What Questions Should Procurement Teams Ask About Medical Device Compliance?

Medical device procurement is about more than comparing prices, delivery schedules, and product specifications. Every purchasing decision can affect patient safety, clinical performance, regulatory exposure, operational continuity, and the organization’s reputation. Procurement teams therefore need a structured way to determine whether a device and its supplier meet the requirements that apply to the intended market and use.

The challenge is that medical device compliance cannot be confirmed by asking one broad question such as, “Is this product FDA approved?” Depending on the device, FDA approval may not even be the correct regulatory pathway. Some devices are cleared through the 510(k) process, some are granted marketing authorization through the De Novo pathway, some require premarket approval, and certain lower-risk devices may be exempt from premarket notification requirements.

Registration also has a specific meaning. A company’s establishment registration or device listing does not, by itself, mean that the FDA has approved the facility or product. Procurement professionals must distinguish among registration, listing, clearance, authorization, approval, exemption, and certification.

The right questions help a purchasing organization verify what it is buying, identify gaps before products enter the clinical environment, and establish clear responsibilities if a complaint, recall, cybersecurity vulnerability, or supply disruption occurs. Whether a team is purchasing a simple disposable item or a connected diagnostic system, compliance due diligence should be proportionate to the device’s risk and complexity.

For organizations evaluating medical devices and related supplies, Merit Pharmaceutical can support an informed sourcing process by helping customers obtain relevant product and supplier information. Buyers should still conduct their own risk-based review and involve clinical, quality, regulatory, information security, biomedical engineering, and legal personnel when appropriate.

Key Takeaways

• Procurement teams should verify the device’s exact identity, intended use, risk classification, and applicable regulatory pathway.
• FDA establishment registration and device listing should not be treated as proof that a product is FDA approved or cleared.
• Regulatory documentation should match the model, configuration, software version, manufacturer, and labeling of the product being purchased.
• Supplier qualification should evaluate quality systems, complaint handling, change controls, traceability, storage, distribution, and recall readiness.
• ISO 13485 certification can provide useful evidence of a structured quality management system, but it does not replace FDA requirements or product-specific marketing authorization.
• Connected devices require additional questions about cybersecurity, software maintenance, data protection, and end-of-support plans.
• Compliance review should continue after contract award through performance monitoring, document updates, complaint escalation, and periodic supplier reassessment.

1. What Is The Device, And How Is It Regulated?

Before reviewing certificates or negotiating contract terms, procurement teams need to establish exactly what product is under consideration. A supplier’s general statement that it sells “FDA-registered devices” is not enough to identify the requirements applicable to a particular model.

What Is The Device’s Intended Use?

Ask the supplier to provide the official intended-use statement and indications for use. These should be consistent with the product labeling and, when applicable, its FDA marketing submission.

A product’s intended use helps determine whether it qualifies as a medical device and how it is classified. Two products that look similar may fall under different regulatory requirements because they are intended for different patient populations, clinical settings, anatomical locations, or diagnostic purposes.

Procurement teams should ask:

• What is the device intended to diagnose, treat, monitor, prevent, or mitigate?
• Who is the intended patient population?
• Is the device intended for professional, prescription, over-the-counter, or home use?
• Are there contraindications, warnings, or use limitations?
• Does the proposed clinical use fall within the authorized or legally marketed intended use?

Purchasing a device for an unsupported use can create clinical, training, liability, and risk-management concerns, even when the product is otherwise legally marketed.

What Is The FDA Classification And Product Code?

In the United States, medical devices are generally classified as Class I, II, or III according to risk and the controls necessary to provide reasonable assurance of safety and effectiveness. Procurement should request the applicable FDA regulation number, product code, and device class.

The team can compare this information with the FDA’s official classification and premarket databases. The review should confirm that the classification actually corresponds to the product being offered—not merely to a broadly similar device.

Which Regulatory Pathway Applies?

Ask whether the device is:

• Exempt from premarket notification
• Cleared through a 510(k)
• Granted marketing authorization through the De Novo pathway
• Approved through a premarket approval application
• Marketed under another applicable authorization or exemption

Terminology matters. A 510(k) device is generally described as “FDA cleared,” while a device with an approved premarket approval application is “FDA approved.” De Novo requests receive FDA marketing authorization when granted. Suppliers should not use “approved” as a blanket description for all regulated devices.

