, EU MDR and IVDR Notified Body audits, UK Approved Body audits and MDSAP. Because the FDA's QMSR incorporates ISO 13485:2016 by reference, the same Dossier also serves US exporters, at no extra cost and with no extra steps. If you never sell in the US, you can ignore that panel.
The Cpk calculator. The ageing protocol. The burst-test evaluation. About three minutes, inside your browser, with 0 KB of your workbook uploaded, and a signed validation record that answers Clauses 4.1.6 and 7.5.6 on paper.
No installation · No admin rights · 0 KB of your workbook uploaded · VAT invoice in your organisation's name