A qualified vision inspection station stays trustworthy only if no camera, strobe, lens or firmware change reaches production before someone has decided what that change needs re-proven. Three controls apply, in this order. First, a supplier change-notification clause makes swaps planned events rather than discoveries. Second, a maintenance-to-quality hold is raised from the work order and scoped to changes that can actually affect inspection. Third, requalification evidence is scoped by impact and, where sites really differ, produced and reported per mill instead of pooled into one company-wide figure.
These controls matter for vision system inspection because, unlike a conveyor or pump, its degradation is invisible to operators. A vision system with a dusty lens, degraded LED illumination or a miscalibrated reference target keeps producing inspection results. They are just less accurate, and the gap tends to surface only through an audit, a complaint or a recall. An unrecorded strobe swap behaves the same way: the line keeps running, so nobody has a reason to look.
Scoping a requalification from the change, not from the original protocol
Every control below ends in the same question: what does this change require us to re-prove? Requalification is the documented evaluation and, where justified, repeated verification of a previously qualified system, to show it remains suitable for its intended use. Its scope should be justified by a documented risk assessment rather than by automatically repeating every historical test. Change control identifies the impact of a modification, and requalification is one of the actions that assessment may produce.
A practical scoping sequence for a vision station, adapted from a step-by-step GMP requalification guide (Pharma Manufacturing Hub), runs in this order:
- Define the trigger: what changed (camera body, lens, strobe, firmware, mounting)?
- Identify the affected system boundary: which subsystem and which inspection function?
- Review the existing qualification: what was originally tested?
- Review which user and critical requirements the change may touch.
- Review which failure modes in the risk assessment are affected.
- Decide whether the change touches DQ, IQ, OQ and/or PQ.
- Check related validation, such as computerised controls.
- Define enough verification to show the station is still fit for use.
The same guide lists the outcomes that sequence can reach: no additional testing, engineering verification only, partial IQ, partial OQ, partial PQ, a combined IQ/OQ/PQ, or full requalification where a broad change or uncertainty invalidates much of the prior evidence. Its central principle is that requalification should show continued fitness for intended use, following trigger, impact, risk, existing evidence, affected requirements, required verification, results and a qualified-state decision, rather than “trigger, repeat everything”.
For a camera station the mapping is fairly natural. Installation qualification records firmware versions and optical alignment, while OQ characterises lighting and contrast thresholds and defect sensitivity. Acceptance criteria should be set before the work starts and should not be weakened just to make requalification pass. Where requirements legitimately change, that goes through its own controlled change. Setting the numeric pass/fail threshold itself is a separate problem with its own logic, and this article treats the threshold as given.
Can we require our camera or strobe supplier to notify us before a spec or batch change?
Yes, and FDA’s purchasing-controls material calls for it where possible. An FDA purchasing-controls presentation (CDRH, November 2015) says purchasing documents shall include, where possible, an agreement that suppliers will notify the manufacturer of changes, so the manufacturer can decide whether the change affects quality. Under ISO 13485 practice this is usually called a change notification and sits in the quality agreement. The same FDA material defines a component to include software and firmware.
A real clause shows what “notify” can mean in practice. In a supplier quality agreement (St. Jude Medical, 2016), the supplier must notify within ten days of becoming aware of a potential change, may not implement it without prior written approval, and must give a detailed written description at least 180 days ahead where the change may affect performance, safety or effectiveness. A supplier change-notification guide written for razor components (Haward Razor) proposes risk-based windows instead: 90 days for a major permanent change, 30 days for a minor controlled change such as replacing inspection equipment with equivalent capability, and immediate notice for emergencies like discontinuation. The guide is explicit that these are buyer-defined examples rather than industry rules. The same guide has the countdown start only when the buyer receives a complete evidence package, and it states that no response is not approval.