If a supplier claims that a device is exempt, request the applicable classification regulation and product code. An exemption from 510(k) submission does not necessarily exempt the manufacturer or product from other regulatory controls, such as registration, listing, labeling, complaint handling, or applicable quality-system requirements.

Can The Supplier Prove The Product Is Legally Marketed?

Once the regulatory pathway is understood, procurement should verify the supporting records. Documents must correspond to the exact device being purchased, including the model, catalog number, configuration, accessories, and software version where relevant.

Can The Supplier Provide The Applicable FDA Submission Number?

For products that require premarket review, request the relevant 510(k), De Novo, or PMA number. Confirm the number in the appropriate FDA database and compare the device name, applicant, intended use, and key characteristics with the supplier’s product.

Pay attention to discrepancies such as:

• A different manufacturer or private-label arrangement
• A model not included within the cited authorization
• An intended use broader than the authorized indications
• Accessories that are not addressed in the underlying submission
• Material product changes introduced after the original authorization
• Software functionality that differs from the reviewed version

A valid submission number belonging to a related product does not automatically establish that every product sold by the supplier is legally marketed.

Are The Manufacturer And Relevant Establishments Registered?

Procurement teams should confirm the identity of the legal manufacturer and determine which organizations manufacture, sterilize, relabel, repackage, import, or distribute the product. Relevant establishments may be subject to annual FDA registration and device-listing requirements.

The FDA’s Establishment Registration and Device Listing database can help verify public registration and listing information. However, the FDA expressly notes that registration, assignment of a registration number, and device listing do not denote FDA approval of the establishment or product.

Accordingly, the team should ask:

• Who is the legal manufacturer?
• Where is the device manufactured?
• Is the product made under contract by another establishment?
• Who performs sterilization, packaging, relabeling, or repackaging?
• If the product is imported, who is the U.S. agent and initial importer?
• Is the device currently listed under the correct manufacturer and product name?

Does The Documentation Match The Supplied Product?

Compare regulatory records with the purchase order, quotation, packaging, labeling, and instructions for use. Model numbers and manufacturer names should be consistent across the documentation.

If a distributor provides the product, procurement should establish whether the distributor is authorized by the manufacturer and how it confirms product authenticity. This is especially important when purchasing high-value products, sterile devices, implants, or devices obtained through secondary distribution channels.

What Quality System Controls Support The Device?

Regulatory authorization addresses whether a device may be legally marketed, but procurement teams must also consider how consistently it is designed, manufactured, handled, and supported.

Does The Manufacturer Follow Applicable Quality-System Requirements?

As of February 2, 2026, the FDA’s Quality Management System Regulation, or QMSR, is effective under 21 CFR Part 820. The regulation incorporates ISO 13485:2016 by reference while retaining applicable requirements under the Federal Food, Drug, and Cosmetic Act and other FDA regulations. The QMSR generally applies to manufacturers of finished medical devices intended for commercial distribution in the United States.

Procurement teams should request an overview of the manufacturer’s quality management system and ask:

• Which facilities and products are covered?
• How are design and manufacturing risks controlled?
• How are nonconforming products identified and handled?
• How are corrective and preventive actions managed?
• How are suppliers and outsourced processes controlled?
• How are quality records retained?
• How does management review quality-system performance?

A supplier may be unable to share confidential procedures or complete audit reports. It should still be able to provide appropriate evidence that a functioning quality system covers the products and activities relevant to the contract.

Is The Manufacturer Certified To ISO 13485?

ISO 13485 certification can indicate that an independent certification body has assessed the organization’s medical device quality management system within a defined scope. Procurement should obtain the certificate and review:

• The organization’s legal name
• The covered site addresses
• The certification scope
• Included or excluded activities
• The issuing certification body
• The certificate number
• The issue and expiration dates
• The certificate’s current status

A certificate covering distribution activities at one address should not be assumed to cover design or manufacturing at another facility.

