Contract Manufacturing in the Medical Device Industry
Contract manufacturing in the medical device industry means shared regulatory responsibility. Here is how to qualify a CMO, structure the quality agreement and manage transfer.
November 4, 20197 min read

Written by Ashok Chintagunta, MS Computer Science, Louisiana Tech University
CTO & Software Engineer, AI and Automation
Published November 4, 2019Updated September 2, 2026
Making medical devices differs from making other products. The paperwork is part of the product itself. A shop might meet your specs perfectly. But it is useless if it cannot make validated processes. It must also provide controlled documents. And it needs traceable records. These records must pass an FDA check or an ISO 13485 audit.
This guide shows what a medical device maker needs. It tells how to check one. It explains what a quality deal should have. It covers how validation and cost work. And it shows where plans often fail. This guide builds on our other help. That guide is about finding a maker for electronic products.

What makes medical device contract manufacturing different
Dimension | General contract manufacturing | Medical device contract manufacturing |
|---|---|---|
Quality system | ISO 9001 typical | ISO 13485 and FDA 21 CFR Part 820 / QMSR expectations |
Process changes | Informal, often verbal | Controlled change orders with impact assessment |
Traceability | Lot level if requested | Full device history record, lot and often serial level |
Validation | First article inspection | IQ, OQ and PQ with documented protocols |
Complaints | Warranty handling | CAPA system feeding complaint and adverse event handling |
Audit exposure | Customer audits | Notified body and regulator inspections |
Legal responsibility does not transfer with the work. The legal manufacturer remains accountable for the device, so supplier controls, monitoring and records are your obligation, not a courtesy the shop performs for you.
How to qualify a medical device contract manufacturer
Check | What to request | Warning sign |
|---|---|---|
Certification | Current ISO 13485 certificate with scope, plus FDA registration | A scope that excludes your device class or process |
Inspection history | Recent audit findings and how they were closed | No findings ever reported, or no closure evidence |
Validation capability | Sample IQ, OQ and PQ protocols from a similar process | Validation described as first article inspection |
Cleanroom and environment | ISO class, monitoring records, gowning procedure | A "clean area" without monitoring data |
Sterilization path | Named partner, method and validation ownership | Unclear who owns sterilization validation |
Document control | How drawings, ECOs and DHRs are released and retained | Drawings exchanged as email attachments |
Supplier controls | How they qualify their own sub-tier suppliers | No approved supplier list |
Ask to see a device history record from a real lot. The five minutes it takes them to find it tells you more than the certificate on the wall.
What belongs in the quality agreement
- Scope split. Exactly which processes, inspections and releases each party owns.
- Change control. No process, material or sub-supplier change without written approval.
- Record retention. Which records are kept, for how long, and how you get copies.
- Nonconformance and CAPA. Notification windows, disposition authority, escalation path.
- Audit rights. Scheduled and for-cause access, including sub-tier suppliers.
- Complaint handling. How field data flows back into manufacturing investigations.
- Exit terms. Ownership of tooling, fixtures, validation data and the right to transfer them.
Validation: IQ, OQ and PQ
Stage | What it proves | Typical duration |
|---|---|---|
IQ - installation qualification | Equipment is installed and configured as specified | 1 to 3 weeks |
OQ - operational qualification | The process works across its intended parameter range | 3 to 8 weeks |
PQ - performance qualification | The process is repeatable at production conditions and volumes | 4 to 12 weeks |
Test method validation | Your inspections measure what they claim, repeatably | 2 to 6 weeks, in parallel |
Validation is a schedule item, not a formality. Plan three to six months between a frozen design and validated production for a moderately complex device, and longer where sterilization or biocompatibility testing is involved.
Cost structure to expect
- NRE and tooling for molds, fixtures and test equipment, usually the largest single line.
- Validation programme covering protocol writing, execution and reporting.
- Unit price, which carries documentation and inspection overhead a general shop does not have.
- Quality overhead for audits, record retention and change control.
- Change cost, where any post-validation change may require partial revalidation.
A regulated part will cost more. Expect its unit price to be 20 to 60 percent higher. This is true for the same part at the same volume. The extra cost is for papers, checks, and tracking. You cannot bargain away this cost.
