Medical device contract manufacturing: you stay the legal manufacturer

Legal manufacturer and builder are different roles

Regulations distinguish the organisation responsible for a device from the one that physically makes it. The first holds design controls, the risk management file, clinical or performance evidence, labelling, post-market surveillance and the declaration of conformity. The second executes a defined process. Outsourcing production shifts nothing on that first list, and no contractual wording achieves it. What the arrangement does move is where manufacturing records physically live, which is why access rights, retention periods and the ability to inspect stop being boilerplate and become substantive terms you should negotiate rather than accept.

The supplier joins your quality system

A device contract manufacturer is not an arms-length vendor. They become a controlled supplier inside your quality management system, meaning you approve them on evidence, define what they may and may not decide alone, monitor performance against agreed measures and re-evaluate them periodically. Their own certification against a device quality standard such as ISO 13485 helps and does not discharge your obligation. Auditors look for your assessment of them rather than theirs of themselves. Companies that adopt a supplier's certificate in place of their own evaluation have recorded a decision nobody actually made.

Design outputs, not intentions, are what gets built

The manufacturer builds from released documentation: drawings, specifications, work instructions, inspection criteria, packaging and labelling. Anything held informally does not exist — a preference expressed in a meeting, a tolerance everyone knows matters, an assembly trick learned during prototyping. Transferring a device therefore forces the design file to become complete, and the exercise routinely exposes decisions that were never written down. That is uncomfortable and valuable. What must not happen is the manufacturer quietly filling gaps with their own judgement, since an undocumented process choice becomes an unvalidated variable the next time anything moves.

Process validation is shared, costly and easy to underestimate

Where a process cannot be fully verified by inspecting its output — welding, moulding, sterilisation, sealing, bonding, cleaning — it has to be validated, and the evidence must exist for the specific equipment at the specific site. Validation consumes materials, machine time and engineering effort on both sides, and it repeats whenever equipment, tooling, material or location changes. Who performs it, who pays for it and who owns the resulting protocols and reports belongs in the agreement rather than in an email during the first build. Treating it as the supplier's routine problem produces a schedule slip instead.

No change is small once the device is on the market

A supplier substituting an adhesive, moving a moulding tool to another press, switching sterilisation provider or altering a cleaning agent can each affect performance, and each may require notification, re-validation or a regulatory submission. The control is simple to state: a written obligation not to change materials, processes, sub-suppliers or locations without your prior approval, plus a duty to report anything that might touch the product. It is harder to sustain, because change requests are inconvenient for both parties. Auditing against it occasionally is what keeps the obligation more than decorative.

Frequently asked questions

Does our contract manufacturer need its own device certification?

Not invariably as a legal matter, and usually in practice. Certification against a device quality standard shows that a site runs the disciplines the sector expects, and its absence leaves you carrying the entire burden of demonstrating control. What certification never does is transfer responsibility: you remain the legal manufacturer, and your approval of the supplier has to rest on your own evidence, including audits, performance data and review of how they handle changes and deviations.

Can the manufacturer change a component supplier without telling us?

Only where your agreement allows it, and it should not. Sub-supplier changes alter material, process and sometimes performance, and they are a well-worn route to field problems nobody can subsequently explain. Write the restriction explicitly, name the categories needing prior approval rather than mere notification, and verify compliance during audits by tracing a recent batch back to its actual material sources instead of asking whether anything has changed.

During an inspection, do authorities visit them or us?

Either, and frequently both in sequence. Your site gets examined for how design, risk and surveillance obligations are met and how supplier control is exercised; theirs for how production and process controls run. Findings at one generate questions at the other, so the useful preparation is making sure the two systems agree — same specifications, same change records, same document versions, and a clear account of who is entitled to decide what.