Contract Manufacturing in the Medical Device Industry

Contract manufacturing in the medical device industry means shared regulatory responsibility. Here is how to qualify a CMO, structure the quality agreement and manage transfer.

November 4, 20197 min read

Ashok Chintagunta

Written by Ashok Chintagunta, MS Computer Science, Louisiana Tech University

CTO & Software Engineer, AI and Automation

Published November 4, 2019Updated September 2, 2026

Making medical devices differs from making other products. The paperwork is part of the product itself. A shop might meet your specs perfectly. But it is useless if it cannot make validated processes. It must also provide controlled documents. And it needs traceable records. These records must pass an FDA check or an ISO 13485 audit.

This guide shows what a medical device maker needs. It tells how to check one. It explains what a quality deal should have. It covers how validation and cost work. And it shows where plans often fail. This guide builds on our other help. That guide is about finding a maker for electronic products.

Four-stage diagram of medical device contract manufacturing: design history file, ISO 13485 supplier audit, IQ OQ PQ process validation, and production with CAPA
In regulated manufacturing, every stage produces evidence as well as parts.
Choosing a manufacturing partner and location, including regulated production.
Video page ↗

What makes medical device contract manufacturing different

Dimension
General contract manufacturing
Medical device contract manufacturing
Quality system
ISO 9001 typical
ISO 13485 and FDA 21 CFR Part 820 / QMSR expectations
Process changes
Informal, often verbal
Controlled change orders with impact assessment
Traceability
Lot level if requested
Full device history record, lot and often serial level
Validation
First article inspection
IQ, OQ and PQ with documented protocols
Complaints
Warranty handling
CAPA system feeding complaint and adverse event handling
Audit exposure
Customer audits
Notified body and regulator inspections

Legal responsibility does not transfer with the work. The legal manufacturer remains accountable for the device, so supplier controls, monitoring and records are your obligation, not a courtesy the shop performs for you.

How to qualify a medical device contract manufacturer

Check
What to request
Warning sign
Certification
Current ISO 13485 certificate with scope, plus FDA registration
A scope that excludes your device class or process
Inspection history
Recent audit findings and how they were closed
No findings ever reported, or no closure evidence
Validation capability
Sample IQ, OQ and PQ protocols from a similar process
Validation described as first article inspection
Cleanroom and environment
ISO class, monitoring records, gowning procedure
A "clean area" without monitoring data
Sterilization path
Named partner, method and validation ownership
Unclear who owns sterilization validation
Document control
How drawings, ECOs and DHRs are released and retained
Drawings exchanged as email attachments
Supplier controls
How they qualify their own sub-tier suppliers
No approved supplier list
Ask to see a device history record from a real lot. The five minutes it takes them to find it tells you more than the certificate on the wall.

What belongs in the quality agreement

  • Scope split. Exactly which processes, inspections and releases each party owns.
  • Change control. No process, material or sub-supplier change without written approval.
  • Record retention. Which records are kept, for how long, and how you get copies.
  • Nonconformance and CAPA. Notification windows, disposition authority, escalation path.
  • Audit rights. Scheduled and for-cause access, including sub-tier suppliers.
  • Complaint handling. How field data flows back into manufacturing investigations.
  • Exit terms. Ownership of tooling, fixtures, validation data and the right to transfer them.

Validation: IQ, OQ and PQ

Stage
What it proves
Typical duration
IQ - installation qualification
Equipment is installed and configured as specified
1 to 3 weeks
OQ - operational qualification
The process works across its intended parameter range
3 to 8 weeks
PQ - performance qualification
The process is repeatable at production conditions and volumes
4 to 12 weeks
Test method validation
Your inspections measure what they claim, repeatably
2 to 6 weeks, in parallel

Validation is a schedule item, not a formality. Plan three to six months between a frozen design and validated production for a moderately complex device, and longer where sterilization or biocompatibility testing is involved.

