Medical-device manufacturers seeking ISO 13485:2003 certification must undergo a review of their entire quality system. At the same time, all outsourced processes must also be reviewed, including the subcontractors' quality systems and controls. As a result, it is becoming more appealing for subcontractors to comply with ISO 13485 or hold their own certification.

To understand this trend's origin, look to the ISO 13845 standard as well as three European directives relevant to the medical-device industry. The approval and marketing of medical devices is regulated by 90/385/EEC Active Implantable Medical Devices, 93/42/EEC Medical Device Directive, and 98/79/EC In-Vitro Diagnostic Devices. In many cases, these directives require manufacturers to have a quality management system in place before a product can be released into an EU member's market. ISO 13485:2003 fits into this regulatory landscape by assuring authorities a manufacturer has indeed developed and implemented a quality management system.

Under the three European directives, approval by a notified body permits CE marking and the subsequent sale of a medical device in the European Union. The directives refer to this critical point of compliance as “control of the supplier.” In fact, a clause states that during this certification process, a notified body must review the manufacturer's management (or “controls”) of its service and parts suppliers.

In addition, Section 7.4 of ISO 13485:2003 explains the “Purchasing” requirements. In effect, if one manufacturer purchases a critical component from another manufacturer, that subcontractor has to comply with the established regulations as well. Accordingly the subcontractor either has to produce documentation to support its certification or will need a site audit in order to secure the proper certification to ensure compliance.

Subcontractor quality is also referenced in the standard's guidance document ISO/TR14969 “Medical devices — Quality management systems — Guidance on the application of ISO 13485:2003,” which assessment bodies follow during ISO 13485:2003 audits. Section 7.4.1.2 says that “supplier evaluation can include, among other things, an audit or a certification of the supplier's quality management system.” In other words, some businesses involved in the medical-device's development must also adhere to the EU's strict quality requirements.

There are several ways ISO 13485 certification can benefit the supply chain. First, it lets subcontractors remain competitive and attract potential customers looking to outsource a particular part or process. Second, it can also save the subcontractor time and labor costs associated with on-site audits. For both the subcontractor and manufacturer, certification can tremendously help the bottom line.

Finally, a subcontractor that is already certified can be an asset during the manufacturer's own certification process, as this assures the assessment body that the subcontractor's quality system is compliant. This eliminates additional reviews, which can delay the manufacturer's certification process.

A subcontractor without proof of quality-system compliance, however, may require an audit. The time required to review a company's system is based on the supplier's size and the scope of its services to the manufacturer. Situations vary but, ultimately, being audited to meet a customer's requirements can place a great deal of stress and strain on an operation. Nevertheless, the impact of any delay can be felt throughout the entire supply chain.

For the global medical-device manufacturer, time to market is critical and a subcontractor who is not certified can draw out the product timeline. Supply-chain certification certainly helps ease a manufacturer's path to ISO 13485 certification. Not to be overlooked are the multiple benefits this certificate offers the supply chain. ISO 13485:2003 can reinforce a subcontractor's quality management system, serve to help maintain loyal customers, and ultimately attract new business.