Supplier qualification refers to the regulated process by which a medical device manufacturer evaluates, selects, contracts, monitors, and re-evaluates suppliers and subcontractors. The normative basis is Clause 7.4 of ISO 13485, which requires documented procedures and established criteria for evaluation and selection in Clause 7.4.1, purchasing information in Clause 7.4.2, and verification of purchased products in Clause 7.4.3. Legally, the selection and control of suppliers and subcontractors is an explicit component of the quality management system according to Article 10(9)(d) of Regulation (EU) 2017/745. The existing glossary entry for Quality Management System mentions supplier evaluations as a task; this section focuses on the procurement process itself.
Evaluation Criteria, Selection, and Agreement
ISO 13485 Clause 7.4.1 requires that criteria be based on the supplier’s ability to meet the organization’s requirements, their performance, the impact of the purchased product on the quality of the medical device, and that they are proportionate to the risk associated with the medical device. This risk-based approach results in a tiered system: suppliers of safety-critical components, materials with body contact, sterilization service providers, software suppliers, or contract manufacturers are qualified more intensively than suppliers of non-critical consumables. Common tools include questionnaires, certificate reviews, sampling and first article inspection reports, process capability evidence, and on-site audits. Engagement is typically formalized through a Quality Assurance Agreement (QAA), which regulates specifications, prohibitions on changes without consent, inspection and release obligations, traceability and retention periods, deviation and complaint handling, audit rights (including access for Notified Bodies and authorities), and reporting obligations for incidents.
Monitoring, Incoming Goods, and Supplier Changes
Qualification does not end with approval. ISO 13485 requires planning the monitoring and re-evaluation of suppliers, monitoring performance against the requirements for the purchased product, and feeding the results into the re-evaluation; non-fulfillment must be addressed with the supplier in a risk-proportionate manner. Key performance indicators (KPIs) typically include delivery and quantity reliability, error rates in incoming goods, complaint trends, frequency of deviations, and response times. The verification of purchased products according to Clause 7.4.3 serves as the operational filter: inspection scopes are determined based on risk and supplier performance; a mere acceptance of certificates is only sufficient for appropriately qualified suppliers. Changes at the supplier require special attention, such as changes in material batches, raw material sources, manufacturing sites, or process parameters: these can affect biological evaluation, process validation, and technical documentation and must therefore be made subject to contractual notification requirements. Furthermore, it should be noted that Notified Bodies may also conduct unannounced audits at suppliers and subcontractors in accordance with Annex IX, Section 3.4 of Regulation (EU) 2017/745.
Distinction from Outsourcing of Study Tasks and Contract Manufacturing
Supplier qualification within the meaning of Clause 7.4 concerns the procurement of products and product-related services for product realization. This is to be distinguished from the outsourcing of tasks in clinical trials to a service provider, which is governed by the requirements for sponsor obligations and contracting in clinical trials, and sets its own requirements for suitability assessment, contract content, and oversight. Contract manufacturing must also be distinguished: anyone who has a product fully manufactured remains the manufacturer within the meaning of Article 2(30) of Regulation (EU) 2017/745 and retains responsibility under Article 10; the qualification of the contract manufacturer does not replace this responsibility. Finally, supplier qualification is not a conformity assessment: an ISO 13485 certificate from the supplier is an initial signal, not proof of the suitability of the purchased product for the specific application.
Relevance for clinical trials
Investigational products for clinical trials are often produced in small batches involving external manufacturers, sterilization service providers, and material suppliers. For the usability of study data, it is crucial that this supply chain is already qualified, ensuring that the investigational products are representative of the product subsequently placed on the market. Annex XV, Chapter II of Regulation (EU) 2017/745 requires information on the design and manufacture of the investigational product; gaps in supplier qualification have a direct impact there.
During the course of a study, supplier changes and modifications at suppliers are particularly sensitive because they affect the comparability of the product units used and thus the evaluability, and depending on the scope, may trigger a notification of a substantial modification under Article 75. Complaints and product defects from the study must also be traced back to the supplier and incorporated into corrective and preventive actions (CAPA). Full-service CROs like Mediconomics support manufacturers and sponsors in preparing the description of the investigational product and its manufacturing for study documentation, evaluating changes in the supply chain from a study perspective, and documenting product defects in an audit-proof manner.
Frequently Asked Questions (FAQ)
Do all suppliers need to be qualified with the same intensity?
No. ISO 13485 Clause 7.4.1 requires criteria that are proportionate to the risk and the impact of the purchased product on the quality of the medical device. A documented criticality classification is therefore the starting point.
Is an on-site supplier audit mandatory?
The standard does not prescribe a fixed method. For critical suppliers, especially contract manufacturers and sterilization service providers, an on-site audit is regularly required in practice to evaluate the effectiveness of the processes.
What happens if a supplier makes unannounced changes?
The manufacturer must evaluate the impact on specification, risk management, validation, and technical documentation, block batches if necessary, and initiate corrective actions. As a preventive measure, change notification obligations should be included in the Quality Assurance Agreement.
Regulatory References
- ISO 13485:2016, Clause 7.4.1 – Purchasing process, criteria for evaluation, selection, monitoring, and re-evaluation
- ISO 13485:2016, Clauses 7.4.2 and 7.4.3 – Purchasing information and verification of purchased products
- Regulation (EU) 2017/745, Article 10(9)(d) – Selection and control of suppliers and subcontractors
- Regulation (EU) 2017/745, Annex IX, Sections 2.2 and 3.4 – Assessment of the quality management system and unannounced audits at suppliers
- Regulation (EU) 2017/745, Article 2(30) and Article 10 – Definition of manufacturer and manufacturer obligations
