Quality Agreements With Critical Suppliers

A quality agreement is not an extended purchase order. It is the operating interface between the manufacturer's quality management system and the supplier's quality management. The more critical the product, the service or the outsourced process, the more precisely responsibilities, change rights, audit and access rights, documentation duties, escalation paths and cost rules have to be defined.

1. Summary

A manufacturer may transfer activities and processes to suppliers or external service providers. What it cannot transfer is overall regulatory responsibility for the conformity of the medical device, the effectiveness of the quality management system or the adequacy of the risk controls. The MDR explicitly requires the quality management system to cover the selection and control of suppliers and subcontractors. Where design, manufacture, final verification, testing or parts of them are carried out by third parties, the manufacturer has to define and demonstrate the type and extent of its control over those parties.

For critical suppliers and outsourced processes, a quality agreement is therefore regularly required. It has to be risk based and supplier specific. A universal standard form with generic audit and information duties is not sufficient where a supplier runs a validated special process, produces documentation with regulatory relevance, develops software, performs testing or influences essential product characteristics.

Guiding principle: Outsourcing may change who performs the work, not who is accountable. The supplier can take over activities; the manufacturer's decision authority and regulatory accountability remain in place.

2. Regulatory starting point

2.1 Manufacturer responsibility and supplier control

Under Article 10(9) MDR, the quality management system has to cover all parts of the manufacturer's organisation that influence the quality of processes and products. This expressly includes the selection and control of suppliers and subcontractors. The MDR does not prescribe a contract labelled "quality agreement", but it does require documented and effective control of externally provided work.

Annex IX MDR makes this concrete: where design, manufacture, final verification, testing or parts of them are carried out by another party, the manufacturer has to describe the type and extent of its controls over that party. A purchase order alone is regularly insufficient where critical activities, specialised processes or regulatory evidence are outsourced.

2.2 Access for the notified body and competent authorities

The notified body may include suppliers or subcontractors in its audit planning. Supplier audits are particularly relevant where the conformity of the finished device is materially influenced by the supplier's activity, or where the manufacturer cannot otherwise demonstrate its control sufficiently. The MDR also provides for periodic and, where appropriate, unannounced audits at suppliers or subcontractors.

Consequence for the agreement: The supplier has to accept contractually that not only the manufacturer, but to the extent required by regulation also its notified body and competent authorities, may be granted access to relevant premises, processes, records, systems and personnel. An agreement that permits audits only "by mutual scheduling" is regularly inadequate for critical suppliers.

2.3 ISO 13485 as the QMS framework

ISO 13485:2016 provides the central QMS framework for medical devices. For quality agreements, the requirements on outsourced processes, risk based supplier control, purchasing information, verification of purchased product, process validation, control of records and handling of nonconforming results are particularly relevant. The agreement translates those requirements into concrete interfaces that bind both parties.

3. A risk based approach: when is an agreement required?

Not every supplier needs a comprehensive quality agreement. The extent of control should be derived from the criticality of the supplied product, the service provided and the outsourced process. Internal labels such as "critical supplier", "high risk supplier" or a company specific supplier class are management instruments of the manufacturer and not in every case regulated terms in their own right.

Recommended internal rule: For all suppliers classified internally as critical or high risk, and for all outsourced processes, an approved quality agreement is required before series production or service start. Deviations have to be justified, approved on a risk basis and limited in time.

4. Minimum content of a robust agreement

• Contracting parties, sites, products, part numbers, services and outsourced processes in scope
• Document hierarchy and precedence rule in case of contradictions between supply contract, quality agreement, specification, drawing, purchase order and test plan
• Roles, responsibilities and approval authority
• Applicable regulatory, normative and customer specific requirements
• Specifications, inspection and release criteria as well as the required quality evidence
• Change management including categorisation, deadlines and consent requirements
• Deviations, concessions, nonconformities, traceability and blocking measures
• Complaints, root cause analyses, CAPA, vigilance and FSCA support
• Audit and access rights of the manufacturer, the notified body and competent authorities
• Cost rules for audits, additional effort, investigations and regulatory support
• Control of critical sub suppliers and flow down of the agreement's obligations
• Documentation, retention, data integrity and release obligations
• Business continuity, emergency management, termination and handover in case of supplier change

Document architecture: The agreement should not repeat every individual technical requirement. A stable main contract with general quality rules plus supplier specific annexes works better, for example scope, responsibility matrix, approved specifications, change matrix, audit and cost matrix as well as contact and escalation paths.

5. Audit rights: scope, cause, notice and costs

5.1 Regulate audit types separately

5.2 What may be audited?

The scope should be limited to the areas relevant to the supplied product, the service or the outsourced process. This may include QMS processes, production and test equipment, validation documentation, qualifications, traceability, sub supplier control, deviations, CAPA, change records and relevant quality records. The supplier may protect legitimate confidentiality interests, but not in a way that makes the evidence required by regulation impossible to produce.

5.3 Costs and effort caps

The MDR does not regulate how manufacturer and supplier allocate the commercial cost of a supplier audit between them. That question therefore belongs expressly in the quality agreement or the supply contract. Unclear cost clauses regularly lead to audit rights being blocked in practice or negotiated only once escalation has already happened.

Important: For audits by the notified body or competent authorities, the agreement must not make prepayment, a purchase order, cost approval, a maximum number of auditors or a maximum audit duration a precondition of access. Commercial questions may be settled afterwards; access required by regulation has to remain possible.

6. Change management: notification is not consent

The wording "the supplier informs the manufacturer of all changes" is too vague. It creates neither a clear review duty nor a reliable prohibition on implementation. An agreement should categorise changes by their possible impact and define, for each category, whether subsequent notification, prior notification or express written consent is required.

