ISO 13485 Supplier Qualification Checklist for Medical Device OEMs
A supplier can show an ISO 13485 certificate and still be the wrong fit for a medical device project. The certificate is a useful starting point, not a complete answer.
For medical device OEMs and startups, supplier selection affects design control, manufacturability, traceability, non-conformance handling, cost, and launch timelines. If the supplier is involved in product design, tooling, moulding, assembly fixtures, or production support, the qualification process must go beyond a document check.
ISO 13485 is a quality management system standard for organisations involved in medical devices. It is not product approval, and it does not mean a specific device, component, mould, or process is approved by a regulator. The ISO page on ISO 13485 medical devices explains the standard at a high level.
This guide gives a practical ISO 13485 supplier qualification approach for OEMs, founders, sourcing teams, and quality teams working with engineering and manufacturing partners in India.
ISO 13485 shows a quality system, not product approval
ISO 13485 certification indicates that an organisation’s quality management system has been assessed against the standard. It can cover areas such as document control, purchasing controls, production controls, traceability, corrective action, and risk-based processes.
That does not automatically mean:
The supplier is approved for your device category
The supplier’s certificate covers the exact activity you need
A part made by the supplier is compliant with your intended market
A mould, jig, or production process has been validated for your product
Regulatory registration or product approval has been granted
This distinction matters. An OEM remains responsible for the medical device it places on the market. A supplier may support a defined activity, but the OEM must decide how that activity fits into the device’s quality plan, risk management file, technical documentation, and regulatory route.
For example, a supplier may be capable of injection moulding a plastic housing. The OEM still needs to confirm that the drawing, material specification, critical dimensions, inspection plan, process controls, packaging needs, and change controls match the device requirements.
A good supplier qualification process treats ISO 13485 as one input. It then checks scope, capability, process fit, communication discipline, and quality responsibilities.
Check the certificate scope before anything else
The most common mistake is to ask, “Do you have ISO 13485?” and stop there. The better question is, “What is included in the certificate scope, and does it match the work we are giving you?”
Certificate scope is the part of the certificate that describes the activities, sites, and sometimes service areas covered by the quality management system. Read it carefully.
Check the following details:
Legal entity name
The certificate should match the company you are contracting with. If the group has multiple entities or units, confirm which one will perform the work.
Site address
A certificate for one site may not cover another facility. If design, mould making, moulding, or inspection happens at different locations, map each activity clearly.
Covered activities
Look for wording that relates to the work you need. Examples may include design and development, manufacture, assembly, servicing, or related support. Do not assume that one activity includes another.
Certificate validity
Check the issue date, expiry date, and certification body. Ask for current copies when the project starts and during periodic review.
Exclusions and limitations
Some quality systems exclude design and development if the organisation does not perform design work. If your supplier will support design inputs, DFM, prototypes, tooling decisions, or design changes, clarify how those responsibilities will be controlled.
Sub-supplier involvement
If the supplier uses outside vendors for tooling steel, heat treatment, mould base work, surface finishing, special processes, testing, or packaging, ask how those vendors are assessed and controlled.
A certificate scope review should be recorded. Even a simple supplier file can include the certificate copy, scope notes, risk rating, approved activities, and the person who reviewed it.
Use supplier audits to test the actual working process
A medical device supplier audit should test whether the supplier’s daily working method matches your quality needs. It is more than a facility visit.
The depth of the audit should match the risk. A supplier making a low-risk prototype jig may need a lighter review than a supplier producing finished device components with critical dimensions. A startup may begin with a desktop audit, then move to an on-site audit before serial production.
A practical audit can cover these areas:
Document and record control
Check how drawings, specifications, inspection formats, process sheets, and revisions are controlled. Ask how obsolete documents are removed from use.
Design support and DFM control
If the supplier gives product design or DFM inputs, confirm how recommendations are recorded. Design suggestions that affect fit, function, material, safety, or usability must not happen through informal messages alone.
