Working with a Contract Manufacturer is a common way for small- and medium-sized medical device companies to streamline their product development process. In this scenario, the firm with the idea for the medical device is designated as a “Virtual Company,” with a core team comprised of medical professionals, engineers, and businesspeople focused on bringing the device to market. Meanwhile, the Contract Manufacturer (CM) can take responsibility for tasks like manufacturing, sterilization, packaging, and shipping of the product.

There are numerous advantages to using the Virtual Company model. The right CM brings vast knowledge and experience to any medtech project, including their quality system (QS) to help guide the development of a compliant device and their facilities for production.

However, too often medical device companies assume that partnering with a CM means that they are handing over responsibility for maintaining a compliant quality management system to that CM. This is not true.

Working with a CM will likely make the quality system (QS) you’re responsible for maintaining much less cumbersome, as you will also be leveraging their QS.

But here’s the cold, hard truth: If your company comes up with a medical device and hires a CM, your company is ultimately responsible for the quality of the product produced by that CM. 

This is absolutely essential for medtech engineering companies to understand from the very start of their product development process.

‍

Why do I need a quality system even though my CM has one?

To understand the nuances of the regulations that push your company towards needing a QS while also using a CM, it helps to understand how FDA identifies “finished devices” and “manufacturers.” 

FDA's definition of a finished device is given in 21 CFR 820.3, which says, “A finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.”  In other words, a finished device is your product.  

FDA's definition of a manufacturer is also given in 21 CFR 820.3: “Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes but is not limited to those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions. In other words, your company is the manufacturer. 

Together, the industry refers to the corporate entity responsible for the device’s manufacture from an FDA perspective, the “Finished Device Manufacturer”. This entity is required to register with FDA and is the entity formally submitting the regulatory submission for the device. 

In other words, your company—not the CM—is responsible for what FDA refers to as the “Finished Device,” and your company is responsible for all aspects of the QS associated with the design and manufacturing of the product. You may assign responsibility to your suppliers from a legal or contractual perspective (more on that below) but the responsibility is not assigned to the CM  in FDA’s eyes. It is only on you. 

So if something goes wrong with the product…

• the FDA contacts YOU not your CM 
• the lawyers will sue YOU and not your CM 
• warning letters are sent to YOU and not your CM
• fines will be paid by YOU and not your CM 
• the FDA will audit YOU and (possibly) also the CM 
• customer complaints will go to YOU and not the CM 
• …. you get the picture. 

‍

How do I ensure that my CM’s quality system covers the parts that mine doesn’t?

First and foremost, you should pick a CM partner that has experience with medical devices, and the necessary certifications. Additionally, you should set up a Supplier Quality Agreement with them. 

A Supplier Quality Agreement sits alongside your general contract to ensure that your CM is upholding the parts of their QS that you expect them to. Specifically, it describes key manufacturing roles and responsibilities, establishes expectations for communication, and describes how your quality management system interacts with the CM’s quality management system.

(It also serves to satisfy the lawyers for a medical device company, by providing certain assurances that damages may be recouped if the CM fails to meet the terms of the agreement. )

What the Supplier Quality Agreement does not do, however, is relieve the Owner (aka the legal entity selling the products) of its responsibility to ensure the quality and safety of the products.  In other words, from FDA’s perspective, a company may not delegate statutory responsibilities to a CM through a legal contract. 

Remember: should any major issues arise with a product that your company is the designated Manufacturer for, FDA will issue  warning letters directly to your company and hold you accountable for all fines and remediation activities.

‍

How should I divide responsibilities between my company and my Contract Manufacturer?

Based on our extensive experience working with companies that use CMs, we understand which steps and activities are best handled in-house and which are best outsourced to a CM. Below is the breakdown that we recommend.

Following this method is cost-effective, provides adequate risk mitigation, and sets you up for success in future audits and with general device development. 

QMS Activities Owned by Your Company:

• Document control and ownership of records
• Management Responsibility
• Quality Reporting and KPI’s 
• Change Control
• Quality Audits 
• Design Controls (and Design History File)
• Design transfer/manufacturability sign-off
• Risk Management (and Risk Management File)
• Management of Incoming and final device inspection specifications
• Supplier Controls and Supplier Quality Agreements
• Purchasing Controls 
• Complaints Handling 
• Adverse Event Reporting/MDR
• Acceptance Activities and Final Release
• First Articles Inspection and approval
• Regulatory Notifications/Changes
• Training
• Quality Policy
• Non-Conformances
• Labeling, Packaging, and Storage
• Corrective Action and Preventive Action planning/implementation
• Distribution
  

As you can see, there may be many overlapping activities between your company’s Quality System and the manufacturer’s Quality System that should be defined in greater detail in your Supplier Quality Agreement. 

QMS Activities Owned by Your CM:

• Quality Policy
• Management Responsibility
• Facilities, Equipment, Process, Analytical Test Method and Computer System Validation
• CAPAs
• Complaints/Adverse Events
• Design Controls
• Risk Management
• Document Control
• Change Management
• Quality Reporting and KPIs
• Non-Conformances, Out-Of-Specification, and Process Deviations
• Quality Audits
• Training
• Supplier Controls
• Purchasing Controls
• Calibration/Preventive Maintenance
• Records Management
• Labeling, Packaging, and Storage
• Distribution
  

Nemedio’s unique software and service solutions have been tailored to suit this type of arrangement and provide a straightforward implementation of a QMS that will integrate seamlessly with the responsibilities you assign to your CM. 

To learn more about how Nemedio’s tools can help accelerate your medical device development process, get in touch today.