ISO 13485 Registration for Medical Device Companies that Outsource Manufacturing

It is quite common for medical device companies to design, package and sell a medical device, but outsource the manufacturing to another company. Often that company is located in another country. Clients often ask us whether they still need to implement ISO 13485 when the OEM has ISO 13485 themselves. The short answer is YES.

Why you need ISO 13485:2003 registration if you outsource manufacturing.

Ministries of Health in all countries consider the company whose name appears on a medical device to be responsible for its safety and efficacy, regardless of who manufactures it. Even if your outsource manufacturer has ISO 13485:2003 registration, you still need to implement it for your company as well, and it does not makes it any easier or less costly to accomplish. Why? Much of ISO 13485 has to do with controlling processes such as design, manufacturing, storage, distribution, monitoring and so forth. Therefore, it does not matter WHO is doing the manufacturing of your product. Procedures still need to be written and followed that demonstrate you have complete control over the Original Equipment Manufacturer (OEM), even if that OEM already has ISO 13485 registration. For instance, you need to have procedures for:

• How you communicate design changes to the manufacturer.
• How the OEM communicates changes in the production process to you.
• Which production changes require notification and which do not.
• Guidelines for non-conforming products.
• And much more.

Remember, if there is a problem with your product in the marketplace, a Ministry of Health is not going to hold the OEM responsible, they will hold YOU responsible. You can outsource manufacturing but you cannot outsource compliance with national regulations!