QMSR Tip #2: Ensure product quality and patient safety with risk-based supplier agreements

Component manufacturers are exempt from QMSR, but FDA can still hold them accountable. Device manufacturers should protect their organization and patients through robust quality agreements.

In the final rule on Quality Management System Regulation (QMSR)¹, due to go into effect in February 2026, FDA has declared the agency’s intention not to require component manufacturers to comply with the requirements of this rulemaking².

This does not mean the agency will tolerate poor quality practices at manufacturers of components or parts that can adversely affect safety and effectiveness of the finished medical device.

Consistent with the current Quality System (QS) regulation, FDA has chosen to exclude manufacturers of components and parts from the QMSR. However, FDA is clear in the preamble to the the final rule that the agency can extend its regulatory oversight to the manufacturers of components and parts should “the need arise”.

In response to Comment 5, FDA writes:

FDA agrees that manufacturers of components or parts of finished devices are not subject to the QMSR. We also note that, although the scope of the QMSR remains unchanged, FDA has the legal authority to inspect component manufacturers under the FD&C, should the need arise.

So, the question is - under what circumstances would the FDA decide to inspect a component manufacturer?

Another question is - if they find any violations, who would get a warning letter?

There are no standard answers to these questions. However, we can gain some insights from recent FDA actions.

Device manufacturers are ultimately responsible for safety and effectiveness, but suppliers are not off the hook

FDA has clearly stated that the scope of QMSR applies only to medical device manufacturers. However, it does not mean that the agency does not have legal authority to go after manufacturers of components and parts if there are gross violations of the Food, Drug and Cosmetics (FD&C) Act. In Comment 2 of the QMSR preamble, FDA writes:

FDA’s legal authority to promulgate the QMSR derives from its statutory authority to develop regulations to assure that a device conforms to CGMP, to assure that the device will be safe and effective and otherwise in compliance with the FD&C Act.

In short, FDA is responsible for ensuring that medical devices marketed in the United States are safe and effective, and processes used in their production, storage and distribution are compliant with the Current Good Manufacturing Practices (CGMP).

They can take legal action against anyone involved in the entire supply chain, from raw material and component suppliers to contract manufacturers to finished device manufacturers when there is evidence of non-compliance with regulations.

Recent warning letters illustrate how FDA can go after multiple entities in the supply chain for a device issue

In late 2023, FDA announced a Class I recall of a certain brand of disposable sterile syringes used in syringe pumps for infusion of fluids or medications to a patient³. Due to a slight change in dimensions, these syringes were no longer compatible with certain syringe pumps, PCA pumps or enteral syringe pumps, which could result in pump performance issues such as overdose, underdose, delay in therapy, delay in occlusion alarms and delay in feeding.

It was followed by another Class I recall⁴, this time by a manufacturer of an infusion pump, to issue an advisory notice to healthcare facilities informing them of the potential incompatibility and actions they should take for continued safe use.

Technically, the syringe manufacturer is not a supplier to the infusion pump manufacturer in this particular case. The syringe is classified as a standalone medical device, but used by healthcare facilities as an off-the-shelf component in various syringe pumps.

However, as illustrated by the warning letters noted below, FDA has taken action against the distributor and foreign manufactures of these syringes.

In April 2024, FDA issued a warning letter to Cardinal Health⁵, the importer/distributor of the sterile syringes involved in the Class I recall of the sterile syringes noted above. FDA cited them for unauthorized marketing and several quality system violations⁶.

In July 2024, FDA issued a warning letter to Jiangsu Caina Medical Co., Ltd⁷, the manufacturer of these sterile syringes for several quality system violations. These violations included failure to investigate complaints and initiate a CAPA following reports of syringe incompatibility with the syringe pumps noted above⁸.

These warning letters illustrate how FDA can take legal action against anyone involved in the entire supply chain of a medical device.

Patient safety is everyone’s responsibility, but device manufacturers have an extra burden for compliance

As we wrote in a recent case study, “When silent changes in one device cause incompatibility with another”, the question “Who is responsible?” is a tricky one to answer.