Caution: A "formal change" is not automatically a safe low risk category. Changes of company name, legal form, manufacturing site, certificate, ownership structure or critical personnel can be significant in regulatory or quality terms and regularly belong at least in a prior notification or consent category.

6.1 Minimum content of a change notification

• Description and justification of the change
• Affected products, part numbers, processes, sites, sub suppliers and documents
• Planned implementation date and first affected batch or version
• Technical, regulatory and risk related impact assessment
• Assessment of specification, validation status, test methods, biocompatibility, sterility, software, shelf life and traceability, where relevant
• Required verification, validation, samples, comparative data or requalification
• Transition rule, remaining stock, dual sourcing and identification of affected deliveries

7. Responsibilities: what can be outsourced and what stays with the manufacturer?

A quality agreement has to distinguish between performing an activity and holding regulatory responsibility. Many operational activities may be carried out by a supplier. Decision authority, oversight and responsibility for conformity remain with the legal manufacturer.

Not outsourceable in practical terms: The manufacturer may purchase advice, preparation and operational execution. It has to remain able, however, to judge the adequacy of the results, approve decisions, meet regulatory obligations and account for them to the notified body and authorities. An agreement must therefore not create a black box.

8. Specifications, documents and data ownership

8.1 Specification responsibility

The agreement should define which specification describes the binding target state, who prepares it, who reviews it and who approves changes. The manufacturer should control the product and regulatory relevant requirements. The supplier remains responsible for the technical control of its process and for the consistency of its internal working documents with the approved specification.

8.2 Retention and access

• Retention periods have to match the product life cycle and the regulatory deadline; "according to the supplier's internal rules" is not sufficient.
• The manufacturer needs a right to timely release of legible copies, including after end of contract, site closure or insolvency.
• Electronic records have to secure integrity, version, release status, change history and retrievability.
• The supplier must not destroy, migrate or archive regulated original data in an illegible form without consent.
• Confidentiality and IP protection have to be regulated, but must not prevent regulatory access.

9. Nonconformities, complaints, CAPA and field actions

For critical supplies it has to be clearly regulated when the supplier informs the manufacturer and which decisions it may not take on its own. Blanket supplier rights to rework, to substitute material or to use "equivalent" components without prior consent are particularly problematic.

• No use, rework, repair or concession for nonconforming critical goods without documented consent of the manufacturer.
• Duty to identify all potentially affected batches, serial numbers, versions and delivery periods.
• Agreed deadlines for root cause analysis, correction, CAPA plan and evidence of effectiveness.
• Support with authority enquiries, vigilance reports, FSCA, recalls and customer communication.
• Right of the manufacturer to have its own tests performed where the investigation is inadequate, and to pass on reasonable cost under the agreed rule.

10. Sub suppliers and business continuity

10.1 Critical sub suppliers

The direct supplier must not move critical activities into a supply chain that is invisible to the manufacturer. The agreement should therefore define which sub suppliers require prior approval, which changes have to be notified and how audit and access rights are passed on.

• Prior consent for new or changed critical sub suppliers
• Flow down of the relevant quality, change, documentation and audit obligations
• Transparency about manufacturing and test sites as well as outsourced special processes
• Traceability down to the critical sub supplier
• Right of the manufacturer or the notified body to direct or mediated access

10.2 Security of supply and termination

• Emergency and restart planning for critical processes, equipment, IT systems and sites
• Duty to report fire, cyber attack, natural event, loss of certificate, insolvency risk or regulatory action
• Minimum stock, safety stock or agreed last time buy rules, where required
• Handover of tooling, data, validation documentation and quality records at end of contract
• Continued application of confidentiality, retention, complaint and authority support obligations after end of contract

11. A recommended modular model

Instead of writing a completely new agreement for every supplier, a modular approach is advisable. The general main body contains stable ground rules. Supplier specific and product related content is maintained in annexes. This keeps the agreement manageable without diluting critical detail.

12. Typical weaknesses of existing agreements

13. Concrete next steps

• Review the supplier classification and the criteria for critical or high risk suppliers and document them bindingly.
• Compile a list of all critical suppliers and outsourced processes; review existing agreements for coverage and currency.
• Anchor a binding requirement for agreements with critical suppliers and outsourced processes in the purchasing or supplier management process.
• Restructure the standard agreement into a main body and supplier specific annexes.
• Introduce the audit and cost matrix and the risk based change matrix as mandatory annexes.
• Prepare a responsibility matrix for every critical supplier and reconcile it with specification, test plan and risk management.
• Review existing supply contracts for contradictions with audit, cost, liability, IP and termination provisions.
• Review agreements periodically and on cause, in particular on changes of scope, site, certificate, process or sub supplier.

A good agreement is detailed, but not unnecessarily long. Its quality shows in whether it gives an unambiguous answer in a concrete situation: may the supplier change something? Does it have to ask first? Who decides on a deviation? Who pays for a for cause or notified body audit? Which documents have to be available? Who supports a complaint, CAPA or FSCA? Where those questions stay open, the agreement exists formally but does not hold up operationally.

14. Regulatory references

• Regulation (EU) 2017/745 (MDR), in particular Article 10(9) as well as Annex IX, sections 2.2, 2.3, 3.2, 3.3 and 3.4.
• Regulation (EU) 2017/745, Annex VII, section 4.5.2 on audit planning and the possible audit of suppliers and subcontractors.
• European Commission Notice 2021/C 8/01 on the use of supplier and subcontractor audits within the QMS assessment.
• ISO 13485:2016, Medical devices, quality management systems, requirements for regulatory purposes.
• Note on citing standards: the specific clause allocation and wording should be checked against the licensed version of the applicable standards and against the manufacturer's certification and contract model.