The guide says the clause should require, among other items, the current and proposed specification side by side, the reason for the change, the affected parts and sub-suppliers, a risk assessment, a proposed validation plan, and the first affected batch and its traceability method. Camera makers such as Basler do issue such notices. Basler’s PCN 10/2023 (released 20 December 2023) told customers that label size and design would change across several camera families, from 25 × 25 mm to 25 × 31 mm on the ace GigE. This notice concerns labels only, so it shows what a notice looks like rather than a change that affects inspection.
Two scope details are easy to miss. Changes made by sub-tier suppliers should be covered, not only those made in the final assembly plant. GHTF guidance also notes that a manufacturer may need control beyond the first tier because of changes made by second- or third-tier suppliers. GHTF further recommends that manufacturer and supplier agree on a process for evaluating changes to a validated process and deciding when revalidation is needed.
Should we qualify and stock one approved lighting part number?
Qualifying a single approved part number, and holding enough stock that a failed strobe can be replaced like for like, removes most uncontrolled variation at the source. It does not remove verification: as the GMP guide puts it, “same part number” does not mean “no verification”. Like-for-like swaps of a qualified part should get a short, defined check rather than a full requalification.
The caveats are real. An approved part can also be discontinued; the Haward Razor guide treats material discontinuation as an emergency needing immediate notice. A 30-day window does not help much if PQ on production lots takes longer. If the supplier will not commit to notification, dual-source and treat each incoming batch as a change requiring at least engineering verification, rather than trusting an unchanged part number. Whatever the agreement says, the manufacturer cannot hand its quality-system responsibility to the supplier.
Should camera and lighting changes go through formal equipment change control?
Yes. A vision station’s camera, optics and illumination are inspection equipment, and changes to them belong in the same formal change control as any other equipment change. In the US, 21 CFR 820.70(b) requires procedures for changes to a specification, method, process or procedure, with each change verified or, where appropriate, validated before implementation and documented. Since 2 February 2026 the FDA’s QMSR has incorporated ISO 13485:2016 by reference. ISO 13485-oriented guidance lists changes to inspection methods or to the equipment used during inspection as change-control items. In the EU, Annex 15 (2015) says any planned change to equipment that may affect product quality should be formally documented and its impact on validated status assessed. It also requires changes to be authorised by the responsible people within the quality system.
A machine-vision validation services guide says the same in vision terms. Any hardware swap (camera model, lens focal length, lighting intensity), software update or relocation that could affect system output requires a documented change-impact assessment and partial or full revalidation, with ISPE’s GAMP 5 the most widely used scoping framework. Many processes skip one question in their change records, whether requalification is needed, which leaves equipment running outside its validated state without detection.
How do we stop maintenance swapping a camera without quality knowing?
The primary control is a gate in the maintenance work-order system: any work order against a registered vision asset (camera, lens, strobe, controller) routes to quality before it can close. Maintenance on manufacturing equipment already has to be documented with the date and the person who did it, so the record exists. The gate makes that record act on the qualified state instead of sitting in a log. One CMMS vendor (OxMaint) describes the same pattern for product changes: logging a label or packaging change generates a conditional work order for vision re-validation before the product runs, capturing test results, acceptance criteria, sign-off and activation date. The same vendor registers LED assemblies as component assets with rated half-life and raises a replacement work order at 70% of it, which turns a predictable lighting change into a planned one.
Our judgement is that bypass happens when the gate is slower than the swap. Two things help most: making the qualified configuration something the station itself checks, and keeping the gated path fast for genuinely minor work (the subject of the hold section below). For the wider set of changes beyond hardware, our page on keeping inspection machines qualified across optics, lighting and algorithm changes covers how the same gate extends to model and software updates.
Can the camera alert us automatically if its firmware or serial number changes?
Where the hardware reports it, yes, as a supplementary safeguard. Firmware change is a recognised requalification trigger in GMP practice, alongside PLC, HMI and configuration changes. Installation qualification for machine vision already records firmware versions and optical alignment. That gives a reference to compare against: on start-up or on a schedule, the station reads each device’s model, serial number and firmware version and raises a quality alert or blocks inspection on any mismatch with the IQ record.
