Most device companies depend on suppliers for components, reagents, manufacturing, software libraries or cloud hosting. ISO 13485 holds the manufacturer responsible for everything it buys or outsources (Clauses 4.1.5 and 7.4).
Risk-based supplier control
- Define criteria for evaluating and selecting suppliers based on their ability to meet requirements and the risk of what they supply
- Maintain an approved supplier list with the scope of approval
- Specify purchasing requirements clearly, including quality and regulatory needs
- Verify purchased products through inspection, certificates of analysis or other means proportionate to risk
- Monitor supplier performance and re-evaluate periodically
- Act on supplier problems through CAPA when needed
Quality agreements
For critical suppliers and outsourced processes, a written quality agreement defines who does what: specifications, change notification, testing, records, audits and complaint handling. Notified bodies expect these agreements and may audit critical suppliers directly, including unannounced visits.
Software and cloud suppliers
For software companies, critical suppliers often include cloud and hosting providers, data sources and annotation databases, third-party software components (SOUP) and outsourced development teams. Each needs risk-based evaluation, monitoring of changes and versions, and contingency plans if a service changes or disappears.
Distributors and partners
Distributors are not suppliers to you, but they are part of your quality system. They must handle complaints, traceability, storage and field actions correctly. Clear agreements and training protect both patients and your certification.
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.