Choosing a Medical Contract Manufacturer: ISO 13485, Cleanrooms, and Design Record Support

01. Who the manufacturer is, legally

Before approaching anyone, understand that "manufacturer" means something specific in this sector, and it may not mean the party doing the manufacturing.

The organization that places a device on the market under its own name carries the regulatory obligations attached to it: the quality system, the design and production records, the post-market responsibilities, and the accountability if something goes wrong. A contract manufacturer building that device to your specification is a supplier operating under your control. Selecting, qualifying, monitoring, and controlling the changes they make are your obligations, not favors you do for good practice.

Two practical consequences follow, and buyers underestimate both.

First, you cannot delegate an obligation by choosing a well-certified supplier. A contract manufacturer with an impeccable quality system does not make their customer compliant. It makes them a supplier that is easier to control, which is worth a great deal, but it's not the same thing.

Second, supplier control costs work. Qualifying a manufacturer, auditing them, reviewing change notifications, and monitoring performance takes time from people with other jobs. If your organization does not have that capacity, that is a resourcing decision to make before you outsource, not after your first supplier audit finding.

The registration question

Establish early where the manufacturer is registered and with which authorities, and whether they hold any establishment registration or listing obligations of their own in the markets you serve. This varies by jurisdiction and by what the manufacturer does, and the answer affects whether they can legally perform the operations you need for the markets you sell into. Confirm it with your regulatory function rather than taking it from a sales conversation.

02. How this category is segmented

Section 01 establishes that responsibility stays with you. This section covers which manufacturers are even candidates, because medical device contract manufacturing isn't one population of certified shops that differ only on price. It is several largely non-overlapping businesses, and a buyer of a sterile disposable and a buyer of a benchtop analyzer share almost no suppliers. Five things divide the market.

By device technology

This is the hardest division and the least visible from a certificate. Manufacturers specialize by what they physically make, and equipment, validated processes, and engineering experience do not transfer between categories.

• Electromechanical devices and instruments, built around circuit assemblies, enclosures, and software. These manufacturers look much like industrial electronics manufacturers with a medical quality system on top.
• Injection molded disposables and single-use devices, where the competence is in molding, tooling, and high-volume assembly.
• Catheters and interventional devices, which involve extrusion, tipping, braiding, and bonding processes that exist almost nowhere else.
• Orthopedic and implantable devices, dominated by precision machining, surface treatment, and material traceability.
• Diagnostics and laboratory instruments, which combine instrument build with fluidics, optics, and consumables.
• Combination products and drug delivery devices, which bring pharmaceutical manufacturing requirements alongside device ones and narrow the field sharply.

Establish which of these describes your device before shortlisting, and ask a manufacturer what they currently build in that category rather than what they can build.

By device risk class

Your device's classification determines what the manufacturer has to do, not just what you have to file. The design and development requirements described in section 04 apply to higher-class devices and to a defined subset of the lowest class, so a manufacturer's experience with your class matters. A shop building low-risk devices has not necessarily operated under the design controls your device requires. Ask what classes they currently build and for which markets.

By market and regulatory regime

Where you sell determines which regulators the manufacturer has to satisfy, and the schemes do not overlap as neatly as buyers assume.

• The Medical Device Single Audit Program, known as MDSAP, allows a single audit by a recognized auditing organization to satisfy the requirements of several regulators at once. Five regulatory authorities participate: the United States FDA, Health Canada, Australia's Therapeutic Goods Administration, Brazil's ANVISA and Japan's health authority. FDA accepts MDSAP audit reports in place of routine inspections, though not for-cause or compliance follow-up inspections, and not inspections associated with premarket approval.
• The European Union is not an MDSAP participant. Selling into the EU requires a separate conformity assessment through a Notified Body under the EU Medical Device Regulation, or under the In Vitro Diagnostic Regulation for diagnostics. That is a distinct process, and the gating question is whether the Notified Body's scope covers your device type. An impeccable MDSAP certificate does not, by itself, clear a manufacturer for Europe.

