Quality assurance agreements between suppliers and manufacturers of medical devices

Regulation (EU) 2017/45 on medical devices (MDR for short) requires manufacturers to have a quality management system and a post-market surveillance system in place, which should be adapted to the risk class and type of device in question. Furthermore, a risk management system and a system for reporting incidents and safety corrective actions in the field must be set up. These high quality and safety requirements for medical devices are intended to dispel general safety concerns about these products in particular.

In addition to this establishment and maintenance of a quality and risk management system, Art. 10 MDR places the following essential additional requirements on manufacturers:

  • Conduct clinical evaluation, including post-market clinical follow-up

  • Preparation and continuous updating of technical documentation

  • Retention of the technical documentation and EU declaration of conformity for at least ten years after the last device has been placed on the market/for implantable devices even for 15 years

  • Creation, application, recording and establishment of the UDI in accordance with Art. 27 MDR

  • Registration obligations (EUDAMED)

The MDR is based on the concept of the responsible manufacturer, i.e. subcontractors or suppliers cannot fulfill the essential obligations of manufacturers, such as the provision of complete technical documentation, in their place.

Manufacturers must therefore fulfill their obligations personally, regardless of the fact that parts of the production are taken over by suppliers. They cannot fulfill their obligation to provide complete technical documentation and/or a quality management system simply by referring to the supplier's technical documentation and/or quality assurance system. Rather, the manufacturer must control the quality of production himself, regardless of the length of the supply chain.

Manufacturers are therefore advised to identify all subcontractors of critical importance and key suppliers and to integrate them into their quality assurance system and conclude quality assurance agreements with them in order to meet the requirements of the MDR.

By defining and delimiting the areas of responsibility and tasks of the manufacturer and supplier, the manufacturer can integrate the process outsourced to the supplier into its quality management system as if it were its own process. In order to ensure efficient control, manufacturer audits may also need to be regulated. Overall, the traceability of raw materials and components should be guaranteed via the QAA.

If the design development, manufacturing, testing or other important work processes are carried out by subcontractors of critical importance or important suppliers, they must also be obliged to accept unannounced audits by the manufacturer's notified body and the competent authorities (see Recommendation 2013/437/EU of 24.09.2013). This obligation must be passed on in the supply chain if necessary.

Confidentiality agreements between manufacturers, contractors and suppliers must ensure that, on the one hand, the confidentiality of business secrets necessary for the business activities of each party involved is maintained and, on the other hand, that the manufacturer is not prevented from complying with the legal requirements placed on him by confidentiality obligations. Therefore, confidentiality agreements or the section in supply or processing contracts relating to confidentiality must be drafted very carefully. Simply copying standard templates would be risky.

Status: 19.03.2020