Supplier qualification under ISO 13485 and EU GMP: a practical guide
How to classify suppliers by risk, decide between a questionnaire and an audit, write a quality agreement that works, and handle a supplier change before it reaches your product.
The approved supplier list has 140 names on it. About twenty of them matter a great deal, perhaps forty were approved years ago on a questionnaire nobody has reread, and one, a moulder of silicone seals, switched to a different curing system last spring without telling anyone. You found out when a biocompatibility question came up during a notified body audit.
That is the usual state of supplier qualification in a growing manufacturer: plenty of paperwork at the front, very little afterwards. This guide sets out what ISO 13485 clause 7.4 and EU GMP Chapters 5 and 7 actually require, then gives you a risk-based way to classify suppliers, choose evidence, write quality agreements, monitor performance and deal with supplier changes.
What ISO 13485 and EU GMP require
ISO 13485:2016 clause 7.4.1 requires criteria for evaluating and selecting suppliers that are based on the supplier's ability to provide conforming product, on its performance, and on the effect of the purchased product on the quality of the medical device, and that are proportionate to the risk associated with the device. You must plan monitoring and re-evaluation, use monitoring results as an input to re-evaluation, address unmet purchasing requirements with the supplier in proportion to risk, and keep records of all of it.
Clause 7.4.2 says purchasing information should include, where applicable, a written agreement that the supplier will notify you of changes before they implement any that affect the purchased product's ability to meet requirements. Clause 7.4.3 ties the extent of incoming verification to the supplier evaluation results and to product risk, and requires you to assess any change you become aware of for its effect on product realisation or the device. Where you outsource a process, clause 4.1.5 requires controls proportionate to risk, including written quality agreements.
Under the EU MDR, Article 10(9) lists the selection and control of suppliers and subcontractors among the things a manufacturer's quality management system must address, and Annex IX section 3.4 allows the notified body's unannounced audits to extend to the manufacturer's suppliers and subcontractors where appropriate. Your critical suppliers need to be ready for a visit you did not arrange.
For medicines, EU GMP Chapter 7 covers outsourced activities. The contract giver must assess the legality, suitability and competence of the contract acceptor before outsourcing (7.5), monitor and review its performance (7.7), and have a written contract that defines who does each step and permits audit (7.14 to 7.17). The contract acceptor may not subcontract without prior evaluation and approval (7.11) or make unauthorised changes that could affect quality (7.12).
EU GMP Chapter 5 covers materials. Paragraph 5.27 requires the selection, qualification, approval and maintenance of starting material suppliers to be documented, with supervision proportionate to the risk from each material, considering its source, manufacturing process, supply chain complexity and final use. Paragraph 5.28 expects quality requirements to be agreed in a formal quality agreement or specification. Paragraph 5.29 requires audits of active substance manufacturers and distributors, and a formalised risk assessment for excipients. Paragraph 5.45 extends the same attention to primary and printed packaging suppliers.
Classify suppliers by risk before you qualify them
Every requirement above says "proportionate", so start with a classification. Three tiers are enough for most small and mid-sized manufacturers.
| Tier | Typical examples | Qualification evidence | Monitoring |
|---|---|---|---|
| Critical | Active substance, contract manufacturer, sterilisation contractor, primary packaging, a component that directly affects device safety or performance, a contract laboratory releasing results | On-site or remote audit before approval, quality agreement, samples or first-article inspection, review of certificates | Re-audit on a risk-based cycle, monthly or quarterly metrics, annual re-evaluation |
| Major | Excipients, printed packaging, secondary components with a specification, calibration services | Detailed questionnaire, certificates, quality agreement or agreed specification, trial batches | Annual re-evaluation from metrics; audit if performance drops |
| Minor | Office supplies, general consumables with no product contact, courier for non-GxP goods | Basic commercial check | Review only when a problem arises |
Classify by the effect on product and patient, then adjust. A single-source supplier, a complex supply chain, or a material where you rely on the supplier's certificate of analysis instead of full testing should push a supplier up a tier. Since the 2023 revision of ICH Q9, product availability counts as a quality risk too, so a sole supplier of a shortage-critical material deserves the critical tier even if the material itself is simple.
Write the rationale for each classification on the supplier record. When an auditor asks why the label printer is "major" and not "critical", you want a one-line answer that mentions the label content check you perform at receipt.