Certification should also be interpreted correctly. ISO 13485 certification is not a substitute for FDA establishment registration, device listing, applicable marketing authorization, or compliance with U.S.-specific legal requirements. Conversely, not every organization involved in distribution must necessarily hold ISO 13485 certification. The requirement depends on its role, the market, contractual expectations, and applicable regulations.

What Audit Evidence Is Available?

Risk-based supplier qualification may include quality questionnaires, document reviews, remote assessments, or on-site audits. The level of review should correspond to the product’s risk and the supplier’s influence over safety and performance.

Useful questions include:

• When was the facility last inspected by a regulatory authority?
• Were any significant observations or enforcement actions issued?
• Have identified deficiencies been corrected?
• Can the supplier provide a summary of recent third-party audit results?
• Will the supplier permit a customer audit under defined circumstances?
• How will critical findings be communicated to the purchasing organization?

Procurement should coordinate these questions with qualified quality or regulatory personnel. The absence of a public warning letter does not prove full compliance, while a historical inspection observation should be assessed in context, including the supplier’s response and remediation.

How Are Safety, Performance, And Product Changes Controlled?

A compliant product must continue to meet its specifications after purchasing begins. Procurement contracts should therefore address evidence of performance, change notification, and management of nonconforming products.

What Evidence Supports Safety And Performance?

Ask the supplier what testing supports the device’s specifications and intended use. The appropriate evidence will depend on the product and may include:

• Electrical safety and electromagnetic compatibility testing
• Biocompatibility evaluation
• Sterilization validation
• Packaging and shelf-life validation
• Software verification and validation
• Usability or human-factors evaluation
• Mechanical or performance testing
• Cleaning, disinfection, or reprocessing validation
• Clinical or nonclinical evidence

Procurement personnel are not expected to independently reproduce a regulatory review. However, they should confirm that relevant documentation exists and ensure technical experts assess evidence for complex or higher-risk devices.

Standards cited by the supplier should be relevant to the model and test date. The team should determine whether testing covers the final production configuration rather than an earlier prototype.

How Does The Supplier Control Product Changes?

Manufacturers may change components, materials, production sites, sterilization processes, software, packaging, labeling, or suppliers. Some changes are minor, while others can affect safety, performance, compatibility, regulatory status, or clinical workflows.

Ask:

• Which changes require advance customer notification?
• How much notice will the organization receive?
• Who evaluates whether a change requires a new regulatory submission?
• Will the supplier provide updated validation or authorization records?
• Can the purchasing organization reject a materially changed product?
• How are software and firmware versions controlled?
• How will discontinued components or models be managed?

These requirements should be included in the quality agreement or purchasing contract rather than left to informal expectations.

What Are The Shelf-Life And Storage Requirements?

For sterile, temperature-sensitive, chemically reactive, or time-limited products, procurement should verify:

• Labeled shelf life
• Minimum remaining shelf life at delivery
• Required storage temperature and humidity
• Protection from light, moisture, shock, or contamination
• Shipping qualification
• Sterile-barrier and packaging integrity
• Procedures for temperature excursions
• Stock rotation requirements

A legally marketed device can still become unsuitable for use if it is transported or stored outside validated conditions.

How Will Traceability, Complaints, And Recalls Be Managed?

Traceability becomes critical when a safety concern arises. Procurement teams should know whether the organization can identify affected products quickly and prevent further use.

Can Each Device Or Lot Be Traced?

Ask the supplier what identifying information appears on the label and packaging, such as:

• Catalog or model number
• Lot or batch number
• Serial number
• Expiration date
• Manufacturing date
• Unique device identifier
• Manufacturer name
• Sterilization status

The FDA’s Global Unique Device Identification Database serves as a reference catalog for devices bearing UDIs. The publicly accessible information primarily concerns the device identifier portion of the UDI; production-specific information, such as individual lot or serial data, is not stored there. Procurement teams can use AccessGUDID information as one verification resource, where applicable.

The purchasing organization should also determine whether its inventory and clinical systems can capture the identifiers needed for recalls and incident investigations.

What Is The Complaint-Handling Process?

The contract should clearly state where users report suspected malfunctions, injuries, packaging failures, labeling issues, or performance problems.

