Introduction
Outsourcing machining or component production doesn't outsource accountability. If you're a medical-device OEM working with a contract manufacturer, a written quality agreement is one of the few documents that actually protects you when something goes wrong.
Many OEMs treat these agreements as boilerplate, something that legal drafts and nobody reads again. That's a mistake. Without clear terms covering responsibilities, documentation, and change control, disputes over nonconforming parts or missed specifications can stall production and jeopardize regulatory standing.
This article covers what belongs in an FDA-related quality agreement for device manufacturing. It explains how to divide responsibilities between OEM and manufacturer, when to review the agreement, and how to vet a contract manufacturer before you sign anything. This is educational content, not legal advice — confirm current requirements with qualified regulatory counsel.
Key Takeaways
- Define responsibilities, communication paths, records, approvals, and escalation in the quality agreement
- FDA drug quality-agreement guidance does not apply to devices; align with QMSR and ISO 13485:2016
- The agreement supplements commercial contracts; it doesn't replace your supply agreement or purchase orders
- Evaluate a manufacturer's quality system, documentation, and inspection capabilities before production starts
FDA Scope: Drugs Versus Medical Devices
Why the Drug Guidance Doesn't Transfer Directly
FDA's Contract Manufacturing Arrangements for Drugs: Quality Agreements guidance, finalized in November 2016, is built specifically for pharmaceutical and biologic manufacturing. The guidance states plainly that it does not cover medical devices.
That doesn't mean it's useless as a reference point. Several principles translate well regardless of product type:
- Clear allocation of quality roles between parties
- Documented oversight of outsourced activities
- Formal change control procedures
- Manufacturing records that support traceability
- Defined handling for deviations and nonconformances
- Timely communication of quality events
Treat the drug guidance as a conceptual starting point, not a device template. Those shared principles still sit inside a different rule set once the product is a device.
The Device-Specific Framework
Device manufacturers follow a separate framework. FDA finalized the Quality Management System Regulation (QMSR) rule on February 2, 2024 (effective February 2, 2026), incorporating ISO 13485:2016 by reference into 21 CFR Part 820.
Important nuance: Part 820's provisions don't apply directly to manufacturers of components or parts — only to finished-device manufacturers. FDA encourages component suppliers to consider the provisions where appropriate, but the direct regulatory obligation sits with the finished-device manufacturer in most cases.
ISO 13485:2016 certification shows you run a structured quality management system. It is not a guarantee of FDA compliance. FDA has said certification alone will not replace its own inspection findings.
Your obligations depend on:
- Regulatory role (specification developer, component supplier, or finished-device manufacturer)
- Device classification and risk level
- Manufacturing activities you actually perform
- Distribution responsibilities
- Whether the component is an accessory or a finished device
What an FDA Contract Manufacturing Quality Agreement Should Cover
A solid quality agreement should work as a shared operations manual both parties can point to when questions arise.
Scope and Foundation
Start with the basics:
- Covered devices or components
- Manufacturing sites
- Applicable specifications and shared terminology
- Effective date
- How the agreement relates to your master services or supply agreement
Ambiguity here creates problems later. If the agreement doesn't name the specific part numbers or sites covered, disputes over scope become inevitable.
Responsibility Allocation
Document who owns what across the production chain:
- Design inputs, outputs, and drawings
- Material specifications and approved suppliers
- Tooling and equipment
- Production instructions and inspection plans
- Testing, packaging, and labeling
- Final release authority
Documentation and Change Control
Specify document-control responsibilities, including:
- Controlled work instructions
- Inspection and calibration records
- Training records and retention periods
- Electronic records access
Treat change control as its own section. Specify which changes require advance written notice, customer approval, revalidation, or a regulatory assessment before implementation. Cover drawings, materials, suppliers, equipment, software, and inspection methods.
Nonconformance, Audits, and Dispute Resolution
Address nonconforming product, deviations, rework, scrap, and CAPA requirements, along with escalation and notification expectations. Avoid locking in fixed timelines. Risk-based timelines, agreed upon by both parties, work better across different severity levels.
Also cover:
- Customer and regulatory audit rights, including reasonable advance notice
- Records access during inspections
- Subcontractor management
- A process for resolving quality disagreements
- Termination or transfer-of-manufacturing provisions
How Responsibilities Should Be Divided Between the OEM and Manufacturer
This is where most quality agreements either succeed or fall apart. A responsibility matrix organized around the manufacturing lifecycle keeps duties concrete:
- Specifications and supplier qualification
- Incoming materials, machining, and in-process inspection
- Final inspection, release, and records
- Change management, nonconformances, and regulatory communication
What Typically Stays with the OEM
- Defining product requirements and critical characteristics
- Approving specifications and significant changes
- Maintaining regulatory and product knowledge
- Evaluating and qualifying the manufacturer
- Making decisions reserved to the legal manufacturer or specification developer
What Typically Falls to the Contract Manufacturer
- Executing approved processes as specified
- Maintaining equipment and calibration programs
- Training personnel on relevant procedures
- Controlling production records
- Inspecting parts against agreed criteria
- Segregating nonconforming product
- Investigating process-related issues
- Notifying the OEM of quality events
Shared Ground
Some activities genuinely need joint input:
- Risk assessment and process validation planning
- Supplier qualification and change-impact evaluation
- Complaint investigations, CAPA, and audit response
- Regulatory submission support
Name who initiates, who reviews, and who approves each one. "Shared" without those specifics usually means nobody is accountable.