Evaluation criteria and evidence
For each tier, define what the evaluation must cover. A sensible set of criteria for critical and major suppliers:
- quality system status (ISO 13485 certificate, GMP certificate or manufacturing authorisation where relevant, inspection history)
- technical capability for your specification, including process validation status
- change control and change notification practice
- control of their own suppliers and subcontractors
- traceability and record retention
- complaint, deviation and recall handling
- regulatory standing, for example presence in EudraGMDP for active substance manufacturers
- supply continuity: other sites, capacity, business continuity plans
Then decide what evidence proves each criterion. Certificates prove that someone else assessed the system against a standard. They do not prove the supplier can make your part to your specification, which is why samples, first-article inspection or qualification batches carry weight for critical items.
Supplier audit or questionnaire?
A questionnaire tells you what a supplier says it does. An audit lets you see whether it does it. Both have a place.
Use a questionnaire for major suppliers, as a screening step before an audit, and to refresh information between audits. Make it specific. "Do you have a change control procedure?" will always get a yes. "Describe the last change you notified to a customer and how much notice you gave" tells you something.
Audit when the supplier is critical, when the questionnaire raises doubts, when performance data deteriorates, or when a supplier proposes a significant change. Where you rely on a supplier's test results, EU GMP paragraph 5.36 expects audits of the testing site, by you or through a third party, at intervals based on risk. Remote audits work well for document-heavy reviews of a supplier you already know. They are weaker for a first visit to a manufacturing site, where seeing the shop floor, the warehouse and the reject cage matters.
Plan supplier audits alongside your internal ones, using the same risk-based scheduling. Our guide to building an internal audit programme covers frequency setting that applies equally to suppliers.
What a GMP quality agreement should contain
A quality agreement is the technical part of the contract. Chapter 7 wants it written by people who understand the outsourced activity and GMP, and that shows in the detail. At minimum it should cover:
- scope: products, materials, services and sites covered
- specifications and who owns them
- responsibilities for each step, in a table: purchasing materials, testing, release, storage, transport
- change notification: what must be notified, how far in advance, and what needs your approval before implementation
- deviations and out-of-specification results: what the supplier must report and how quickly
- subcontracting: prohibited without your prior approval
- records: what is kept, for how long, and access on request
- your right to audit, including for-cause audits at short notice
- complaints, recalls and falsified product investigations
- regulatory inspections: notification when an authority inspects or finds issues affecting your product
The change notification clause is the one that gets weakened in negotiation. Hold the line on it for critical suppliers. Name examples of notifiable changes in an annex: raw material source, manufacturing site, key equipment, test method, sterilisation parameters, subcontractors.
Approved supplier list and ongoing monitoring
The approved supplier list should show more than a name and a tick. For each supplier, record the materials or services approved, the tier and rationale, the approval status (approved, conditional, suspended, disqualified), the date of the last evaluation and the next due date, and a link to the quality agreement. Purchasing should not be able to raise an order against a supplier who is not approved for that item.
Monitoring needs data you already collect: goods-in rejections, certificate of analysis discrepancies, deviations and complaints traced to the supplier, late or incomplete responses to supplier corrective action requests, and on-time delivery where shortages would affect supply. EU GMP 5.36 adds a check that is often skipped: where you reduce testing and rely on the supplier's certificate, perform full analysis at risk-based intervals and compare results. If there is a discrepancy, stop accepting certificates until the investigation is complete.
Re-evaluate on a schedule set by tier and bring the monitoring results into it, as clause 7.4.1 requires. The outcome is a decision: continue, continue with conditions, increase oversight, audit, or disqualify. When a supplier problem needs formal action, raise it through CAPA and treat the supplier as the owner of the corrective action, with you owning verification. Our article on CAPA under ISO 13485 covers how to structure that.
When a supplier changes something
Supplier changes reach you in one of three ways: a formal notification, a hint in a new certificate or datasheet, or an investigation after something goes wrong. The first is the system working. The other two are signs the agreement or the relationship needs attention.
Treat every notified change as an internal change control. Assess its effect on specifications, validation, stability, biocompatibility, regulatory filings and your own processes, and decide what evidence you need before accepting it: comparison testing, qualification batches, updated certificates, or a notified body or competent authority notification. The method in our article on change control impact assessment works the same way for supplier-initiated changes.
An unnotified change is a deviation. Contain affected material, assess product already released, and open a CAPA that covers both the product impact and the failure of the notification arrangement. Consider whether the supplier's tier, audit frequency or approval status should change. In the silicone seal example, that means quarantining stock, assessing the new curing system against the biological evaluation, and auditing the supplier's change control before approving further deliveries.
Takeaway
Pull your ten most critical suppliers this week and check three things for each: a written classification rationale, a quality agreement with a specific change notification clause, and a re-evaluation in the last year that used real performance data. If any of the three is missing for a critical supplier, fix that before you add another name to the list.
If you want supplier audits planned and tracked with the same programme, checklists, findings and closure as your internal audits, see InnoQualis audit management.