Cost structure to expect

  • NRE and tooling for molds, fixtures and test equipment, usually the largest single line.
  • Validation programme covering protocol writing, execution and reporting.
  • Unit price, which carries documentation and inspection overhead a general shop does not have.
  • Quality overhead for audits, record retention and change control.
  • Change cost, where any post-validation change may require partial revalidation.

A regulated part will cost more. Expect its unit price to be 20 to 60 percent higher. This is true for the same part at the same volume. The extra cost is for papers, checks, and tracking. You cannot bargain away this cost.

Where medical device programs go wrong

  • Selecting on unit price. The cheapest quote usually excludes validation and documentation entirely.
  • Designing before knowing the process. Late process changes trigger revalidation.
  • Vague quality agreements. Ambiguity surfaces during an inspection, at the worst moment.
  • Single-sourcing critical components. A supplier change on a validated device is a project, not an email.
  • Treating the design history file as an afterthought. Reconstructing it later costs far more than maintaining it.

Getting the design right saves money. Do this before it hits a regulated production line. This is the cheapest control you have. Our medical device design and development work builds papers as we design. We do not add them in later.

Design transfer: the step most programs underestimate

Design transfer moves a medical device design to production. It is a formal handover. This is a required part of design controls under 21 CFR 820.30(h).

Programs often fail here. This step turns engineering plans into procedures. It also creates fixtures, trained operators, and inspection records.

None of these things exist until someone writes them. Treat it as its own project phase. Give it a schedule and an owner. Do not see it as a week of emails after the design is final.

Deliverable
Owner
Typical duration
Common failure
Device master record assembled
Manufacturer + CM
2–4 weeks
Drawings not matched to released revision
Work instructions and travelers
Contract manufacturer
3–6 weeks
Written by engineering, not by the line that will use them
Process validation (IQ/OQ/PQ)
CM with client approval
6–12 weeks
Started before the tooling is final, so it must repeat
Inspection methods and gauges
Quality
3–5 weeks
Gauge R&R skipped; measurement noise mistaken for process drift
Operator training records
CM
2 weeks
Completed after the first production lot
First article inspection
Both
1–2 weeks
Sampled from a tuned run rather than a normal one

Change control after production starts

Once a device is in production, changes cost money. This is true under a quality system. A change to resin regrind percentage can cost money.

A new connector supplier can cost money. A moved supplier site can cost money. A changed fixture can cost money.

All these may need impact assessment. They may also need re-validation. Sometimes they need a new regulatory submission.

This is a big shock for teams. It hits teams from consumer hardware. There, a running change is a quick decision.

  • Classify changes early. Agree with your contract manufacturer what counts as like-for-like versus a validated change before the first one appears.
  • Lock critical suppliers by name and part number in the device master record; approved-vendor substitutions are not free.
  • Keep a change log the auditor can follow, including the ones you rejected and why.
  • Bundle changes into planned revisions rather than trickling them; each revalidation carries fixed cost.

Questions to ask before signing a manufacturing agreement

  • What is the scope of your ISO 13485 certificate, and does it cover this device type and these processes?
  • Who owns the tooling, fixtures and process documentation if we transfer production elsewhere?
  • How many FDA or notified-body inspections have you had, and what were the observations?
  • What is your documented process for handling a nonconformance discovered after shipment?
  • What lead time and minimum order quantity apply once we are in steady state, and how is price tiered?
  • Who writes and approves the validation protocols, and how are deviations resolved?

Get the design right first. Also, get its documents right. Do this before making a regulated product. This is the cheapest way to cut risk. See our product development process. And see our work in medical device design. We show how we manage that hand-off.

Frequently asked questions

What is contract manufacturing in the medical device industry?

This means you pay someone else to make your medical device. Or you pay them to make its parts. This supplier must use a regulated quality system. An example is ISO 13485. The contract maker builds to your plans. They also make the records you need. These include validation and traceability records. The device file needs these.

Does a medical device contract manufacturer need ISO 13485?

