Resources

Your Supplier's Quality System Is Now Your Quality System: Purchasing Controls Under the QMSR

Author

PDPriya Deshmukh
Supplier Quality Manager

Expertise

New Product Introduction
Quality Assurance and Regulatory Affairs

Service

Contract Manufacturing

Sector

Diagnostic Devices
Therapeutic Devices
Drug Delivery

Topic

Supply Chain & Sourcing Strategy
Quality & QMS

Published

4 May 2026
7 min read

TL;DR

• Regulators hold the legal manufacturer responsible for the entire supply chain. Outsourcing production transfers the work, not the liability.
• Supplier controls sit in the top four most-cited FDA Form 483 observations for devices year after year, alongside CAPA, design controls, and complaint handling. In 2025, CAPA, complaint handling, and supplier controls each appeared in 25–26 of the 54 device warning letters issued.
• A quality agreement is a technical document, not a legal formality. Its most important clause is the definition of what constitutes a notifiable change.
• Incoming inspection is the weakest form of supplier control and the most commonly over-relied upon. You cannot inspect quality into a component.
• The FDA's Quality Management System Regulation, effective 2 February 2026, aligns 21 CFR 820 with ISO 13485:2016. Early inspection data shows management oversight and risk-based supplier control emerging as dominant citation areas.

Contract manufacturing is now the default operating model for most device companies, and for good reason. Capital efficiency, access to validated processes, established supply relationships, and the ability to scale without building a plant are all real advantages.

What does not transfer is accountability. Under 21 CFR 820, ISO 13485:2016, and EU MDR 2017/745, the legal manufacturer — the entity whose name is on the label — remains responsible for the conformity of every component and every process, including those it does not perform and cannot directly observe.

This produces a specific asymmetry that catches companies out: the risk sits with you, the information sits with them. Purchasing controls exist to close that gap, and the enforcement record suggests the industry is not closing it well.

The Enforcement Record Is Consistent and Unambiguous

Analysis of FDA Form 483 observations under 21 CFR Part 820 for fiscal years 2022–2024 places four subsystems at the top, in stable order:

1. 1CAPA (820.100) — the most cited observation, year after year
2. 2Design controls (820.30) — increasingly tied to discrepancies between the marketed device and the cleared device
3. 3Complaint handling (820.198)
4. 4Purchasing controls (820.50) — supplier quality management and purchasing documentation

The pattern continues into enforcement. Of the 54 medical device warning letters issued in 2025, CAPA, complaint handling, and supplier controls each appeared in 25–26 of them. Device warning letters rose roughly 17% year over year in FY2025, following a near-doubling in FY2024.

These are not exotic findings. They are the same four subsystems, cited repeatedly, across years and across company sizes. The persistence is the signal: this is not a knowledge problem in the industry, it is an execution problem.

Supplier Qualification Has to Be Risk-Based or It Is Theatre

Both 21 CFR 820.50 and ISO 13485 clause 7.4.1 require evaluation and selection of suppliers based on their ability to meet requirements, with the extent of control proportionate to the effect of the purchased product on the finished device.

The word carrying the load is proportionate. A single qualification questionnaire applied identically to the supplier of a critical implantable-grade polymer and the supplier of shipping cartons is not risk-based control; it is a filing system.

A workable stratification looks like:

Critical suppliers — components or processes where failure can directly cause patient harm, or where the characteristic cannot be verified on receipt. Sterilisation, moulded parts with critical dimensions, adhesives, electrode gels, battery cells, PCB assembly for safety-critical circuits. These require on-site audit, process validation review, change notification agreements, and often first-article and periodic re-qualification.

Significant suppliers — components affecting device performance but with verifiable characteristics. Enclosures, cables, connectors, packaging. Documented evaluation, certificate of conformance requirements, periodic performance review.

Standard suppliers — commodity items with no direct device impact. Approved vendor list, purchase order specification, performance monitoring.

The stratification itself should be documented and justified, because an auditor's first question is not "did you audit this supplier?" but "how did you decide what level of control this supplier needed?"

The Quality Agreement Is a Technical Document

Most quality agreements are drafted by legal teams from a template and signed by people who will never use them. This is a mistake, because the quality agreement is the only mechanism by which you get visibility into a process you do not run.

The clauses that determine whether it functions:

Change notification — and specifically, the definition of a change. This is the most important sentence in the document. Suppliers optimise their own processes continuously: a different resin grade with "equivalent" properties, a new moulding machine, a relocated production line, a different sub-tier supplier for a plating operation, a revised cleaning agent. Any of these can alter your device. If the agreement says "the Supplier shall notify the Customer of material changes," you have no protection, because material is the supplier's judgement. Enumerate: raw material source or grade, tooling, equipment, process parameters, manufacturing site, sub-tier suppliers, test methods, and any change requiring re-validation on their side.

