Calibration records: what to keep, how long, and a free template

A calibration record is your evidence that a specific instrument was calibrated or verified: which item, when, by whom, against which traceable standard, with what results (as found and as left), against which tolerance, what you decided, and when it is due next. Keep it for as long as the strictest rule that applies to you requires: ISO 9001 and ISO/IEC 17025 set no number of years, while medical device makers must keep records for at least the lifetime of the device and never less than two years from product release (ISO 13485 clause 4.2.5, enforced by FDA through the QMSR). This guide covers what to record, an annotated example, a printable template, retention by standard, and the findings auditors write most often.

Calibration record, certificate, equipment record, master list: what’s the difference

People use these words loosely, and no standard defines a “calibration log”. These are the working definitions we use in our guides. They follow how ISO/IEC 17025 separates the report a lab issues (clause 7.8) from the equipment records a user keeps (clause 6.4.13, as summarized by PJLA and A2LA G149).

In a small program, the calibration records are simply the rows of the equipment record’s history, as in the example below. Software usually stores them that way too. What matters is that each piece exists and links to the others through the asset ID.

What a calibration record must contain

No single free source lists every field. The clearest public minimum came from FDA’s former device rule, which required calibration records to show the equipment identification, the calibration dates, the person who performed each calibration and the next calibration date, displayed on or near the equipment or readily available (former 21 CFR 820.72(b)(2), in force until February 1, 2026). ISO/IEC 17025 gives the most complete list for equipment records (clause 6.4.13), and its technical-record clause adds the date and identity of the people responsible for each activity, the results, and enough information to identify the factors that affect them (clause 7.5.1, as summarized by SADCAS and NATA). Put together:

Each framework states the core differently:

• ISO 9001 requires documented evidence that monitoring and measuring resources are fit for purpose (clause 7.1.5.1) and, when no national or international standards exist, a record of the basis used for calibration or verification (clause 7.1.5.2) (ISO/TC 176 N1286). The 2026 edition does not change clause 7.1.5 in substance, as far as the official change summaries show (Global ACI TECH-3-TR, §3.1). Auditing guidance expects records of calibration, uncertainty and traceability to match how the equipment is used (ISO 9001 APG).
• ISO 13485 (and so FDA’s QMSR since February 2, 2026) requires records of calibration and verification results, and a recorded assessment of the validity of earlier results when equipment doesn’t conform (clause 7.6; MDSAP Tasks 13–14, pp. 107–108).
• US drug CGMP requires written records of the calibration, inspection or checking of automatic, mechanical and electronic equipment (21 CFR 211.68(a)), and complete records of the periodic calibration of laboratory instruments, apparatus, gauges and recording devices (21 CFR 211.194(d)).
• IATF 16949 has its own clause on calibration and verification records (7.1.5.2.1). We don’t list its content here because we couldn’t verify it in a free primary source.

Example: an equipment record with its calibration history

The example below is the record a manufacturer might keep for the digital pressure gauge from our example calibration certificate. It continues the same story: the gauge came back from the lab out of tolerance at 300 psi, which opened the out-of-tolerance assessment OOT-2026-007. Everything in it is fictitious. Select a number to jump to its note.

Three details make this record hold up in an audit. The 2026 row keeps the as-found failure next to the as-left result, so the adjustment does not hide the problem. The decision points to the out-of-tolerance report, so an auditor can follow the trail. And the interval change has a reason and a date in the change log, so nobody has to guess why a 12-month gauge is now on 6 months.

Free calibration record template

Use this form for one calibration or verification, whether in-house or external. For external calibrations, fill in the header, copy the key results from the certificate, and record your decision. Print it, or copy the fields into your own spreadsheet or system. It is free, with no sign-up.

Master list columns. For the list of all your equipment, one row per item is enough: asset ID, description, serial number, location, owner, risk class, tolerance, interval, last calibration date and certificate, next due date and status. Our program guide shows a filled-in row for this same gauge. A due-date tracker without results is a useful master list, but it is not a calibration record.

How long to keep calibration records

Most sources answer “it depends”. Here is what it depends on, by framework. For paid standards we describe requirements in our own words, based on the free sources cited.

Sources: ISO 9001 via ISO/TC 176 N1286; ISO/IEC 17025 via PJLA (8.4.2) and NATA (§8.1.1); ISO 13485 via MDSAP Task 8 (p. 26) and FDA’s QMSR final rule; 21 CFR 211.180; 21 CFR 11.10; GM IATF 16949 customer-specific requirements.

