ISO 13485: Outsourced Manufacturing, Sterilisation and Device Changes
Medical device quality system scope depends on who designs the device and where critical processes occur. Product conformity and management system certification also serve different purposes.
Questions for your situation
Is an ISO 13485 certificate sufficient to market a device with CE marking?
Not by itself. The certificate concerns a quality system within its stated scope. Determine product legislation separately from intended use, classification and target market. Technical documentation, clinical or performance evaluation and the applicable conformity route are device-specific. Quotations should distinguish quality system certification from product assessment outputs.
How is scope established when another company designs and manufactures products sold under our brand?
Determine your legal role in the target market and control over design first. Outsourcing agreements should address specifications, change approval, traceability and complaint sharing. Plan access to technical information and records if suppliers change. A contractor's certificate does not automatically assume the quality and product responsibilities you hold.
Does outsourcing sterilisation end our validation responsibilities?
No. Evidence must establish suitability for your device, packaging and load configuration. Define process parameters, batch acceptance, change notification and record access contractually. A report covering another product family does not establish coverage for yours. Reassess evidence when materials, packaging or loading arrangements change.
Does changing only the packaging supplier require a change assessment?
Examine effects on the sterile barrier, shelf life, transport resistance and label legibility. Identical dimensions and material names do not guarantee equivalent performance. Alongside supplier approval and incoming checks, determine comparison, testing or revalidation needs. Check separately whether notification to the relevant product assessment body is required.
How are post-market complaints distinguished from reportable incidents?
Record and assess each complaint using device, batch, event date and user effects. Reporting decisions depend on the target market's device legislation; a satisfaction score is insufficient. Where serious risk is possible, protective action and reporting assessment should not wait for completed root cause analysis. Retain the decision rationale and responsible role.
How should renewal be scheduled when a new device family is being added?
Identify renewal of the current scope and assessment of the new family separately in the application. Technology, sterility, design activities and critical outsourced processes affect audit planning. Allow time for preparation and operating evidence. Do not assume the existing certificate covers new products before the scope decision is completed.
Share the subject, organisation or product, target market, current evidence and target date. The team can then separate consultancy, official fees, independent evaluation and realistic timing.