This is because there are many entities involved in the complex system of healthcare delivery to patients, and no single entity has the sole responsibility. However, when a medical device is directly involved, the device manufacturer is ultimately responsible for its safety and effectiveness of their devices. That is why device manufacturers have an extra burden, and FDA is generally more focused on exercising its legal authority on them.

Now that the QMSR has incorporated the entire ISO 13485:2016 by way of reference in the amended regulation, device manufacturers will be required to comply with Clause 7.4 in the standard, which requires them to establish a process for supplier selection, evaluation and re-evaluation, purchasing information and verification of purchased product.

However, in an indirect way, FDA is suggesting that device manufacturers should establish a contract with component manufacturers to ensure quality. In Comment 2 of the preamble, FDA writes:

FDA’s determination not to extend this regulation to manufacturers of components and parts does not preclude any contract between manufacturers that requires compliance with this rulemaking and is consistent with Clause 0.1 of ISO 13485⁹.

In short, device manufacturers can require their suppliers to comply with applicable Clauses of ISO 13485, and aspects of the QMSR, through a written contract.

A best practice in the industry is to establish a Supplier Quality Agreement, which also includes, a requirement to notify any changes that may affect the quality and safety of the finished device. A risk-based approach is preferred for each supplier based on the criticality of their product or services associated with the manufacturing of the finished device.

An added advantage of a supplier quality agreement is that a device manufacture may be able to take legal action if the terms of the agreement are violated.

Component manufacturers can gain a substantial competitive advantage by voluntary compliance to regulations and standards

A component or parts manufacturer, although not required to comply with the QMSR, should also consider voluntary compliance to applicable regulatory requirements and standards.

In Comment 5 of the preamble, FDA writes:

FDA encourages manufacturers of components and parts of finished devices subject to the QMSR to also review this rule and consider its provisions as guidance, and to develop and follow processes and procedures aligned with the current best practices for manufacturing and designing that are applicable to such component or part. Voluntary compliance with the QMSR will provide manufacturers of components or parts of finished devices as a framework for achieving quality throughout the organization.

There is also a potential business impact for manufacturers and suppliers of components and parts to establish state-of-the-art quality systems in conformance with International Standards such as ISO 9001 and/or ISO 13485. Having an ISO certification can be a competitive advantage in securing a highly profitable contract with a medical device manufacturer.

In conclusion

Although, the Quality Management System Regulation (QMSR), due to go into effect in early 2026, explicitly exempts manufacturers of components or parts of a finished medical device, FDA maintains its legal authority to take action as needed.

This should, however, not be the reason for medical device manufacturers to ignore the need to establish robust, and risk-based, supplier quality agreements. Component manufacturers, on the other hand, can benefit from voluntary compliance to regulations and standards to gain a competitive advantage in securing new business with medical device manufactures.

1. Medical Devices; Quality System Regulation Amendments, final rule published in the Federal Register, February 2nd, 2024.

2. See FDA’s response to Comment 2 in the preamble to the final rule on QMSR.

3. FDA: Class I recall, Cardinal Health Recalls Sterile Monoject Luer-Lock and Enteral Syringes Due to a Change in Manufacturing, Updated March 7, 2024.

4. FDA: Class I recall, Becton Dickinson (BD)/Carefusion 303 Recalls Alaris Infusion Pumps Due to Compatibility Issues with Cardinal Health Monoject Syringes, Updated December 19, 2023.

5. FDA: Warning Letter, Cardinal Health, CMS 679404, Issued April 24, 2024.

6. See FDA Warning Letters summary in our Monthly MedTech News Update from April 2024.

7. FDA: Warning Letter, Jiangsu Caina Medical Co., Ltd, CMS 687033, Issued July 18, 2024.

8. See FDA Warning Letters Summary in our Monthly MedTech News Update from July 2024.

9. According to Clause 0.1 of ISO 13485:2016 “The requirements of this International Standard can also be used by suppliers or other external parties providing product (e.g. raw materials, components, subassemblies, medical devices, sterilization services, calibration services, distribution services, maintenance services) to such organizations.