Becoming a MedTech Supplier: Requirements and How to Start

For industrial companies in precision engineering, plastics processing, electronics or surface technology, medical technology is an attractive market: stable demand, long product life cycles and high requirements that set good suppliers apart from the competition. At the same time, the business differs significantly from other industries. This article shows what medical device manufacturers expect from their suppliers, why, and how to get started in a structured way.

Why the requirements are so high

Most suppliers do not fall directly under the Medical Device Regulation (MDR). The obligations still reach them, through the manufacturer. Under the MDR, the manufacturer must operate a quality management system and remains responsible for the entire product, including outsourced processes and purchased components. ISO 13485 therefore explicitly regulates how manufacturers select, control and monitor their suppliers.

In addition, under Annex IX of the MDR, the manufacturer's notified body may also audit critical suppliers and subcontractors, including on site during unannounced audits. Anyone manufacturing for the medical device industry should therefore expect visits not only from the customer but also from the customer's notified body.

An important distinction: anyone who places a medical device on the market under their own name is a manufacturer within the meaning of the MDR, with all the associated obligations. This does not apply to classic suppliers and contract manufacturers who work on behalf of, and to the specification of, the manufacturer.

What manufacturers expect from suppliers

A quality management system

An ISO 13485 certificate is not legally required for suppliers. In practice, however, many manufacturers expect one, especially for critical components or outsourced production steps. For less critical parts, an ISO 9001 QMS with additional agreements may be sufficient. What matters is how strongly the supplied part affects the safety and performance of the medical device. ISO 13485 explicitly requires manufacturers to base supplier control on risk.

A quality agreement

ISO 13485 clause 7.4.2 requires suppliers to agree in writing to notify the manufacturer before implementing changes that could affect the ability to meet requirements. For outsourced processes, written quality agreements are mandatory anyway (clause 4.1.5). Typical contents of a quality agreement:

• Specifications, inspection requirements and release criteria
• Change notification: material, raw material supplier, process, machine, site
• Handling of deviations and nonconforming product
• Traceability of batches and materials
• Record retention periods
• Audit rights for the manufacturer and the notified body

Changes only after agreement

Perhaps the biggest cultural difference compared with other industries: a seemingly minor change, such as a new resin supplier, a different cleaning chemistry or a new tool, can mean a new assessment for the manufacturer. For materials in contact with the body, it may affect biocompatibility under ISO 10993; for sterile devices, the validation of packaging and sterilisation. The rule is therefore: notify first, then change.

Validated processes

Processes whose output cannot be fully verified by subsequent inspection must be validated under ISO 13485 clause 7.5.6. Typical examples include injection moulding, welding, bonding, cleaning, coating, sealing of sterile barrier packaging and sterilisation. A three-stage approach is common:

Stage	Content
IQ (Installation Qualification)	Is the equipment correctly installed and documented?
OQ (Operational Qualification)	Does the process deliver reliable results at the limits of the process window?
PQ (Performance Qualification)	Is the process consistently stable under production conditions?

Software that controls production or inspection must also be validated for its intended use.

Traceability and documentation

If a problem occurs, manufacturers must be able to identify affected products quickly. Suppliers should therefore be able to assign batches, materials and process data unambiguously. Under ISO 13485, records must be retained for at least the lifetime of the device as defined by the manufacturer, but not less than two years from release. Many manufacturers contractually require longer periods because the MDR imposes long retention obligations on them.

Cleanroom and cleanliness

For components delivered sterile or with low bioburden, manufacturers often require production or packaging under controlled conditions, for example in a cleanroom according to ISO 14644-1. This includes particle and microbial monitoring, hygiene and gowning rules, and trained personnel.

Getting started in five steps

1. Define target market and products: which components or processes match your capabilities? For which risk classes and customers?
2. Gap analysis: compare your existing QMS with the requirements of ISO 13485 and of typical customers. Risk management, validation, traceability and change control are particularly important.
3. Extend the QMS: build missing processes and, where appropriate, pursue ISO 13485 certification. Our article on ISO 13485 certification describes process and effort.
4. Check infrastructure: are cleanliness, environmental conditions and inspection equipment sufficient? Is a cleanroom needed?
5. Start with a pilot project: a first project with a customer shows how audits, first article inspection, validation and change processes work in practice.

From our own experience in building an ISO 13485 certified MedTech service provider with an ISO class 7 cleanroom, we know that market entry can be planned well, but it takes time for validation and for building trust with customers.

Common mistakes when entering the market

• Underestimating MedTech requirements: documentation and validation effort are often budgeted too low.
• Implementing changes without notification: even small process changes can trigger a reassessment at the manufacturer.
• Treating validation as a one-off: validated processes must be monitored and reassessed when changes occur.
• Neglecting audit readiness: customers and notified bodies do not only visit at project start.
• Putting price before quality: in medical technology, reliability and traceability count for more than the lowest unit price.

Conclusion

Suppliers who understand the logic of medical technology become long-term partners to their customers. A QMS according to ISO 13485, clear quality agreements, validated processes and a consistent change culture are the foundation. Companies that build these foundations are also well prepared for audits by customers and their notified bodies (see preparing for a notified body audit).

We support industrial companies entering medical technology, from gap analysis and QMS setup to the first customer audit. Learn more about our business development and MedTech consulting.