Tooling and mould control
For mould design and mould making, review how tool drawings, tool maintenance, mould trial records, and engineering changes are managed. The mould is not only a production asset. It is part of the controlled manufacturing route for the component.
Jigs and fixtures
Jigs used for inspection, assembly, drilling, trimming, bonding, or holding parts need identification and control. Confirm how fixtures are verified before use and after repair.
Injection moulding process control
Review how process parameters are established, recorded, and changed. If the component has critical dimensions, the inspection plan should show what is measured, when, and by whom.
Training and competence
Check whether people performing inspection, mould maintenance, and production tasks are trained for assigned work. Training records should be current and relevant.
Non-conformance and corrective action
Ask for examples of how non-conforming parts are identified, segregated, investigated, and closed. The aim is not to find a perfect record. The aim is to see whether the supplier handles problems in a disciplined way.
Calibration and measurement
Measurement tools used for acceptance should be identified and calibrated. If the supplier relies on external labs, confirm how lab reports are linked to the job or batch.
Cleanliness and handling
Medical device parts may need specific handling, packaging, or contamination controls, depending on their use. Do not assume the supplier knows the intended use unless it is documented.
Use the audit to confirm what the supplier can actually perform under control. Good documentation should reflect real practice, not just a file created for audit day.
Define responsibilities, traceability, and change notification early
Many supplier issues come from unclear boundaries. The OEM expects one thing, the supplier assumes another, and the gap appears when a part fails inspection or a design changes late.
A written quality agreement helps prevent this. It works alongside the commercial agreement, purchase order, NDA, drawing pack, and technical specification. It should be clear enough for engineering, purchase, quality, and production teams to use.
Responsibilities need clear ownership
Define who owns each activity. For example:
Product requirements and intended use
Design inputs and design approvals
DFM review and risk review
Material selection and approved grades
Tool design approval
Mould trial approval
First article inspection
Routine inspection
Packaging and labelling requirements
Non-conformance review
Rework approval
Scrap approval
Regulatory documentation support, if any
If the supplier supports product design, DFM, jigs, mould design, mould making, or injection moulding, write the boundary clearly. Support does not mean the supplier becomes the legal manufacturer or takes over product approval responsibilities unless a formal regulatory arrangement states so.
Traceability should match the risk
Traceability does not have to be complex for every part, but it must be suitable. Decide what needs to be traced and how long records must be retained.
Common traceability items include:
Raw material batch or lot
Supplier batch number
Mould identification
Machine or process route, where relevant
Operator or inspector record, where relevant
Inspection results
Non-conformance records
Dispatch quantity and date
Customer purchase order or job number
For injection moulded parts, traceability can link the production lot to material certificates, mould trial data, inspection records, and dispatch documents. If the part later needs investigation, this trail saves time and reduces guesswork.
Change notification must be specific
Change control is one of the most sensitive parts of medical device supply. The supplier should not make changes that may affect fit, form, function, safety, performance, traceability, cleanliness, packaging, or compliance without defined notification and approval.
Changes that usually need prior notification include:
Material grade or supplier change
Tool modification or major mould repair
Change in moulding location
Change in key process parameters beyond agreed limits
Change in critical inspection method
Change in packaging method
Use of a new sub-supplier for a controlled process
Drawing revision or specification change
Change in jig or fixture used for acceptance
The quality agreement should define the notification period, approval method, emergency handling, and evidence required after change implementation.
A good agreement also covers escalation. If there is a repeated defect, delayed corrective action, or unapproved deviation, the OEM should know who will be contacted and how quickly.
A practical checklist for qualifying a medical device supplier
Use this checklist before approving a supplier for development, tooling, or production. Scale it to the risk of the part and the supplier’s role.
Supplier profile
Confirm the legal entity, location, key contact points, and activities offered.
Certificate review
Collect the current ISO 13485 certificate if available. Check scope, site, validity, certificate body, and exclusions.