Ask the supplier:

• Who receives complaints?
• Is support available during all hours when the device is used?
• What information is required when reporting a problem?
• How quickly will the supplier acknowledge and investigate a complaint?
• When will the manufacturer become involved?
• How are replacement products or field service arranged?
• How will investigation findings be communicated?
• Who evaluates whether an event is reportable to the FDA?

Medical Device Reporting obligations generally apply to defined manufacturers, importers, and device user facilities under different circumstances. A purchasing organization should obtain advice specific to its regulatory role instead of assuming that forwarding a complaint to a distributor satisfies every applicable duty.

Is There A Documented Recall And Field-Correction Process?

Procurement teams should ask for the supplier’s recall notification and execution procedures. Essential questions include:

• How are urgent safety notices delivered?
• Who maintains the customer and shipment records?
• Can affected lots, serial numbers, or software versions be identified?
• How quickly can replacement products be supplied?
• Who pays for removal, return, repair, or replacement?
• How are field corrections documented?
• How is recall completion verified?
• What happens if the manufacturer ceases operations?

Teams should also search FDA recall and safety-communication databases during initial qualification and periodically thereafter. The presence of a recall does not automatically disqualify a supplier, but repeated or poorly managed events may indicate elevated risk.

Are Cybersecurity, Software, And Data Risks Adequately Addressed?

A network-connected or software-driven medical device introduces risks that do not apply to an ordinary disposable product. Procurement should involve information security, privacy, biomedical engineering, clinical engineering, and IT teams early in the review.

Is The Device A Cyber Device Or Otherwise Connected?

Determine whether the product connects to hospital networks, mobile devices, cloud platforms, electronic health records, or external service systems. Ask whether it stores, processes, or transmits patient or operational data.

Relevant questions include:

• Which interfaces, protocols, ports, and wireless functions are used?
• Does the device require continuous internet or cloud access?
• What authentication and access controls are available?
• Is sensitive data encrypted in transit and at rest?
• Are audit logs available?
• Can default passwords be changed?
• Can unused services be disabled?
• Does the device support network segmentation?
• Is remote access controlled and logged?

For devices meeting the statutory definition of a cyber device, manufacturers have specific FDA submission and postmarket cybersecurity responsibilities. FDA cybersecurity expectations continue to evolve, so procurement teams should verify the requirements applicable to the device and current software version through the FDA’s medical device cybersecurity resources.

How Are Vulnerabilities And Updates Managed?

A supplier should be able to explain how it identifies, evaluates, communicates, and remediates security vulnerabilities. Ask:

• Does the manufacturer maintain a coordinated vulnerability disclosure process?
• How are customers notified of critical vulnerabilities?
• What are the timelines for patches and mitigations?
• Can updates be deployed without disrupting clinical operations?
• Are updates validated before release?
• Who is responsible for installation?
• Will applying approved security controls affect the warranty?
• Is a software bill of materials available where applicable?
• How are third-party software components monitored?

Procurement should also ask how emergency mitigations will be handled if a patch cannot be installed immediately.

What Is The Supported Life Of The Device?

Purchase price alone can obscure the cost and risk of maintaining a device over many years. Ask for the anticipated service life, software-support period, operating-system dependencies, replacement strategy, and end-of-support policy.

A device that remains physically functional but no longer receives security updates may create unacceptable risk. Contracts should address advance notice of end-of-life and end-of-support dates, data migration, replacement options, and secure disposal.

 What Contractual And Ongoing Oversight Protections Are Needed?

Compliance review should not end when a purchase order is issued. Supplier performance and regulatory status can change, making continuing oversight essential.

Are Responsibilities Clearly Documented?

The purchasing agreement should assign responsibility for matters such as:

• Regulatory documentation
• Product authenticity
• Storage and transportation
• Installation and acceptance testing
• User and technical training
• Preventive maintenance
• Calibration
• Complaint escalation
• Adverse-event cooperation
• Recalls and field corrections
• Cybersecurity updates
• Product changes
• Business continuity
• Record retention
• End-of-life support

If the supplier is a distributor rather than the manufacturer, the agreement should clarify which responsibilities the distributor performs directly and which remain with the manufacturer.

