IMDRF Guidance on Supplier Controls for Medical Devices: Overview of QMS Expectations

The International Medical Device Regulators Forum (IMDRF) continues to strengthen global harmonisation of medical device quality management systems (QMS) through updated guidance focused on supplier controls and risk-based oversight.

A major development in this area is the draft guidance titled “Guidance on the Control of Products and Services Obtained from Suppliers ”, published by the IMDRF Quality Management Systems Working Group. The IMDRF draft guidance provides detailed recommendations for medical device manufacturers on establishing, implementing, and maintaining supplier controls within a quality management system.

The guidance applies to:

• Medical device manufacturers

• IVD manufacturers

• Contract manufacturers

• Suppliers and service providers

• Importers and distributors

• Regulatory authorities and auditors

The guidance is intended primarily for educational and harmonisation purposes rather than direct regulatory auditing. The guidance applies to the control of products and services obtained from suppliers throughout the entire lifecycle of medical devices. The document applies to all medical devices, including IVDs and certain combination products regulated as medical devices.

Core Principle: Manufacturers Retain Ultimate Responsibility

One of the most important principles in the guidance is that manufacturers remain fully responsible for their medical devices, even when activities are outsourced.

The IMDRF clearly states that:

• Supplier activities may be delegated

• Certain CAPA activities may involve suppliers

• Independent contractors may perform audits or testing

• Contract manufacturers may produce devices

However, the manufacturer always retains overall regulatory responsibility and QMS accountability.

This principle is highly consistent with global regulatory expectations from FDA, EU MDR, Health Canada, MHRA, and other regulatory authorities.

General Principles of Supplier Control

The IMDRF states that effective supplier management requires a robust purchasing and supplier control process.

Manufacturers are expected to establish documented procedures for:

• Supplier planning

• Supplier selection

• Supplier evaluation

• Supplier approval

• Monitoring and re-evaluation

• Corrective and preventive actions

• Change management

• Risk assessment

The level of supplier control should always be proportional to the risks associated with the supplied product or service.

Six Key Phases of Supplier Control

The guidance identifies six major phases for supplier control processes:

1. Planning

2. Selection of potential suppliers

3. Supplier evaluation and acceptance

4. Establishment of controls and change management

5. Delivery, monitoring, and measurement

6. Feedback, communication, and CAPA activities

The document emphasises that change management must be considered throughout all phases.

Manufacturers should carefully assess supplier quality, operational capability, technological competence, and business reliability.

Supplier evaluation activities may include:

• Supplier questionnaires

• Desktop reviews

• On-site audits

• Remote audits

• Product testing

• Prototype evaluations

• First article inspections

• Review of certifications

• Assessment of supplier QMS effectiveness

The IMDRF cautions manufacturers against relying solely on ISO certification as evidence of supplier capability.

References

• IMDRF Draft Guidance: Guidance on the Control of Products and Services Obtained from Suppliers