Impartiality and confidentiality under ISO/IEC 17025

Clause 4.1 requires laboratory activities to be undertaken impartially and structured and managed to safeguard impartiality. The laboratory must identify risks to impartiality arising from its activities, relationships or the relationships of its personnel, and eliminate or minimise them.

Common risk sources

• Calibrating equipment the same organisation manufactures, sells or services.
• Incentives tied to pass rates or throughput.
• Personnel calibrating instruments they also use in production.

Confidentiality

Clause 4.2 requires the laboratory to be responsible, through legally enforceable commitments, for the management of all information obtained or created. Customers must be informed in advance of information the laboratory intends to place in the public domain, and told when information is released because of legal obligation.

Identifying risks is the requirement, not having none

Clause 4.1.4 asks the laboratory to identify risks to impartiality on an ongoing basis, including those arising from its activities, its relationships and the relationships of its personnel. The word that does the work is ongoing: a risk register written at accreditation and never touched again is the finding, and a register that concludes no risks identified is a stronger one, because every laboratory has some.

What matters is the pairing of a real risk with a control that plausibly addresses it. A laboratory inside a manufacturer cannot eliminate the relationship; it can separate reporting lines, remove throughput from the technical staff's objectives, and route conformity statements through someone with no production responsibility.

Confidentiality, and the two disclosures it turns on

Clause 4.2 makes the laboratory responsible through legally enforceable commitments — usually contract terms and staff undertakings — for all information obtained or created during its activities. Two cases carry specific obligations. Where the laboratory intends to place information in the public domain, the customer is informed in advance. Where the laboratory is required by law or authorised by contract to release information, the customer is notified of what was provided, unless the law prohibits the notification.

That second case is the one people miss. Releasing data to an accreditation body during an assessment, or to a regulator, is legitimate; not telling the customer it happened is not, unless the law forbids telling them.

The practical minimum

• A maintained impartiality risk register with named owners and review dates.
• Staff declarations of interests, refreshed on a cycle rather than at induction only.
• Confidentiality undertakings from employees, contractors and anyone acting on the laboratory's behalf — including external reviewers and IT suppliers with access to result data.
• Access control over result systems that matches the confidentiality commitments actually made.
• A record of every disclosure to a third party, and of the notification to the customer.