Because so many novel medical devices are, by their nature, quite unique, and because safety is foremost, when a component supplier must be ISO 13485 certified depends on the specific component and what it does. If a component fails is it an annoyance or does it pose real risk? Is a particular component’s material entering a sterile environment, or even more acutely, the patient’s anatomy (like a screw or complete implant)? For what components will a supplier with ISO 9001 certification suffice? What else should a medical device manufacturer consider when evaluating component or material suppliers?
We’ll endeavor to answer those questions and provide some additional insights here.
It’s All About Risk Mitigation, Vendor Vetting and Validation
“When a new medical device earns FDA approval and hits the market in the United States, the manufacturer of record enters the queue for an FDA audit,” GCMI’s Rebecca Stonecipher says. “One day they will be asked by an auditor how and why your supplier is appropriate for what they’re providing.
“In addition to defending your device and quality management systems, if a device fails, you will need to know why. If the failure is attributable to a component supplier issue, you will need to defend how you vetted them. For example, how do you know a sterilization vendor is doing their job properly? How do you know a provider of Bluetooth chips or screws for a surgical implant is making the product to the right specifications? How does your supplier know where the raw materials from which they made the component originated?
“When it comes to componentry or service providers for medical device manufacturers, the point is to confirm that they have the appropriate controls in place, then demonstrate the appropriate qualification of any component supplier. Manufacturers of record are expected to show controls for suppliers and how you manage that.”
For which components is ISO-13485 certification required as a component supplier qualification?
The short answer: it depends. “If a component failure is an annoyance, ISO 9001 certification may suffice,” Rebecca says. “But if the component failure means catastrophic failure resulting in injury or death (especially including sterilization), then using only ISO 13485 certified suppliers should be considered mandatory.
“Hypodermic needles ‘off the shelf’ should only come from ISO 13485 certified suppliers as should any sterilization services or packaging services for sterilized devices especially when the packaging is in contact with the sterile component or device. There are plenty of occasions when certain testing services or other manufacturing services should only be performed by organizations with ISO 13485 certification as well.
For relatively low risk componentry including hardware like computer or Bluetooth chips, a supplier’s ISO 9001 certification might suffice, especially given the manufacturer of record’s responsibility to mitigate risk in line with regulatory agencies along with their own ISO 13485 certification. It all depends on risk.
“For biocompatibility testing services, a manufacturer of record should expect a supplier to follow Good Laboratory Practices (GLP), but not necessarily demand ISO 13485 certification. For materials, a supplier’s qualification or certification depends on how the material is used. If a component’s material will not be introduced in a sterile field, an ISO 13485 certified material supplier might not be required. But for critical components and the materials from which they are made like a polymer, metal or alloy, innovators and manufacturers of record should insist those come from ISO 13485 suppliers.
All Things Equal: Go with the ISO 13485 Supplier
“If presented with suppliers for the same material, component or service where one is ISO 13485 certified and one is not, always go with the certified supplier. Suppliers confirm ISO 13485 compliance with a certificate prior to audit. In addition to this, if I see a supplier is registered with the FDA (separate from ISO 13485, that’s a check in their favor. Current ISO 13485 certification shows they’ve been audited by external experts to verify their qualifications providing a strong layer of risk mitigation for all.”
Consequences of Medical Device Component Failure: One (Fortunate, but Costly) Example
Rebecca recalls the story of a device manufacturer’s component supplier whose material supplier changed the grade of material from which the component was made without notifying them. When the device failed pre-clinical testing, everyone needed to know why. While the change in material grade was identified during pre-clinical testing and not in provision of clinical care, the subsequent investigation, re-sourcing, re-manufacturing and re-testing significantly delayed the project and a substantial amount of money.
“If that had occurred within the clinical setting and caused harm to a user, a quality management system with proper supplier controls would be needed to properly handle the event,” Rebecca says.
Beyond Certification, Responsiveness is a Key Attribute to Quality Suppliers
Responsiveness is a strong criteria for evaluating suppliers, especially for critical componentry.
“In case of a failure and an investigation, you’ve got to have someone on the supplier’s side who will respond quickly, accurately and thoroughly,” Rebecca says. “And if they experience or anticipate any problems or delays with your component, they should let their customer know immediately.”
