For U.S. manufacturers and OEMs, that system has to run through the entire production chain. Compliance doesn't start at final inspection. It starts at design transfer and continues through materials control, machining or assembly, in-process checks, release, recordkeeping, and whatever happens after the part ships.
Many manufacturers struggle to connect these pieces into something an auditor can actually follow. This article covers what FDA requires, how the new Quality Management System Regulation (QMSR) relates to ISO 13485:2016, the core manufacturing controls you need, how to oversee contract manufacturers, and what inspection readiness actually looks like in practice.
Key Takeaways
- A documented QMS aligned with FDA's QMSR (21 CFR Part 820) is the required legal foundation.
- Procedures must match what actually happens on the floor, backed by objective records.
- ISO 13485:2016 supports a QMS but does not replace FDA obligations or skip inspections.
- OEMs stay accountable for contract manufacturers and critical suppliers, even when work is outsourced.
What GMP Means for U.S. Medical Device Manufacturers
"Current Good Manufacturing Practice" isn't a static checklist you complete once. The "current" part matters: FDA expects methods that reflect appropriate, effective practices as technology and risk understanding evolve, not whatever procedures were adequate a decade ago.
FDA's amended regulation, now called the Quality Management System Regulation, took effect February 2, 2026, replacing the standalone Quality System Regulation. The QMSR incorporates ISO 13485:2016 by reference, meaning the ISO standard's requirements now function as the FDA's legally enforceable baseline for most device manufacturers.
That's a meaningful distinction. ISO 13485 certification is a voluntary, third-party credential. QMSR compliance is a legal obligation enforced through FDA inspection and warning letters. A company can hold one without fully satisfying the other, especially where FDA-specific provisions (like certain recordkeeping and labeling requirements under 21 CFR 820.35 and 820.45) sit outside the ISO text itself.
Factors That Shape Your Compliance Obligations
Not every facility carries the same regulatory weight. Your actual obligations depend on:
- Your role — finished-device manufacturer, contract manufacturer, or component-only supplier
- Device classification and risk — Class I, II, or III devices carry different scrutiny
- Design responsibility — whether you own design controls or receive a transferred design
- Outsourced activities — what you perform in-house versus what a supplier handles
- Labeling and postmarket rules — these extend beyond the core quality-system regulation
A component-only fabricator and a finished-device contract manufacturer are treated differently under FDA's registration framework, so don't assume one shop's obligations automatically apply to another. If you're uncertain where your facility falls, confirm with regulatory counsel or a qualified consultant.
Core GMP Compliance Requirements for Medical Device Manufacturing
A compliant QMS rests on several interlocking structures. Skip one, and the rest start to wobble during an audit.
Quality management system structure is the foundation. It should include:
- Defined quality responsibilities and management oversight
- Controlled procedures and documented training
- Internal audits, management review, and risk-based planning
Nobody should be guessing who owns a given process.
Design and development controls (where you hold design responsibility) cover:
- Design inputs, outputs, and formal reviews
- Verification, validation, and controlled design transfer
- Documented design changes with a paper trail for why each change happened and what was reassessed
Production and process controls require:
- Approved work instructions and controlled manufacturing conditions
- Equipment maintenance, calibration, and environmental controls where relevant
- In-process inspection, final acceptance, and personnel qualification records
Materials, purchasing, and supplier controls complete the core set:
- Supplier qualification and purchase specifications
- Incoming verification and ongoing supplier performance monitoring
- A documented path for escalating supplier nonconformances
Process Validation: When Final Inspection Isn't Enough
Some processes can't be fully verified by looking at the finished part. Welding, certain heat treatments, and most additive manufacturing builds fall into this category. For these, you need:
- Written protocols defining the process parameters and acceptance criteria upfront
- Qualification evidence proving the process performs as intended under real conditions
- Revalidation triggers defined in advance for equipment changes, material changes, or process drift
- Retained records tying each production lot back to its validation status
FDA's additive manufacturing guidance makes this point directly for 3D-printed components. Build-process qualification and post-processing validation matter because final inspection alone can't catch everything.
Documentation Checklist: Evidence an Auditor Will Ask For
| Control Area | Objective Evidence Produced |
|---|---|
| Design transfer | Approved specifications, verification/validation records |
| Production | Device master records, batch/lot records, traceability logs |
| Inspection | Measurement data, calibration certificates, acceptance results |
| Materials | Certifications, incoming inspection records |
| Changes | Change requests, risk assessments, approval signatures |
| Nonconformance | NCR logs, CAPA records, effectiveness checks |
At MoManTech, that evidence column isn't theoretical. No component leaves the Sheridan, Montana facility without comprehensive inspection, using systems such as an OGP Flash 302 vision platform with CMM and laser measurement, plus a 14-inch Mitutoyo PHA 14.
The working rule is prevention over detection: controls built into the process, not bolted on at the end.