What to take from the table:

• If you make medical devices, the device lifetime sets the floor, and a calibration record can matter for as long as any device measured with that instrument is in use. MDSAP auditors check that records are kept for at least the device lifetime and not less than two years from product release (MDSAP Task 8, p. 26). FDA inspects this under ISO 13485 clause 4.2.5 together with 21 CFR 820.35 (FDA CP 7382.850, Attachment A).
• If you make drugs, Part 211 sets no calibration-specific period. Our recommendation: when a calibration supports the release of a batch, keep the record at least as long as that batch record. That is our reading, not a stated rule.
• If you follow ISO 9001 or ISO/IEC 17025 only, write the period into your procedure. Base it on the longest of product life, warranty, contract and legal liability. Even a large metrology program sets its own schedule: NASA’s metrology standard simply refers to the agency’s records retention schedules (NASA-STD-8739.12A, §4.6.1).
• Keep the history while the item is in service. Interval reviews use past calibration results (ILAC G24), so discarding old records also discards the evidence for your intervals. That is our recommendation, not a requirement.

Paper, spreadsheet or software?

No standard requires a particular medium. The same rules apply to all of them: records must be legible, protected against damage and loss, backed up, retrievable and kept for the defined period (ISO/IEC 17025 clauses 8.4.1–8.4.2, as summarized by PJLA). Corrections must keep the original visible, with who changed what and when (clause 7.5.2, as summarized by SADCAS). How each option handles that:

Whatever you choose, three regulated situations add requirements:

• FDA-required records kept electronically. Part 11 applies to records in electronic form created, modified, maintained or archived under FDA record requirements (21 CFR 11.1(b)). For closed systems it asks for validation, accurate copies, protection throughout the retention period, limited access, and secure, time-stamped audit trails that don’t hide earlier entries (21 CFR 11.10). Electronic signatures must show the signer’s name, date and time and meaning, and be linked to their records (21 CFR 11.50, 11.70).
• FDA’s enforcement discretion. In its 2003 guidance, FDA said it intends to exercise enforcement discretion over the Part 11 requirements for validation, audit trails, record copying and record retention, and over systems in operation before August 20, 1997 that meet certain conditions. It still enforces controls such as limited system access, operational and authority checks, training, accountability and electronic signatures. The record requirements of the underlying rules still apply in full, and FDA recommends basing your decisions on a documented risk assessment (FDA Part 11 guidance, §III). In drug plants, 21 CFR 211.68(b) separately requires controls so that only authorized people change records, plus checks and secure backups.
• Medical device quality-system software. Software used in the quality system, including off-the-shelf calibration software, must be validated for its intended use (ISO 13485 4.1.6 and 7.6; MDSAP Task 15, p. 109).

Part 11 does not apply to records kept only for ISO 9001, ISO/IEC 17025 or IATF 16949. Our comparison of calibration management software covers what to check before buying.

Common audit findings on calibration records

Many calibration findings are about the record, not the instrument. These are the record problems that appear in FDA observation data and that follow from the requirements above:

• Calibration done but not documented, or written records not kept (FDA observation codes under 820.72(a) and 211.68(a)).
• Incomplete laboratory calibration records, for example without results, standard or acceptance limits (21 CFR 211.194(d)).
• No reference standard or acceptance criterion in in-house records, so traceability and the pass decision can’t be shown (ISO 9001 7.1.5.2; ISO/IEC 17025 6.4.13).
• Certificate filed but never reviewed, so an out-of-tolerance as-found result went unnoticed. ILAC recommends checking results against predetermined limits before equipment goes back into use (ILAC G24, §4.10).
• Out-of-tolerance result with no documented assessment of earlier results (ISO 13485 7.6; former 820.72(b)).
• Records that can’t be found, are illegible or were not kept long enough (former 21 CFR 820.180, including its retention paragraph (b)).
• Uncontrolled computer systems or spreadsheets: anyone can change records, or backups are incomplete (21 CFR 211.68(b)).

FDA publishes the observations its investigators write on Form 483. These codes relate directly to calibration records:

FDA warns that these data sets are not a complete list of observations: they only include 483s generated with its electronic tools. Fiscal year 2025 ended on September 30, 2025, before the QMSR took effect, so device observations still use the former section numbers (FDA Inspection Observations). Code 1263 covers computer systems in general, not only calibration.

Common myths

Related guides

• How to set up a calibration program: where records fit in the whole program.
• How to read and review a calibration certificate: what to check before the results go into your record.
• Out of tolerance: what to do when a calibration fails: the assessment your record should point to.
• Calibration intervals: how the history in your records sets the next interval.
• How to write a calibration procedure and the ISO 9001 clause 7.1.5 guide.