Establish your markets first, then ask which schemes and certifications the manufacturer holds and for which sites.

By scope of engagement

What a manufacturer will take on varies, and it changes the record ownership question in section 04 as well as the commercial one.

• Contract manufacture, where you own the design and they build to it. Most design records stay with you.
• Contract design and manufacture, where they contribute to or own part of the development. The boundary on design records must be drawn explicitly, and it often isn't.
• Full development including regulatory support, where the manufacturer participates in the submission. This is a deeper relationship with a correspondingly harder exit.
• Specification developer arrangements, where you specify and market a device built substantially to the manufacturer's existing design. This has particular consequences for who holds what, and you should enter knowingly.

By sterilization pathway

For any sterile device, this is among the most consequential filters, and it is rarely asked early. Some manufacturers sterilize in-house; most ship to a specialist sterilization contractor. Either is normal. What matters is which method your device requires, whether the manufacturer has an established route, what that does to lead time, and who validates and monitors the process. Ethylene oxide, gamma irradiation, electron beam, and steam are all commonly used, and they are not interchangeable: the method must suit the materials, the packaging, and the device, and changing it later is a validation exercise rather than a purchasing decision.

Where you land

Work through the five in that order. Device technology eliminates most of the market; risk class and regulatory regime narrow what remains; scope and sterilization settle the rest. What survives is a shortlist worth the conversation this guide describes.

03. Design and production records, and what changed this year

This section addresses a change that took effect during 2026 and that buyers and manufacturers are still absorbing, so it is worth being precise about what happened and what did not.

What changed

The United States device quality system regulation, at 21 CFR Part 820, was amended to incorporate ISO 13485:2016 by reference. The amended regulation is titled the Quality Management System Regulation, and it became effective on 2 February 2026, replacing the previous Quality System Regulation framework. The stated purpose was to harmonize the FDA's requirements with those used by other regulatory authorities. The FDA also updated the inspection program its investigators use for device manufacturers.

Alongside the incorporation, several long-familiar record names no longer appear as defined terms in the regulation. The design history file, the device master record, and the device history record are no longer defined regulatory record types. Instead, the international standard's framework applies, with its medical device file and design and development records.

Because the older names persist and the newer ones are unfamiliar, it is worth being clear about what each held.

• The design history file held the records demonstrating that a device was developed according to an approved design plan and the applicable requirements.
• The device master record held the specifications and procedures defining how the device is made: drawings, formulations, production methods, quality assurance procedures, and packaging.
• The device history record contained evidence that a specific batch or unit was made in accordance with that master record.
• Under the international standard, the medical device file serves a comparable purpose to the master record and contains the documents that define the device and its manufacture. In contrast, design and development records serve the purpose of the design history file.

The names have changed, and the distinction has not: one set of records describes how the device was designed, one describes how it is to be made, and one proves how a particular unit was made.

What did not change

The obligation. Design and development records still must be created, controlled, and retained, and they must demonstrate that the device was developed under a controlled process and that the design meets its requirements. Production records must still demonstrate that each device was made as specified. The requirement moved and was renamed; it did not disappear.

The design and development requirements of the international standard apply to Class II and Class III devices, to Class I devices automated with computer software, and to a specific list of Class I device types identified in the regulation. Whether your device falls inside that scope is a question for your regulatory function.

What this means when you are choosing a manufacturer

Three things, and they are all practical.

First, expect the older terminology to persist in conversation for some time. A contract manufacturer offering design history file support is describing a real service using a name that is no longer a defined regulatory term. That is not a red flag on its own. It becomes one if they are unaware the framework changed, so ask how they addressed the transition, because the answer distinguishes a manufacturer whose quality system is maintained from one whose documentation was written years ago.

Second, establish what design and development records the manufacturer will hold and what you will hold. On a device you designed and they build, most design records are yours. On a device they helped develop, the boundary is less obvious, and it needs drawing. Whichever applies, you need access to the records supporting your device, in a form you can produce to a regulator, for as long as retention requirements demand.