Where medical device programs go wrong
- Selecting on unit price. The cheapest quote usually excludes validation and documentation entirely.
- Designing before knowing the process. Late process changes trigger revalidation.
- Vague quality agreements. Ambiguity surfaces during an inspection, at the worst moment.
- Single-sourcing critical components. A supplier change on a validated device is a project, not an email.
- Treating the design history file as an afterthought. Reconstructing it later costs far more than maintaining it.
Getting the design right saves money. Do this before it hits a regulated production line. This is the cheapest control you have. Our medical device design and development work builds papers as we design. We do not add them in later.
Design transfer: the step most programs underestimate
Design transfer moves a medical device design to production. It is a formal handover. This is a required part of design controls under 21 CFR 820.30(h).
Programs often fail here. This step turns engineering plans into procedures. It also creates fixtures, trained operators, and inspection records.
None of these things exist until someone writes them. Treat it as its own project phase. Give it a schedule and an owner. Do not see it as a week of emails after the design is final.
Deliverable | Owner | Typical duration | Common failure |
|---|---|---|---|
Device master record assembled | Manufacturer + CM | 2–4 weeks | Drawings not matched to released revision |
Work instructions and travelers | Contract manufacturer | 3–6 weeks | Written by engineering, not by the line that will use them |
Process validation (IQ/OQ/PQ) | CM with client approval | 6–12 weeks | Started before the tooling is final, so it must repeat |
Inspection methods and gauges | Quality | 3–5 weeks | Gauge R&R skipped; measurement noise mistaken for process drift |
Operator training records | CM | 2 weeks | Completed after the first production lot |
First article inspection | Both | 1–2 weeks | Sampled from a tuned run rather than a normal one |
Change control after production starts
Once a device is in production, changes cost money. This is true under a quality system. A change to resin regrind percentage can cost money.
A new connector supplier can cost money. A moved supplier site can cost money. A changed fixture can cost money.
All these may need impact assessment. They may also need re-validation. Sometimes they need a new regulatory submission.
This is a big shock for teams. It hits teams from consumer hardware. There, a running change is a quick decision.
- Classify changes early. Agree with your contract manufacturer what counts as like-for-like versus a validated change before the first one appears.
- Lock critical suppliers by name and part number in the device master record; approved-vendor substitutions are not free.
- Keep a change log the auditor can follow, including the ones you rejected and why.
- Bundle changes into planned revisions rather than trickling them; each revalidation carries fixed cost.
Questions to ask before signing a manufacturing agreement
- What is the scope of your ISO 13485 certificate, and does it cover this device type and these processes?
- Who owns the tooling, fixtures and process documentation if we transfer production elsewhere?
- How many FDA or notified-body inspections have you had, and what were the observations?
- What is your documented process for handling a nonconformance discovered after shipment?
- What lead time and minimum order quantity apply once we are in steady state, and how is price tiered?
- Who writes and approves the validation protocols, and how are deviations resolved?
Get the design right first. Also, get its documents right. Do this before making a regulated product. This is the cheapest way to cut risk. See our product development process. And see our work in medical device design. We show how we manage that hand-off.
Frequently asked questions
What is contract manufacturing in the medical device industry?
This means you pay someone else to make your medical device. Or you pay them to make its parts. This supplier must use a regulated quality system. An example is ISO 13485. The contract maker builds to your plans. They also make the records you need. These include validation and traceability records. The device file needs these.
Does a medical device contract manufacturer need ISO 13485?
Yes, in real life, this is true. Most legal makers need ISO 13485. This certification must cover your work. Notified bodies expect proof of supplier checks. You can use a shop without it. But you will need much more oversight. You will also need much more proof.
Who is responsible if a contract manufacturer makes a defective device?
The legal manufacturer whose name is on the device remains responsible to regulators. Contractual remedies may recover cost from the supplier, but supplier qualification, monitoring and CAPA oversight remain the legal manufacturer's obligation.
How long does it take to qualify a medical device manufacturing process?
A mid-level device takes three to six months to make. This is from a frozen design to full production. It includes IQ, OQ, PQ, and test method checks. Sterilization, biocompatibility, or software checks can make this much longer.