Right to audit — including sub-tier. Your supplier's supplier is also in your supply chain. If your critical moulder outsources their secondary operations, that operation is in scope.

Deviation and nonconformance disclosure. Suppliers dispose of nonconforming material internally as a matter of routine. You need to know when a lot you received was subject to a deviation, a concession, or rework.

Record retention and access. Device master record and device history record traceability breaks the moment a supplier destroys records on a schedule shorter than your product lifetime plus regulatory retention.

Sterilisation and process validation ownership. If the supplier holds the validation, specify who owns revalidation triggers, who reviews the dose audits, and what happens on a bioburden excursion.

Incoming Inspection Is the Weakest Control You Have

There is a persistent belief that a robust incoming inspection programme compensates for weak supplier control. It does not, for three reasons.

Sampling plans have defined risk. An ANSI/ASQ Z1.4 general inspection level II single sampling plan at AQL 1.0 for a 1,000-unit lot accepts on the basis of 80 pieces. That plan is designed to reject lots that are substantially worse than the AQL. It is not designed to catch a 0.5% defect rate, and it will not.

Most critical characteristics are not inspectable on receipt. Bond strength, sterility, biocompatibility, residual monomer, weld integrity, and long-term dimensional stability after moulding stress relief are all destructive, expensive, or slow to test. You accept them on the basis of the supplier's process control, whether or not you acknowledge it.

Inspection detects; it does not prevent. By the time a nonconformance is found at goods-in, the supplier has already run the batch, consumed the material, and moved on. The cost is absorbed somewhere, and the schedule is already lost.

The higher-leverage controls are upstream: process validation review at qualification, statistical process control data supplied with each lot, change notification, and periodic on-site audit of the actual process rather than the quality manual.

Where Contract Manufacturing Relationships Break Down

The specification is ambiguous, and the supplier resolves the ambiguity in their favour. Not maliciously — a drawing that does not state a surface finish requirement will be produced to whatever finish the process naturally yields. If that finish affects adhesion, you have a latent defect that will appear when the supplier changes tooling.

Nobody has visited the line. A quality manual, a certificate, and a video call tell you what the supplier intends to do. Walking the line tells you what they do. The gap between those two is where problems live.

Cost pressure passed down without specification change. When a purchasing team negotiates a 12% price reduction and the specification does not change, something in the supplier's process has to give. It usually gives in the places you are not measuring.

Dual sourcing without dual validation. A second source de-risks supply and introduces a second process distribution. Both need qualification; both need capability data; and the tolerance stack that worked with source A may not work with source B.

Complaint data never reaching the supplier. Field failure information is the most valuable process feedback a supplier can receive, and it is routinely withheld — sometimes for commercial reasons, more often because nobody built the loop.

The QMSR Transition Changes the Emphasis

The FDA's Quality Management System Regulation took effect on 2 February 2026, harmonising 21 CFR Part 820 with ISO 13485:2016. For supplier management, the practical effect is a shift in emphasis toward risk-based control and management responsibility. Early post-QMSR inspection data indicates that management oversight and risk management integration have become dominant citation areas, accounting for a substantial share of observations.

For manufacturers already operating a mature ISO 13485 system — which includes most Indian manufacturers, given that ISO 13485 conformance is embedded in the Medical Device Rules, 2017 — the transition is largely one of vocabulary and evidence presentation rather than fundamental redesign. For US-domestic manufacturers who built to QSR alone, it is more substantial.

The Honest Summary

Outsourcing manufacturing is a decision to accept an information deficit in exchange for capital efficiency and speed. That is often the right trade. But the deficit is real, and the only instruments available to close it are supplier qualification, the quality agreement, audit, and the change notification clause.

Companies that treat those four instruments as procurement paperwork discover the deficit during a recall investigation. Companies that treat them as engineering controls generally do not.

RhythmRx manages contract manufacturing for cardiac monitoring devices, including supplier qualification, quality agreement definition, process validation review, and change control across multi-tier supply chains.

PDPriya Deshmukh is Supplier Quality Manager at RhythmRx, working on supplier qualification, quality agreements and multi-tier supply chain oversight for contract-manufactured products.

Sources

1. 1.FDA Inspection Observations datasets, FY2022–FY2025 — 21 CFR Part 820 subsystem citation frequencies.
2. 2.Covington & Burling and Hogan Lovells analyses of FY2025 FDA device warning letters and Form 483 trends.
3. 3.FDA Quality Management System Regulation (QMSR), 21 CFR Part 820 as amended, effective 2 February 2026.
4. 4.21 CFR 820.50 (purchasing controls); ISO 13485:2016 clause 7.4; EU MDR 2017/745 Article 10.
5. 5.ANSI/ASQ Z1.4 sampling procedures and tables for inspection by attributes.
6. 6.Medical Device Rules, 2017 (India), G.S.R. 78(E) — Fifth Schedule quality management system requirements.