Yes, in real life, this is true. Most legal makers need ISO 13485. This certification must cover your work. Notified bodies expect proof of supplier checks. You can use a shop without it. But you will need much more oversight. You will also need much more proof.

Who is responsible if a contract manufacturer makes a defective device?

The legal manufacturer whose name is on the device remains responsible to regulators. Contractual remedies may recover cost from the supplier, but supplier qualification, monitoring and CAPA oversight remain the legal manufacturer's obligation.

How long does it take to qualify a medical device manufacturing process?

A mid-level device takes three to six months to make. This is from a frozen design to full production. It includes IQ, OQ, PQ, and test method checks. Sterilization, biocompatibility, or software checks can make this much longer.

How much more expensive is regulated manufacturing?

Unit prices typically run 20 to 60 percent higher than equivalent non-regulated parts, plus a validation programme and higher tooling and fixture cost. The premium buys documentation, inspection and traceability that the device file legally requires.

Planning a regulated build?

Talk to our team

From the archive: Tech Talk Episode 07

Supplier audits: what a real qualification audit covers

A quality agreement is only as good as the audit that preceded it. A first-article paper review is not an audit. Plan a two-day on-site with a lead auditor and a process engineer, and walk the actual line your device will run on rather than the demo cell near reception.

The findings that matter are rarely dramatic: an out-of-calibration torque driver, a training record without a signature, a nonconformance log with open items older than ninety days. Those are the leading indicators of the deviation that will eventually hold your lot.

Audit area
Evidence to request
Common finding
Document control
Current DHF/DMR index, revision history
Obsolete work instructions still at the bench
Training records
Signed competency records for the operators on your line
Records exist but are not tied to the current revision
Calibration
Calibration schedule and out-of-tolerance procedure
No documented impact assessment for OOT equipment
CAPA
Open CAPA list with age and effectiveness checks
CAPAs closed without effectiveness verification
Supplier controls
Their approved supplier list and re-evaluation cadence
Sub-tier suppliers never re-evaluated
Environmental monitoring
Cleanroom particle and viable trend data
Trending exists but excursions lack investigation
Sterilization / EO residuals
Validation reports and residual testing
Validation from a different load configuration

UDI, labeling and the traceability chain

Unique Device Identification looks like a labeling problem. But it is really a manufacturing problem. The device ID is set for each model.

Yet, the production ID changes. This includes lot, serial, expiration, and date of manufacture. You must make this ID on the production line.

You must check its barcode grade. You must match it to the device history record. Do this for every single unit.

Decide who handles GUDID submission. Decide who checks barcodes against ISO/IEC 15415 grade C or better. Also, decide what happens if a printer fails mid-lot. If you get this wrong, your device meets specs. But you cannot sell it.

  • Specify barcode grade in the quality agreement, including verifier model and sampling plan.
  • Define the label reconciliation procedure so unused labels are destroyed and counted.
  • Map lot genealogy end to end from resin lot and component lot to finished device serial.
  • Rehearse a mock recall annually; four hours to identify affected lots is the working benchmark.

Exit terms: tooling, technology transfer and the second source

The most costly part of a contract is often left unsaid. This is what happens when you stop working together. Get it in writing that you own the tooling.

Make sure you can take it back by a set date. Also confirm that checked process settings will transfer. And that inspection tools will move with it.

The maker must also help with the transfer. This is for a set time at agreed rates. Without these terms, your device has only one maker.

This is true even after eighteen months of checks. Every price hike after that is a fight you cannot win.

Work with LA NPDT: Do you want to move from idea to product? Start with our CAD engineering services. Or talk to us about design improvement.

Related articles

All articles

Get in touch

Tell us what this is about

Share a few details about your question, partnership, or idea — a member of the LA NPDT team will reply within one business day.

Optional context

What are you looking to accomplish? (optional)

What do you already have? (optional — tick any)

Your information stays confidential and is never shared.