How much more expensive is regulated manufacturing?
Unit prices typically run 20 to 60 percent higher than equivalent non-regulated parts, plus a validation programme and higher tooling and fixture cost. The premium buys documentation, inspection and traceability that the device file legally requires.
Planning a regulated build?
Talk to our teamFrom the archive: Tech Talk Episode 07
Supplier audits: what a real qualification audit covers
A quality agreement is only as good as the audit that preceded it. A first-article paper review is not an audit. Plan a two-day on-site with a lead auditor and a process engineer, and walk the actual line your device will run on rather than the demo cell near reception.
The findings that matter are rarely dramatic: an out-of-calibration torque driver, a training record without a signature, a nonconformance log with open items older than ninety days. Those are the leading indicators of the deviation that will eventually hold your lot.
Audit area | Evidence to request | Common finding |
|---|---|---|
Document control | Current DHF/DMR index, revision history | Obsolete work instructions still at the bench |
Training records | Signed competency records for the operators on your line | Records exist but are not tied to the current revision |
Calibration | Calibration schedule and out-of-tolerance procedure | No documented impact assessment for OOT equipment |
CAPA | Open CAPA list with age and effectiveness checks | CAPAs closed without effectiveness verification |
Supplier controls | Their approved supplier list and re-evaluation cadence | Sub-tier suppliers never re-evaluated |
Environmental monitoring | Cleanroom particle and viable trend data | Trending exists but excursions lack investigation |
Sterilization / EO residuals | Validation reports and residual testing | Validation from a different load configuration |
UDI, labeling and the traceability chain
Unique Device Identification looks like a labeling problem. But it is really a manufacturing problem. The device ID is set for each model.
Yet, the production ID changes. This includes lot, serial, expiration, and date of manufacture. You must make this ID on the production line.
You must check its barcode grade. You must match it to the device history record. Do this for every single unit.
Decide who handles GUDID submission. Decide who checks barcodes against ISO/IEC 15415 grade C or better. Also, decide what happens if a printer fails mid-lot. If you get this wrong, your device meets specs. But you cannot sell it.
- Specify barcode grade in the quality agreement, including verifier model and sampling plan.
- Define the label reconciliation procedure so unused labels are destroyed and counted.
- Map lot genealogy end to end from resin lot and component lot to finished device serial.
- Rehearse a mock recall annually; four hours to identify affected lots is the working benchmark.
Exit terms: tooling, technology transfer and the second source
The most costly part of a contract is often left unsaid. This is what happens when you stop working together. Get it in writing that you own the tooling.
Make sure you can take it back by a set date. Also confirm that checked process settings will transfer. And that inspection tools will move with it.
The maker must also help with the transfer. This is for a set time at agreed rates. Without these terms, your device has only one maker.
This is true even after eighteen months of checks. Every price hike after that is a fight you cannot win.
Work with LA NPDT: Do you want to move from idea to product? Start with our CAD engineering services. Or talk to us about design improvement.
Filed under:Tech Talk Podcast
Tagged:InnovationInventionLatestNewsRoboticsTechTech NewsTechnology NewsUniversityUpdatesWireless
Related articles
All articles
Contract Manufacturing for Medical Devices: How to Choose and What It Costs
What contract manufacturing for medical devices actually involves, from technology transfer and process validation to QMS obligations, costs and partner qualification.
FDA QMSR 2026: What Medical Device Founders Should Change Before the Next Prototype
For founders and product teams building Class I/II hardware: what actually changed when FDA's QMSR replaced the old QS framework, and how to keep early prototypes from becoming regulatory debt.

Medical Device Design Companies: Who Fits Which Device Class
Which medical device design companies fit Class I, Class II and Class III programs, what design controls and ISO 13485 actually cost, and when a general product firm is the wrong call.
Services related to this guide
- Product design servicesIndustrial design and CAD taken all the way to manufacturable files.
- Rapid prototypingWorking prototypes in days, from 3D printing to vacuum casting.
- Electronic design servicesSchematic, PCB layout, firmware and bring-up, through to production handoff.
- Product development examplesReal projects we designed, prototyped and shipped.