Practical Roadmap for Implementing GMP Controls
Building this system from scratch feels overwhelming. Breaking it into a clear sequence helps. Start with a gap assessment. Map applicable FDA requirements against your current procedures, your ISO 13485 processes if you have them, and your device-specific risks. Prioritize gaps that touch patient safety or product function first. A missing signature on a low-risk form matters less than an unvalidated critical process. Assign clear ownership next. Each of these areas needs a named owner:
- Document control and record retention
- Training and purchasing
- Production, inspection, and equipment maintenance
- Nonconformance handling and CAPA
- Complaint management and change control Shared ownership usually means no ownership. Build controls around your actual process, not a generic template:
- Define critical dimensions and characteristics for each part
- Specify inspection methods and acceptance criteria
- Document the sampling rationale (why you check 1-in-10, not 1-in-100)
- Set tooling, equipment, and operator qualification requirements
- Create escalation steps for deviations before they happen, not after
A Closed-Loop CAPA Process
Treat correction, investigation, corrective action, and prevention as distinct steps:
- Correction — fix the immediate nonconforming part or batch
- Root-cause investigation — find out why it happened, not just what happened
- Corrective action — address the actual cause
- Effectiveness check — verify the fix worked, with data, not assumption
- Management review — close the loop at a level that can allocate resources For startups and small OEMs, scale this sequence rather than skip steps. A five-person shop does not need a 40-page CAPA procedure, but it does need all five steps documented somewhere traceable. Electronic or paper systems both work if you preserve approval controls, revision history, and retrieval. The same discipline applies whether you run controls in-house or with an ISO 13485 contract-manufacturing partner.
Lock Down Change Control
Give change control its own gate before anything goes live. Evaluate changes to:
- Materials and suppliers
- Equipment and software
- Specifications and process parameters Ask whether the change needs revalidation, customer notification, or updated technical documentation—and finish that evaluation before release.
Contract Manufacturing and Supplier Compliance Considerations
Outsourcing a manufacturing step doesn't transfer your regulatory responsibility. FDA's current inspection program specifically examines whether outsourced processes are effectively monitored and controlled, placing the accountability squarely on the finished-device manufacturer, not the supplier doing the work.
That means your contract manufacturer relationship needs a clear division of labor covering specifications, process control, inspection, release, complaint handling, nonconformances, changes, and records.
OEM Due-Diligence Checklist
Before committing to a contract manufacturer, evaluate:
- Relevant ISO 13485 certification and quality-system scope
- Manufacturing experience with your specific device category
- Equipment and process capability for your tolerances
- Inspection resources and a documented calibration program
- Traceability practices and employee training records
- CAPA history and supplier-control processes
- Willingness to grant audit access
A quality agreement should put the division of labor in writing. Cover at least:
- Approved specifications and change-notification rules
- Deviation and nonconformance reporting
- Record access and retention
- Complaint and recall support
- Sub-tier supplier controls and right-to-audit provisions
Without that document, you're trusting goodwill instead of process.
This is the kind of partner evaluation OEMs run for spinal, large-bone, trauma, and foot-and-ankle component programs. MoManTech, for example, is an ISO 13485:2016-certified contract manufacturer focused on orthopedic components, with documented inspection and production from prototype lots of 1–10 units through runs of 100-plus.
Certification is only a starting point. It does not replace the due diligence above on any individual customer program.
Inspection Readiness and Evidence of Compliance
An FDA or customer auditor compares what's written against what's actually practiced. They'll look at written procedures, employee practices, equipment status, inspection results, nonconformance records, training files, supplier records, change histories, and released-product documentation side by side.
FDA retired its older QSIT framework on February 2, 2026, shifting to compliance program 7382.850. Inspections now organize around six areas:
- Change control
- Design and development
- Management oversight
- Measurement, analysis, and improvement
- Outsourcing and purchasing
- Production and service provision
Quick Audit-Readiness Checklist
- Current work instructions are accessible at the point of use
- Traceable records connect every lot back to its inspection and release data
- Equipment calibration is current, with certificates on file
- Personnel training records match the tasks each employee actually performs
- Open CAPAs and overdue actions are tracked, not buried
- Process owners give consistent answers when asked the same question twice
Documentation gaps show up fast under scrutiny. One recent FDA warning letter cited deficiencies in rework documentation, a missing process risk assessment, and incomplete corrective-action investigation records. Implementation evidence matters as much as the written procedure.
When findings surface, follow a clear response sequence:
- Preserve evidence
- Document the immediate correction
- Investigate the systemic cause
- Assign accountable actions with due dates
- Verify effectiveness before closing the record
Avoid overstating your compliance status in any written response.
Core quality-system compliance is not the whole picture. Medical device reporting, corrections and removals, unique device identification, and labeling rules sit outside QMSR but still carry independent FDA obligations.
Frequently Asked Questions
What are the GMP guidelines for medical devices?
U.S. GMP expectations center on a controlled quality management system, qualified personnel, documented design and production processes, validated processes where needed, inspection and testing, traceability, supplier controls, and CAPA. Exact obligations depend on your device classification and manufacturing role.
What are the 5 rules of GMP?
There's no single officially recognized "five rules" framework for U.S. medical devices. In practice, the core principles are documented procedures, trained personnel, controlled facilities and equipment, reliable records and traceability, and ongoing investigation and prevention of quality problems.
How do I get a GMP certification?
FDA doesn't issue GMP certificates. ISO 13485:2016 certification comes from an independent, accredited certification body after you establish a QMS and pass an audit. Certification doesn't replace your separate FDA registration, listing, and ongoing regulatory obligations.