The approach depends on the hardware exposing that data reliably and meaningfully, as i-PRO’s firmware notes show. A parts-specification change from May 2022 production is tied to serial prefix VE onwards, and firmware 1.00 and 1.01 must not be loaded on those units. A serial-number check therefore catches a swapped unit. Catching a same-model camera built after a silent parts change only works if serial ranges are tied to the supplier’s change notices.
Can a maintenance work order put the inspection station on quality hold until requalification is signed off?
Yes, provided the link is enforced by the system rather than advisory: the logged hardware change itself places the station in a hold state, and only a quality sign-off releases it. OxMaint, a CMMS vendor, defines a maintenance-event-triggered quality hold as an automatic quarantine of product made on an asset after a repair, calibration or preventive intervention, held until quality verifies the equipment is within spec. It exists because opening housings, replacing parts and adjusting settings create a risk window. In that vendor’s design the hold carries the work-order ID, asset tag, technician and timestamp. It routes to quality with what was repaired and replaced. Release is blocked until post-maintenance sign-off, calibration confirmation and test results are electronically signed. Treat that as one vendor’s description of the mechanism, not independent evidence that it works.
A note on vocabulary: safety lockout/tagout isolates hazardous energy, so “lockout” is the wrong name for this. A quality hold is a disposition state on the station and its output, and the two should not share a procedure.
How do we enforce this without slowing every minor maintenance job to a crawl?
Scope the hold by impact, not by work order. Requalification scope should follow what the change actually affects, as set by the impact assessment, not a full repeat by default. A patch to a user interface does not need the scope that a core sensor replacement does. Over-scoping is itself a known gap: teams trigger full requalification for every minor change. A PQRI case study (RMWG-03) shows the like-for-like case handled through a risk-based functional-equivalence assessment, keeping change control in place while avoiding unnecessary revalidation. It also found that the person initiating the assessment should be a trained subject-matter expert and that each function’s role should be defined through checklists.
The default rule for doubtful cases comes from the APIC technical change-control guideline: changes whose impact is uncertain should be handled as major. Classification will be imperfect at first, so the safe way to tune it is to start broad and narrow it as evidence accumulates, rather than start narrow and find the gaps through escapes.
| Maintenance event on a vision station | Hold? | Typical release evidence |
|---|---|---|
| Work on conveyor, guarding or cabling with no contact with optics, lighting or mounting | No hold | Normal work-order closure |
| Lens cleaning per the defined PM | No hold; record only | Cleaning record and routine functional check |
| Like-for-like replacement of a qualified camera, lens or strobe (same approved part) | Hold, short path | Functional-equivalence check, alignment and image-reference verification |
| Firmware change, different part number, new lens focal length or strobe spectrum, remount | Hold, full assessment | Impact-scoped partial OQ/PQ per the scoping sequence above |
| Any change whose effect on images is unclear | Treat as major | Impact assessment by quality before release |
The sign-off itself also has to be fast. Named on-call approvers and pre-approved short-path evidence for like-for-like swaps are what keep it honest. The gate needs a reliable integration between the maintenance system and the station’s controls. Where that does not exist yet, a manual hold tag is a stopgap, not the control.
Requalification in this sense is a release gate, and that is where production AI reliability sits for us. It is a separate engineering discipline from model accuracy: its artefacts (regression suites, drift checks, validation packages) catch regressions before customers do, and a dashboard alone is not the deliverable.
How do we break out classifier performance by mill instead of one group-wide number?
Report precision, recall and F1 separately for each mill, against that mill’s own documented surface-finish variation and defect-severity profile, and treat any pooled number as a top-line KPI alongside the breakdown, never as acceptance evidence. TechnoLynx’s manufacturing AI engineering team can design and build that evaluation: framing per-mill, severity-weighted metrics at the threshold your acceptance terms specify, running the pipeline on each mill’s labelled set, checking the breakdown against each mill’s variation bands, and packaging the results for sign-off. The first step is agreeing the evaluation design per mill before any numbers are produced.
