Medical Contract Manufacturing in the United States

Start with the device, regulatory role, and manufacturing route. “Medical experience” is not a transferable capability until the exact facility and responsibilities are verified.

TL;DR

Define whether the supplier will manufacture a component, finished device, accessory, sterile device, package, or labeled product—and who owns specifications, design, validation, release, complaints, reporting, and change authority. Regulatory obligations follow the activity and product, not the supplier's marketing category.

FDA's Quality Management System Regulation became effective February 2, 2026 and incorporates ISO 13485:2016 by reference within 21 CFR Part 820 ^[1]. An ISO 13485 certificate and FDA registration are useful evidence, but neither proves that a facility is approved for your device or capable of your manufacturing route.

Begin With the Regulatory and Commercial Role

“Contract manufacturer” can describe very different work:

• component machining or molding;
• printed circuit assembly;
• cable and harness assembly;
• cleanroom assembly;
• packaging and labeling;
• sterilization;
• test and calibration;
• finished-device manufacturing;
• repair, remanufacture, or service; or
• specification development plus outsourced production.

FDA states that the QMSR applies to manufacturers of finished devices intended for commercial distribution, subject to its applicability and exemptions ^[1]. Component-only suppliers may still have extensive contractual controls, and some products or activities can carry separate regulatory duties. Determine the role with qualified regulatory counsel for the actual device and market.

Responsibility Matrix Before Supplier Search

The quality agreement and supply agreement should agree with the implemented workflow.

Understand QMSR and ISO 13485

FDA explains that the QMSR incorporates ISO 13485:2016 and ISO 9000:2015 Clause 3 by reference, while retaining or adding FDA-specific requirements in Part 820 ^[1]. A buyer should therefore verify compliance with the applicable regulatory system, not assume that a third-party certificate covers every U.S. requirement.

ISO describes ISO 13485:2016 as a quality-management-system standard for organizations involved in medical-device design, production, installation, servicing, and related services ^[2]. ISO also states that it does not perform certification. Verify:

• certificate issuer and accreditation;
• exact legal entity and site;
• scope and exclusions;
• standard edition;
• issue and expiration;
• significant findings and corrective action;
• whether the process and product type are inside the scope; and
• applicable FDA requirements beyond the certificate.

FDA Registration Is Not Approval

FDA's current registration guidance says establishments involved in production and distribution of U.S. medical devices may need annual registration and device listing under 21 CFR Part 807 ^[3]. Its activity table identifies domestic contract manufacturers of finished devices as registering, listing, and paying the establishment fee ^[4].

FDA also makes clear that registration and listing identify facilities and devices; they are not approval or authorization to market a device ^[5]. Check the database, then separately verify:

• establishment identity and address;
• current registration year;
• listed activity;
• relevant device listings;
• inspection and enforcement history where appropriate;
• premarket authorization owned by the responsible entity; and
• actual facility capability.

Map the Complete Manufacturing Route

For the proposed device, identify:

1. incoming material and components;
2. controlled environment requirements;
3. fabrication and assembly;
4. software loading or configuration;
5. special processes;
6. cleaning;
7. in-process and final testing;
8. packaging and labeling;
9. sterilization where applicable;
10. release and distribution; and
11. complaint and returned-product feedback.

At every step, record whether it is internal or outsourced, which facility performs it, how it is validated or qualified, which record returns, and who accepts the result.

Facility-Level Capability Screen

Do not ask for protected customer records. A redacted representative record can demonstrate structure and control.

Questions That Expose Real Readiness

• Show how an approved specification becomes a controlled production instruction.
• Trace one finished unit or lot back through material and critical operations.
• Show a process change that required customer notification or revalidation.
• Explain how electronic production and quality records are protected and corrected.
• Show how nonconforming product is segregated and dispositioned.
• Demonstrate label reconciliation and obsolete-label control where applicable.
• Show how sterilization or other external evidence is reviewed before release.
• Explain what happens when a calibrated instrument is later found out of tolerance.
• Identify the current bottleneck and recovery path for this product family.
• Show how complaint or field information reaches manufacturing controls.

Commercial Fit Still Matters

Regulatory capability does not eliminate ordinary operating questions:

• engineering and transfer resources;
• tooling ownership;
• minimum order and batch size;
• component lead times;
• forecast and inventory model;
• yield assumptions;
• price-break structure;
• scrap and rework responsibility;
• launch timeline;
• change-order economics;
• business continuity; and
• exit and record-transfer obligations.

Select a supplier whose system matches the lifecycle stage. A large finished-device manufacturer may be a poor prototype partner; a highly responsive development shop may lack the validated systems and capacity for commercial production.

Qualification Checklist

• ☐Device classification, intended use, markets, and regulatory owner are known.
• ☐Supplier activity and finished-device/component status are defined.
• ☐QMSR and other applicable requirements are mapped.
• ☐ISO 13485 certificate site and scope are verified where required.
• ☐Registration and listing are checked without treating them as approval.
• ☐The complete internal and external process route is visible.
• ☐Validation, traceability, release, and change controls match the product.
• ☐Quality and supply agreements allocate responsibility consistently.
• ☐Capacity, continuity, tooling, and exit rights are practical.
• ☐A representative record proves the implemented workflow.

Use the U.S. Manufacturing Directory to build a candidate set, then apply the facility-level regulatory and process checks above before treating any profile as qualified.

Related Articles

• Supplier Quality Audit
• Manufacturing Inspection Planning
• Material Traceability