A Worked Example
Consider an orthopedic trauma plate machined under contract. The OEM approves the engineering drawing, defines critical dimensions, and sets acceptance criteria. The manufacturer then:
- Controls the machining process and in-process inspection
- Performs final measurement against the approved drawing
- Maintains traceability records
- Escalates any deviation under the agreed procedure
That same split is what a disciplined orthopedic contract manufacturer builds into daily work: controlled processes, trained personnel, comprehensive inspection, and documentation that supports the OEM's regulatory record-keeping. MoManTech runs quality systems this way on orthopedic component programs.
A quality agreement allocates operational tasks. It cannot contract away statutory obligations that remain legally tied to either party.
When to Create, Review, and Update the Agreement
Finalize the quality agreement before the first production run, not after. Treating it as paperwork to clean up post-launch creates gaps exactly when you need clarity most.
Review Triggers
Revisit the agreement when any of the following occur:
- New device or component added to the relationship
- Site transfer to a different manufacturing location
- New subcontractor brought into the supply chain
- Process or equipment change affecting the qualified arrangement
- Specification revision to covered parts
- Significant nonconformance or audit finding
- Regulatory change affecting either party's obligations
- Ownership change at either organization
Neither Global Harmonization Task Force (GHTF) guidance nor FDA audit approach documents prescribe a fixed renewal interval. Reevaluation frequency should match the risk and significance of the supplied component to the finished device.
Keeping It Current
Beyond trigger-based reviews, run a periodic check to confirm the agreement still matches actual operations: approved suppliers, record-retention practices, and current points of contact. Build these controls into the agreement:
- Version control and revision history
- Approval by appropriate quality representatives on both sides
- A clear effective date
- Superseded-version handling
- Communication or training when terms change
How to Evaluate a Contract Manufacturer Before Signing
Before committing production volume to a new partner, run a structured due-diligence review rather than relying on a sales conversation.
Due-Diligence Checklist
Ask for evidence covering:
- Applicable certifications and quality manual
- Supplier control and incoming-inspection procedures
- Calibration program and measurement capability
- Training records and personnel qualification
- Traceability practices
- Nonconformance and CAPA processes
- Change-control procedures
- Recordkeeping practices
You don't need confidential customer documents — a quality manual summary, procedure index, and sample inspection report usually tell you enough.
Beyond the Certificate
Verify that quoted capabilities match actual equipment and personnel on the floor. A risk-based supplier audit, or at minimum a documented qualification review, should confirm the manufacturer can support both first-article work and repeat production at volume.
Ask specific operational questions:
- How are drawing revisions communicated and controlled?
- What's the process for material certifications on critical components?
- How are critical dimensions inspected and documented?
- How does the manufacturer handle special processes and subcontractors?
- What's the escalation path for urgent quality issues?
FDA's own historical training materials note that audits, performance monitoring, and inspection/testing data matter more than a certificate on a wall. Quality procedures should match the work on the floor, not the marketing brochure.
When you apply that standard to an orthopedic machining partner, look for ISO 13485:2016 certification, clear inspection methods, and a shop that actually runs your device types. MoManTech focuses exclusively on orthopedic components (spine, trauma, large joint, and foot/ankle), supports DFM input from planning through prototype lots of 1–10 and production runs of 100+, and releases parts only after OGP vision/CMM and Mitutoyo height-gauge inspection. If you're comparing partners for prototype, first-article, or production work, the team can review your specs against those capabilities at kirt.johnston@momantech.com or 406-842-5403.
Frequently Asked Questions
What is an FDA contract manufacturer?
A contract manufacturer is a third party performing specified manufacturing activities on behalf of an OEM or other legal manufacturer. Under FDA rules, exact duties depend on the products, activities, and each party's defined role.
Are quality agreements required by the FDA?
Requirements vary by product category and activity type. FDA's drug-specific guidance doesn't apply to devices. Confirm the quality-system and supplier-control obligations that apply to your arrangement.
What should be included in an FDA quality agreement?
A practical agreement typically covers:
- Scope and responsibility allocation
- Specifications, production, and inspection controls
- Records, change control, and CAPA
- Nonconforming product handling
- Audit rights, quality-event communication, and revision control
Who is responsible for quality in contract manufacturing?
Responsibility is shared according to the work each party performs and the regulations that apply to it. Outsourcing doesn't remove the OEM's oversight obligations, and it doesn't remove the manufacturer's responsibility for compliant execution.
How often should a quality agreement be reviewed?
Review periodically, plus immediately after any significant operational, product, supplier, process, or regulatory change. No universal review interval applies. Base frequency on risk and how critical the component is to the finished device.