If you are evaluating multiple component or material providers that are both (or all) ISO 13485 certified (or ISO 9001 certified if applicable), price, speed of production and provision (dependent significantly on your needs), experience and track record especially for like devices and redundancy in suppliers of their own including material sources follow.
For some very basic materials like blank labels, certification may not apply. What’s important are the words that go on those labels and any sterilization of the packing on which they adhere.
Beyond Certifications and Responsiveness: Other Key Supplier Evaluation Criteria for Medical Device Manufacturing
It seems quite basic, but worth stating, beyond any certifications a supplier has to have the equipment and processes required to produce the component to spec.
“If a component needs to be produced, packaged or both in a class VII clean room, they’ve got to have a class VII clean room,” says Georgia Manufacturing Extension Partnership’s (GaMEP) Dean Hettenbach. “If a prospective supplier needs to set up a clean room for the first time just for you, this adds risk for all concerned in the possibility for errors in that process. Who made the clean room components? Who assembled those? Are the seals and filters correct? Does the supplier-user know how to monitor and change those seals and filters? What about the motors and associated components that run the ventilation, filtration and power systems? What happens if those systems fail?
“If a component for which you are evaluating suppliers needs microsoldering, they have to have that equipment and expertise. They also need to employ those in a quality, cost effective way in the volumes required within the economic parameters in small batches or at full scale. Can they meet those?
“Bumping up a level into experience, has the supplier done anything like what you need them to do before? It is also good to know if the component is part of the mainstream of the supplier’s production stream or is it ‘on the fringe?’ If a supplier is hungry for work, they might try to take a bite of something that isn’t good for them or their prospective customer. For truly novel products, who are their other customers? Are they producing a component that needs a similar rigor?
“And if a prospective component supplier has never worked with medical grade device raw materials, including medical grade plastics, that should raise a bright red flag.”
Strategic Components: Risk and Opportunity
Strategic components, those that make your device truly unique and potentially protected by patents or other IP mechanisms, need a partner worthy of high levels of trust. This can present both risk and opportunity.
“Screws, nuts, fasteners, wiring and Bluetooth chips must be made right, but they’re fairly common items even at medical device grades,” Dean says. “But for more novel, complex componentry, some suppliers might actually be capable of taking part in a strategic partnership with their medical device customers. This, along with confidence that they will protect any IP you might have to share with them, is something to consider in a strategic component supplier evaluation as well. If so, strategic fit and cultural fit need to be there. If not, go elsewhere. Keep looking.”
Supplier, material and component sourcing for medical device manufacturers is very, very nuanced in some ways. It’s quite cut and dried in others. In almost every case, it requires thorough vetting including examination and verification of a prospective supplier’s quality management systems, manufacturing processes and currency of certification claims.
When In Doubt, Reach Out
Because so much is dependent on unique qualities of new medical devices, so much remains unknown until it’s thoroughly investigated by the innovator and manufacturer, including the appropriateness of providers and the vetting process. If a medical device innovator or manufacturer is ever uncertain about what they should require of a supplier and why, always ask an expert like a member of the GCMI or GaMEP team before proceeding.
Thanks for reading.
About GCMI
“Based on deep experience and variety in products supported, GCMI knows the requirements for commercialization across the breadth and depth of new medical technologies from the simplest to the most complex. But they know what’s even more important. They know what a technology needs to be within those requirements to actually be successful in the clinic and in the market.
“We can’t get where we want to go, as efficiently and effectively as we need to get there without GCMI.” – Kamil Makhneija, Founder and CEO, Jackson Medical
About GaMEP
The Georgia Manufacturing Extension Partnership (GaMEP) at Georgia Tech is a state and federally funded program and part of the national MEP network. With 10 regional offices throughout the state, the GaMEP helps manufacturers in Georgia increase top-line growth and reduce bottom-line cost through education, training, and technical assistance.
Areas we offer onsite or virtual assistance include: Leadership Development, Strategic Growth, Technology, Lean and Process Improvement, Quality, Energy, Environmental, ISO Management Systems, and Marketing. To learn more about our services and additional resources, visit gamep.org.