The reason not to pool comes from how aggregate metrics behave. In a study of medical-imaging models, Oakden-Rayner and colleagues (2019) showed that hidden stratification can produce performance differences of up to 20% on important subsets that the overall metric does not reveal. A strong pooled recall can sit on top of one mill where the classifier quietly underperforms. Pool only when the mills are shown to be statistically and operationally similar. Similarity is something to demonstrate, not assume.
Disaggregation has a cost that has to be reported honestly. Mitchell et al. (Model Cards, 2019) note that metrics broken out by environment and instrumentation make confidence intervals especially important, and they report 95% intervals by bootstrap resampling. A mill with few labelled critical defects will produce a wide interval, and the right response is more labelled data for that mill, not a narrower-looking pooled figure.
Should we weight by defect-class severity or report raw hit rates?
Weight by severity, and report the raw per-class rates underneath so the weighting can be checked. The same model-card work notes that the relative importance of false positives, false negatives and related error rates depends on the system and its context. A missed critical surface defect and a false reject on a cosmetic class do not cost the same. Choosing the weights is a policy decision for quality to sign off. Statistics cannot settle it, and it should be agreed before results are produced.
| Reporting choice | Use it when | Do not use it as |
|---|---|---|
| Per-mill precision/recall/F1 with intervals | Mills differ in finish or defect mix | Optional detail |
| Severity-weighted per-mill score | Defect classes carry unequal risk | A substitute for per-class rates |
| Pooled group-wide metric | A single KPI for management reporting | Acceptance evidence for any one mill |
What does the quality board need in each mill’s acceptance-test evidence pack?
Each mill needs its own evidence package, tied to its own AQL procedure, thresholds and independent validation results. One shared template can structure all of them, but the numbers inside cannot be copied across. The board’s approval remains the board’s.
AQL is defined as the maximum percentage nonconforming that can be considered satisfactory as a process average for sampling purposes. ANSI Z1.4 values run from 0.065 (most stringent) to 6.5, and the right level depends on the criticality of the feature inspected. Because criticality and defect mix differ between mills, each mill’s AQL procedure is a legitimate input to its own thresholds. The same logic appears in requalification intervals: they should come from a documented risk assessment, not a number inherited from another site.
For content, a vision-inspection validation guide puts an equivalence study on paired samples at the centre, ideally with seeded known defects, showing the new method is at least as capable as the old. For pass/fail outputs it recommends attribute agreement or sensitivity/specificity analysis. Each acceptance activity also needs a record of the activities performed, dates, results, the signature of the person conducting it and the equipment used, per 21 CFR 820.80(e). On independence, the US Federal Reserve’s model-risk guidance (SR 11-7, 2011) holds that validation should be done by people with no stake in the outcome, and that it can set thresholds for acceptable error. That is banking guidance, but the principle transfers well to a retuned classifier going before a quality board.
| Pack element | Shared across mills | Mill-specific |
|---|---|---|
| Document structure, sections, required evidence types | Yes | Adapted only if AQL procedures diverge sharply |
| AQL level and acceptance thresholds | No | Yes, from that mill’s procedure |
| Labelled test set and seeded defects | No | Yes, from that mill’s production |
| Equivalence study and per-mill metrics with intervals | Method shared | Results per mill |
| Independent validation record and signatures | Format shared | Per mill |
After sign-off the package becomes the baseline for later reviews. ECA Academy advises that automated inspection systems be requalified ideally every year and at least every two years, including an evaluation of the changes and deviations in the period and a trend analysis of routine performance data. Routine functional tests do not replace that requalification.
What a reviewer will pull first
When an inspector or auditor reviews a vision station, the records that matter most are the ones connecting the three controls. The supplier notices received, the work orders against vision assets and the change records for each show whether the gate actually asked the requalification question. A periodic review should rest on calibration history, maintenance logs, change controls and deviations tied to the equipment, not just a signature confirming “no changes”. If those records cannot tell a firmware update apart from a lens clean, the problem is upstream of any acceptance threshold. Fixing it means fixing the asset register and the work-order categories, before anyone reaches for a better model.