Third, establish what happens to those records if the relationship ends. A manufacturer holding records that support your regulatory file is holding something you may need after you stop buying from them. The agreement for retrieving it belongs in the agreement, not in a future negotiation.

04. Cleanrooms and controlled environments

Cleanroom claims are made loosely and mean something specific, so the questions here are worth asking plainly.

A cleanroom classification describes a measured airborne particle concentration, not a construction type. The classification comes from measurement against a defined standard, which means a room is classified because it was tested and found to meet a class, and it stays classified only as long as it continues to meet the standard. Ask which class the room is classified to, against which standard, when it was last qualified, and how often requalification is performed.

Ask also which occupancy state the classification refers to. A room performs differently when empty, with equipment running but nobody present, and when fully operational with people working in it. These are distinct states, and a classification quoted without stating which state it was measured in does not answer the question. The state that matters to you is the one your device will actually be built in.

Beyond the classification, establish the controls that keep it: gowning procedures and how they are enforced, environmental monitoring for particles and, where relevant, for microbial contamination, pressure differentials between the cleanroom and adjacent areas, material transfer arrangements, cleaning and disinfection regimes, and the training and requalification of the people working inside. A classified room operated casually does not perform to its class, and that is not visible on a certificate.

Finally, be clear about whether your device actually needs a cleanroom and at which stage. Some devices require controlled environment manufacture throughout, some only for specific operations, and some not at all. Specifying a controlled environment your device does not need adds cost to every unit for the life of the program, and specifying one that is cleaner than required does the same.

05. Process validation

Process validation is where most of the engineering effort in a medical program goes, and it is where a contract manufacturer's competence shows most clearly.

The principle is that when a process output cannot be fully verified by subsequent inspection and test, the process itself must be validated: demonstrated to produce a result that meets predetermined specifications consistently. Many processes in device manufacture fall into that category, including sterilization, sealing, welding, molding, bonding, and cleaning, because fully verifying them would destroy the product.

A conventional validation approach establishes that the equipment is installed correctly and functions as intended, that the process produces acceptable output across its operating range, including at the edges, and that it does so consistently in normal production over multiple runs. Manufacturers refer to those three stages as installation qualification, operational qualification, and performance qualification, abbreviated IQ, OQ, and PQ, and you will hear the abbreviations on every call. The specifics vary by process and by device, and the approach should be justified rather than applied by rote.

What to establish before selecting

Who writes the validation protocols, who executes them, who reviews the data, and who approves the result. All four can sit with either party or be split, and the split should be explicit. A manufacturer who expects you to write protocols for their equipment is telling you something about their capability, and so is one who expects to approve validations for your device without your involvement.

Then establish how validated processes are maintained. A validation is a point in time. What triggers revalidation, how process monitoring detects drift, and what happens when a validated parameter moves outside its range determine whether the validation still means anything in year three.

Ask specifically about the processes your device needs. A manufacturer with extensive validation experience in one process family may have none in another, and the gap will surface during your program rather than before it.

06. The quality agreement

This document decides everything discussed above, and it is remarkable how often it is treated as a formality signed after the commercial terms.

A quality agreement records the division of responsibility between the party placing the device on the market and the contract manufacturer. It is separate from the supply agreement; quality, not procurement, owns it, and regulators will ask to see it when they want to know who was responsible for what.

At minimum, it should settle the following, each of which is a real decision rather than boilerplate:

• Which party performs and which approves each activity: incoming inspection, in-process control, final inspection, batch release, and disposition of nonconforming product. Who may release product for shipment and against what criteria.
• How deviations and nonconformances are handled: who is notified, within what period, who investigates, who approves the disposition, and what happens to affected stock.
• How complaints and field issues flow. A complaint about your device may reach the manufacturer first, and the route by which it reaches you, and how quickly, is a regulatory matter rather than a courtesy.
• Change control, covered in section 07, including what requires your approval before it happens.
• Records: which party holds what, retention periods, and your right of access both during the relationship and after it ends.
• Audit rights: whether you may audit, on what notice, how often, and whether you may audit their subcontractors.
• Subcontracting: whether the manufacturer may subcontract any part of your device's manufacture, whether your approval is required, and how their subcontractors are controlled.
• Termination: what happens to your tooling, your materials, your records and any work in progress, and what transition support is provided.