Activity fit
Confirm whether the supplier will support product design, DFM, jigs, mould design, mould making, injection moulding, assembly support, or other work.
Risk classification of supplied work
Classify the supplied item or service based on its effect on device safety, function, regulatory documentation, and production continuity.
Capability review
Check whether the supplier has the processes, people, inspection methods, and records needed for the assigned work.
Supplier audit plan
Decide whether to use a questionnaire, remote audit, on-site audit, sample job review, or periodic surveillance.
Drawing and specification control
Make sure the supplier works only with approved revisions and has a method to prevent use of obsolete drawings.
Material control
Define approved materials, certificates needed, storage requirements, substitutions, and approval rules.
Inspection plan
Agree on critical dimensions, sampling method, measurement tools, acceptance criteria, and record format.
Traceability plan
Define batch identification, lot records, mould or jig identification, and dispatch linkage.
Non-conformance handling
Agree on segregation, reporting, rework approval, concession process, root cause analysis, and corrective action.
Change notification
List the changes that need prior written approval and the documents required after implementation.
Sub-supplier control
Identify any outsourced activity and confirm how the supplier qualifies and monitors those vendors.
Record retention
Set retention time for inspection reports, material records, tool records, change records, and corrective actions.
Quality agreement
Sign a quality agreement before production. For contract manufacturing, it should connect quality duties with project scope, drawings, specifications, and purchase controls.
Periodic review
Review supplier performance at planned intervals. Include delivery quality, defect trends, audit findings, response speed, and change discipline.
This checklist should not become a paper exercise. The value lies in matching supplier controls to actual product risk.
How Medimals Healthcare can support OEM development and manufacturing preparation
Medimals Healthcare, based in Chennai, India, supports medical device OEMs and startups across practical engineering and manufacturing preparation activities. These include:
Product design support
Design for manufacturability review
Jigs and fixture development
Mould design
Mould making
Injection moulding support
These are company capabilities, not claims of product approval or customer outcomes. OEMs should still run their own supplier qualification process, define quality responsibilities, and maintain regulatory ownership for their devices.
For early-stage teams, the useful step is to connect design decisions with later manufacturing needs. A small design feature can affect mould complexity, inspection access, assembly fit, and batch consistency. DFM discussions, fixture planning, and mould design reviews can reduce avoidable rework when they are documented and reviewed at the right time.
For established OEMs, the focus may be different. The need may be controlled moulding support, better fixture planning, engineering change control, or documentation that fits the OEM’s supplier quality process.
The best results come when the OEM shares enough technical context. Intended use, critical dimensions, mating parts, expected volumes, material constraints, handling needs, and inspection expectations all help the supplier give better inputs.
Frequently asked questions
Does ISO 13485 certification approve a medical device component?
No. ISO 13485 relates to the supplier’s quality management system. It does not approve a specific component, finished device, mould, material, or production process. Product compliance depends on the device requirements, intended market, regulatory route, validation, documentation, and OEM controls.
Should a startup audit every supplier on-site?
Not always. The audit method should match the risk. A questionnaire or document review may be enough for low-risk early development work. For critical parts, production parts, or suppliers handling controlled manufacturing steps, an on-site or detailed remote audit is usually more suitable.
What should go into a quality agreement with a manufacturing supplier?
A quality agreement should define responsibilities, approved documents, inspection requirements, traceability, non-conformance handling, change notification, sub-supplier controls, record retention, and escalation steps. It should be specific to the supplied part or service, not a generic template.
Supplier qualification works best when it is practical, risk-based, and documented. Start with the ISO 13485 certificate, but do not stop there. Check the scope, audit the real process, define responsibilities, control traceability, and put change notification in writing.
If your team is planning a medical device development or moulding project, connect with Medimals Healthcare to discuss product design, DFM, jigs, mould design, mould making, and injection moulding support.
Comments