Medical device applications: ISO 13485, validation and cleanroom supply

What makes medical supply different

A medical component is often a simple metal or plastic part. What makes it medical is the chain of evidence around it. The material has to be traceable, the process has to be validated, the environment has to be controlled and the records have to show that the part was made the way it was approved.

That changes the cost structure. A validated moulding process needs a longer launch, more documentation and a quality agreement that covers change. A machined component for a surgical instrument may need a cleanroom for final cleaning and packing, even if the machining itself is conventional.

It also changes the supplier relationship. A medical buyer cannot simply move a part to a cheaper source without repeating the validation. The switching cost is high, which makes the first supplier choice more important than the first price.

ISO 13485 and the scope of the certificate

ISO 13485 is the quality management standard for medical devices. It requires a documented quality system, risk based processes, control of records, validation of processes and control of suppliers. It does not replace the regulatory approval of the device, which sits with the device manufacturer or the legal manufacturer.

The certificate carries a scope. It names the site and the activities covered, such as the manufacture of machined components or the moulding of plastic housings. A certificate for one activity does not cover another, and a certificate for a trading office does not cover a factory.

Check the certification body, the expiry and the scope. Then check whether the supplier's quality manual and procedures actually cover the part you are buying. A certificate is the entry ticket, not the audit.

Risk management to ISO 14971

ISO 14971 sets out the risk management process for medical devices. The manufacturer identifies hazards, estimates and evaluates risk, and controls it. The controls may sit in the design, in the process, in the inspection or in the labelling.

For a component supplier, the relevant output is the link between a risk and a control. If a burr on a machined edge is a hazard, the control might be a deburring process, an inspection or a design change. The supplier should know which characteristics are critical and why, not only that they are tight.

That link is what a buyer should test in a supplier review. Ask which features are critical to quality, what could go wrong if they drift, and how the process prevents it. A supplier that answers with a tolerance table but no failure mode is not thinking about risk.

Process validation: IQ, OQ and PQ

Process validation shows that a process consistently produces a part that meets its specification. The conventional sequence is installation qualification, operational qualification and performance qualification. Each stage has an output that the next stage depends on.

Installation qualification confirms that the equipment and the services are installed as specified. Operational qualification challenges the process across its operating window and identifies the critical parameters. Performance qualification runs the process under normal conditions, with the normal operators and the normal material, and shows that the output meets the specification over a run.

The validation is specific to the process, the equipment, the material and the part. A change to any of them can require a revalidation. That is why the change notification clause matters: a supplier that changes a mould insert, a cleaning agent or a heat treat cycle without telling the buyer can invalidate the validation without knowing it.

Cleanroom and contamination control

A cleanroom is classified by the number of particles above a stated size in a volume of air. ISO 14644 sets the classes, and a medical supplier may run an ISO 7 or ISO 8 area for moulding, assembly or packing. The class is only meaningful with the monitoring that proves it is maintained.

Contamination control also covers people, garments, tools and material transfer. A cleanroom with a good air handling system and a weak gowning procedure is not a cleanroom. Ask for the particle monitoring records, the gowning qualification and the cleaning schedule.

For a machined or stamped part, the cleanroom may be needed only for final cleaning and packing. That is a smaller investment and a common arrangement. The buyer should confirm where the cleanroom boundary sits and which operations happen inside it.

Materials and biocompatibility

Material choice in a medical part is driven by the application, the sterilisation method and the contact duration with the patient. The ISO 10993 series sets out the biological evaluation, and the tests depend on the nature and duration of contact.

The supplier's role is usually to provide material certificates, process history and change control, not to run the biological evaluation. That sits with the device manufacturer. But the supplier has to buy the right grade, keep it clean and avoid substitutions.

Watch for the small substitutions that look harmless. A lubricant, a release agent, a cleaning solvent or a colourant can change the biological profile. A supplier that swaps a lubricant to fix a sticking problem without telling the buyer has changed the product.

Records that follow the part

A medical device manufacturer keeps a device master record, a device history record and a design history file. The supplier feeds the device history record with lot or batch records that show the material, the process, the inspection and the release.

Unique device identification adds a labelling requirement in many markets. The supplier may print or verify the identifier, or may simply supply the data that the manufacturer uses. The requirement belongs in the drawing and the quality agreement, not in an email at the end of the project.

Retention periods are long. Ask how the records are stored, how they are retrieved and what happens if the supplier changes ownership. A record that cannot be produced is a record that does not exist.

• Lot or batch record with material heat numbers
• In-process and final inspection results
• Validation status at the time of production
• Cleanroom and environmental monitoring records
• Deviation and non conformance records
• Release signature and date

Supplier control and change notification

The device manufacturer is responsible for the supplier, even when the supplier holds a certificate. That means the manufacturer has to approve the supplier, define the controls and monitor performance. A quality agreement is the usual tool.

The agreement should cover the specification, the inspection, the records, the change notification, the right to audit and the handling of a non conformance. It should also say who owns the tooling and what happens on transfer.

Change notification is the clause that earns its keep. Define what counts as a change: material, process, site, equipment, software, cleaning agent, packaging. Then define the notice period and the approval process. A supplier that notifies early is protecting both sides.