07. Change control and notification

Uncontrolled change is the most common way a compliant supplier relationship becomes noncompliant, and it usually happens through ordinary business decisions rather than negligence.

A manufacturer improving a process, moving a line, changing a supplier, or switching a material is doing what competent manufacturers do. On a medical device, any of those may affect validation status, may require revalidation, and may in some cases affect your regulatory filing. The question is not whether change happens but whether you find out before it does.

Establish explicitly what the manufacturer must notify you of and what requires your written approval before implementation. A workable list covers materials and component suppliers; process parameters within and outside validated ranges; equipment; tooling; the manufacturing location; subcontractors; test methods; software used in production; and cleanroom classification or environmental controls.

Then establish the notification period, and make it long enough to be useful. Notice given after a change is implemented is information, not control.

Finally, agree what happens to product made during a change and to stock already in the field if a change turns out to have been consequential. That is an unpleasant conversation to have in the abstract and a much worse one to have for the first time under pressure.

08. Audits, inspections and what happens when a regulator arrives

Two distinct things are worth separating here, because buyers frequently conflate them.

Your audit of the manufacturer is part of your supplier control obligation. Establish before selection whether you will audit, how often, whether you have the competence in-house or need to engage someone, and what access the agreement gives you. Ask what other customers audit them and how they handle it, because a manufacturer accustomed to customer audits will be easier to work with than one for whom your audit is a novelty.

A regulatory inspection of the manufacturer is a different matter, and one you should care about. Ask whether the site has been inspected, by which authorities, when, and what the outcome was. Ask what findings were raised and what was done about them. A manufacturer who discusses this openly, including findings they have closed, is showing you a functioning quality system. One who claims they've never had a finding is either very small, very lucky, or not answering.

Then establish what happens if a regulator inspects them while your device is in production, and specifically whether and how quickly you would be told if a finding touched your product or the processes that make it. That should be in the quality agreement, and often it isn't.

Assessing capability beyond the paperwork

Certification and audit history describe the system. Two further questions describe whether they can build your device specifically.

Ask what devices of similar type, class, and process they currently manufacture, and for how long. Experience with a device like yours matters more than general medical experience, because failure modes and validation approaches transfer.

Ask what they would want to change about your design or specification. A manufacturer who reviews your documentation and comes back with specific manufacturability observations has engaged with your product. One who accepts it without comment has quoted it.

09. What good and poor answers sound like

The distinctions below are audible early, and they are more informative than a certificate.

On responsibility

Good: States clearly which activities they perform and which remain yours, and raises the quality agreement before you do.

Poor: Describes themselves as fully compliant in a way that implies your obligations are covered by their certification.

On certification

Good: Provides the certificate, points out what its scope covers and what it does not, and volunteers which site would build your device.

Poor: Confirms they are certified without offering the scope, or is vague about which facility is covered.

On the regulatory change

Good: Can describe how they addressed the transition to the amended framework and what they changed in their documentation.

Poor: Uses the superseded record names without awareness that the terminology changed, or has not revisited their procedures.

On cleanrooms

Good: States the class, the standard, the occupancy state it was measured in, and the requalification interval without being pressed.

Poor: Describes a room as a cleanroom, or quotes a class without saying which state it applies to.

On validation

Good: Asks which processes on your device cannot be fully verified by inspection, and proposes a split of protocol authorship, execution, and approval.

Poor: Treats validation as paperwork to be completed after the process is running.

On change

Good: Proposes a notification list and an approval threshold, and can describe a change they notified a customer about recently.

Poor: Says they would tell you about anything significant, without defining significant.