Qualifying a Medical-Device Supplier: How It Differs from Industrial Sourcing

Almost every step has an industrial analogue, which is exactly what makes the transition dangerous — the steps look familiar, so buyers run their normal playbook and find the gap late.

A tour answers "can they make this?" An audit answers "can they prove how they made it, consistently, after the fact?" Those questions have almost nothing in common, and a supplier can pass the first while failing the second badly. The audit is a records exercise conducted on site: you sample procedures, follow them into actual records, and see whether the two match.

Since 2 February 2026 the FDA's Quality Management System Regulation has incorporated ISO 13485:2016 by reference into 21 CFR part 820, with FDA-specific requirements added — so a certified supplier's vocabulary is closer to the US framework than before. That helps; it does not make a certificate a substitute for your own audit. Read the scope line rather than the logo, confirm the certificate with the issuing body, and ask for the last two audit reports including non-conformities and closure evidence — a supplier with zero findings across several years is telling you about their auditor, not their system. Ask too about MDSAP: it reflects one audit accepted by the US FDA, Health Canada, Australia's TGA, Japan's PMDA and Brazil's ANVISA, so surviving it means something, though it authorizes no product.

This question usually gets settled by accident, and that is expensive. In industrial sourcing, "we sent a drawing and they improved it" is a good outcome. In device sourcing it is a change to a controlled design, and it has to land inside a design-control process with verification, validation and a documented review — not in an email thread.

Decide explicitly whether you are the design owner and the manufacturer builds to your specification, or whether you are buying their design and putting your name on it. Both are legitimate; they produce different obligations and different answers to what happens if you leave. Then settle the file. Whether your team calls it a design history file — the long-standing US term — or a design and development file in ISO 13485 language, someone must hold a coherent record of design inputs, outputs, reviews, verification, validation and changes. If it lives only on your supplier's server and your agreement gives you no copy on exit, you have outsourced something you cannot take back.

Because in industrial sourcing an unannounced change is an annoyance, and in device sourcing it is a compliance event. A supplier who quietly re-sources a resin, moves molding to a second site, swaps a sterilization provider or updates a firmware toolchain has changed your validated state — and if you learn about it from a field complaint, you are reconstructing history under pressure.

The clause worth fighting for is narrow: no change to materials, critical-component suppliers, processes, process parameters, tooling, test methods, software, sites or subcontractors without prior written notification, a defined notice period, and your right to require re-qualification. Vague language — "significant changes" — collapses in the exact argument it was written for. Two additions earn their keep: name the sub-tier, because quiet substitutions happen there, and agree what a change obliges you to do, not only what it obliges them to tell you.

Deeper than industrial buyers expect, and in a specific direction: you must be able to start from a distributed unit and work backwards. Traceability is a chain that survives an investigation, not a stamp on a carton.

Every item below exists because buyers who skipped it redid work. Note that almost none of it involves the supplier at all.

Three of them. First, none of this substitutes for regulatory advice — classification, submission strategy, notified-body selection and retention obligations are jurisdiction-specific and they move, as the February 2026 change to the US quality-system framework shows. Second, no amount of supplier qualification makes an unauthorized device marketable; qualification and market authorization are separate programs that merely run at the same time. Third, bluntly: we do not serve this vertical and hold no biomedical supplier data, and a service that pretends otherwise is selling you the easy half of a problem whose hard half is regulatory.

Where we can help is the unregulated hardware alongside a device program — machined and molded sub-components, enclosures, stands and carts, cable assemblies, fixtures, packaging tooling — ordinary work Taiwan does well at moderate volume. If that is the part of your bill of materials you are stuck on, describe it on our request page, including the standards it must meet, and Taiwan Supplier Hub returns a shortlist of at least three verified manufacturers that have confirmed they want the project within 14 days, US$99 at launch, refunded if we can't deliver. For the device itself, start with your regulatory consultant.