The Medical Device Regulation (EU) 2017/745 puts great emphasis on the legal responsibility for the final device being that of the legal manufacturer. However, achieving MDR certification will nearly always depend to some extent on a manufacturer having a dependable supplier; one who knows of the regulatory obligations which apply to manufacturers wishing to CE mark medical devices in compliance with the medical device regulation EU 2017/745. It is therefore worth asking ourselves what a strong manufacturer-supplier relationship looks like. It takes more than the existence of a documented supplier agreement for there to be a strong relationship. Here are some of the traits I believe characterise a strong manufacturer-supplier relationship, along with references to applicable parts of the MDR:
1) MDR proficient parties
Mutual understanding of the regulations by both parties, recognising where the supplier as well as the manufacturer fits in (MDR Annex II & Annex VII 4.5.2)
From a legal perspective, liability and responsibility for guaranteeing the safety and performance of a medical device lies solely with the legal manufacturer. However, the medical device’s actual safety and performance are very much dependent upon the ability of the manufacturer’s suppliers to produce components, or supply materials which contribute towards, and complement the overall requirement for safety and performance of the final device to be guaranteed. Even the seemingly simplest of devices, e.g. a medicine spoon, can involve the use of multiple suppliers and subcontractors to achieve the final product. The MDR puts an onus on the legal manufacturer, but also, expects the manufacturer to ensure any outsourced production activities to critical suppliers or subcontractors are controlled in accordance with the same quality management standards as per those applicable directly to the legal manufacturer.
Furthermore, in the case of devices certified by a Notified Body, the MDR requires the manufacturer to ensure the critical suppliers/sub-contractors agree to grant the manufacturer’s Notified Body access to their production facilities, for the purpose of on-site audits of the supplier’s QMS and production processes, where deemed necessary, or to carry out unannounced audits at the supplier’s premises.
An agreement between manufacturer and supplier will help ensure both parties’ responsibilities and levels of access are clearly defined and committed to.
2) Awareness of the manufacturer’s obligations
A joint appreciation of the unique obligations and responsibilities of the manufacturer (Article 10)
Manufacturers are legally responsible for building the QMS to effectively produce and deliver the final devices. They are also responsible for compiling the technical file: the proof of how all the General Safety and Performance requirements, and other applicable requirements of the MDR, have been fulfilled.
However, unless the supplier of the materials used to manufacture our medicine spoon is aware of the MDR requirement for the manufacturer to document a biological evaluation for the final device, the supplier might neglect to document or provide the information on the chemistry of the plastic, such as the MSDS, or the formulation of the materials used in the medicine spoon. Sadly, this will, in turn, compromise how comprehensive any biological evaluation of the medicine spoon the manufacturer documents, can be.
Suppliers and subcontractors hold valuable technical and quality information which need to be understood within the context of what they can contribute to MDR technical and quality compliance.
3) Pace with the current state-of-the-art
Mutual acceptance that, at times both parties need to act in a timely manner to support the demonstration of safety and performance of the device in question (MDR Article 10 section 9 para 1)
QMS audits and technical file reviews often involve requests for provision of data to demonstrate compliance with regulatory requirements. It is therefore important that there is experience handling such requests by both parties. Often the format in which the data is provided to the Notified Body auditor or technical file reviewer has as much influence on a positive/negative conclusion as the content of the data. A good supplier relationship will be manifested in part in the ability of both parties to understand, and then respond, often at pace, to technical, quality and regulatory requests, for activities which they have each been overseeing or responsible for undertaking.
4) Safeguarding of effective record keeping
The relationship involves a symmetrical commitment from both parties to document and data retention (MDR Annex IX section 7)
Legal manufacturers are required to retain critical QMS and technical documentation for at least 10 years after the last device has been placed on to the market. In practice, this means that for certain key data, the MDR expects records to be maintained for a retention period which is well beyond the retention period recognised in the ISO 13485:2016 standard. Indeed the EU’s expectations as regards retention of documents as detailed in the MDR is globally one of the most stringent across the international medical device web of legal frameworks. This is positive for consumer protection, and safeguarding of public health. However unless these stringent document and data retention practices are reciprocated by the manufacturers’ suppliers and subcontractors for applicable data and documents they hold, a gap appears in the document and data retention process, leading to supplier held data being lost or destroyed before the 10 years minimum retention period has passed.
As well as including mirrored commitments to document retention periods in line with MDR requirements, a good supplier relationship will involve actual processes and measures implemented at manufacturer and supplier production facilities to ensure documents and data are retained in line with MDR retention periods.
5) The ability to go beneath the surface
Mutual appreciation for the depth of scrutiny introduced by the MDR (MDR Annex I)
Whilst there are completely new elements which the regulation introduces, like, a publicly accessible Eudamed Database, UDI, and recognition of special obligations for importers and distributors, the vast majority of regulation increases the depth of evidence needed by the manufacturer to prove the safety and performance of the medical device they make and sell, rather than introducing new technical and quality regulatory requirements.
It is therefore more important than ever that the technical data in particular, produced by suppliers and manufacturers is reviewed against MDR GSPRs, other requirements, harmonised and international standards, and is verified as being of sufficient depth. Examples of where sufficient detail can be important:
- Material formulations identifying not just constituents, but also quantities and REACH status transparently
- Test reports not just stating the test method and results, but also detailing calibration status of test equipment at the time of verification testing
- Production records not just identifying the product, but furthermore demonstrating unambiguous traceability between products in the technical file, production records and purchased materials.
6) Commitment to MDR compliant Quality Management
The suppliers’ QMS is separate and distinct from the manufacturers’ QMS. But the MDR effectively judges each against the same standard (MDR Article 10 section 9)
When a manufacturer chooses to purchase in materials or outsource production activities of a medical device or component to a third-party supplier or subcontractor, they are required to ensure that they control the supplier/subcontractor so that the supplier carries out their activities in a manner which ensures the final device meets all the applicable requirements of the MDR. This often means that the supplier needs to have their own quality management system in place, to address issues like contamination control, traceability, or control of non-conforming product.
Suppliers who hold a Quality management certificate such as ISO 9001 or ISO 13485:2016, from an accredited certification body have demonstrated transparently their dedication to, and understanding of good quality management. Specifically, suppliers with an ISO 13485:2016 QMS certificate, issued from an accredited Certification body have demonstrated their in depth understanding, and compliance with the rigorous quality management activities which are required by the ISO 13485:2016 standard, which in turn is harmonised to meet the Quality management requirements of the Medical device regulation. A supplier with a certified Quality management system, coupled with a comprehensive, written and mutually agreed supplier agreement, can therefore signal a good medical device component supplier and will be well prepared for any inspections they may be subjected to such as Notified Body audits, or supplier audits.
Like any effective and long-lasting relationship, manufacturers and suppliers will benefit from effective communication and a commitment to cooperation throughout inevitable changes. A Supplier agreement should set out clearly the expectations of each party and involve mutual MDR correlated document retention and post-market surveillance data sharing practices also to allow both parties to improve their service and product delivery. Implementing such measures will ensure the supplier and manufacturer are both on the same page and speaking the same language.