What Evidence Must Remain Current?

Create a compliance file for each critical supplier or product category. Depending on risk, it may contain regulatory database checks, certificates, insurance records, quality agreements, training materials, service documentation, recall contacts, and cybersecurity records.

A practical review schedule might include the following:

Review frequency should reflect device class, patient risk, purchase volume, technological complexity, supplier performance, and the difficulty of obtaining substitutes.

What Happens If Compliance Status Changes?

Contracts should require prompt notification if the supplier or manufacturer experiences events that could affect the purchased product. Examples include:

• Suspension, withdrawal, or expiration of a relevant authorization or certificate
• FDA inspection findings or enforcement actions affecting the product
• A recall, safety notice, or field correction
• A major manufacturing-site or process change
• Loss of an essential supplier
• A cybersecurity incident
• A product discontinuation
• A change in ownership or legal manufacturer
• A significant interruption in supply

Procurement should establish escalation criteria before an incident occurs. Depending on the risk, the organization may pause orders, quarantine inventory, request a corrective-action plan, identify substitutes, or terminate the relationship.

Supplier scorecards can integrate delivery, quality, complaint, recall, service, and compliance performance. A supplier that consistently ships on time but fails to communicate safety issues should not be considered a strong performer.

Conclusion

Medical device compliance requires more than collecting an FDA registration number or a quality certificate. Procurement teams must determine exactly what product they are purchasing, how it is regulated, whether it is legally marketed, who manufactured it, and what controls protect its quality throughout the supply chain.

The most effective review combines regulatory verification with supplier qualification, technical evaluation, traceability planning, cybersecurity assessment, and clear contractual responsibilities. The depth of due diligence should be proportional to the device’s risks. A low-risk nonsterile accessory may require a simpler review than an implant, life-supporting system, sterile device, or connected diagnostic platform.

Procurement is also an ongoing process. Regulatory status, manufacturing arrangements, software versions, safety information, and supplier performance may change after the initial purchase. Periodic reassessment helps healthcare organizations identify emerging risks and respond before those risks interrupt care.

Merit Pharmaceutical understands that customers need clear, accurate product information when evaluating medical devices and supplies. By asking focused compliance questions and verifying the supporting evidence, procurement teams can make better-informed purchasing decisions while supporting patient safety, operational reliability, and responsible supply-chain management.

Frequently Asked Questions

1. Is FDA Registration The Same As FDA Approval?

No. FDA establishment registration and device listing do not mean that the FDA has approved the establishment or its products. Depending on the device, lawful marketing may involve 510(k) clearance, De Novo authorization, PMA approval, or an applicable exemption. Procurement teams should verify the pathway for the specific product.

2. Should Every Medical Device Supplier Have ISO 13485 Certification?

Not necessarily. Whether certification is required depends on the supplier’s role, applicable markets, contractual obligations, and the customer’s qualification criteria. ISO 13485 certification can provide useful quality-system evidence, but its scope must cover the relevant locations and activities. It does not replace applicable FDA requirements.

3. What Documents Should Procurement Request From A Medical Device Supplier?

Depending on risk, procurement may request regulatory submission details, establishment and listing information, current certifications, product labeling, instructions for use, test or validation summaries, sterilization information, shelf-life records, cybersecurity documentation, recall procedures, and evidence of authorized distribution.

4. How Can Procurement Verify Whether A Device Is Legally Marketed?

Start by identifying the product code, classification, manufacturer, intended use, and applicable pathway. Search the relevant FDA databases and compare the public records with the model and labeling being offered. Quality or regulatory specialists should investigate inconsistencies before the purchase is approved.

5. How Often Should Medical Device Suppliers Be Reevaluated?

There is no single interval appropriate for every supplier. Reevaluation should be risk-based and may be triggered by certificate expiration, product changes, complaints, recalls, enforcement actions, cybersecurity events, declining performance, or changes in the manufacturing or distribution chain.

6. What Should Procurement Ask About A Connected Medical Device?

Ask about network architecture, data handling, authentication, encryption, logging, vulnerability disclosure, software updates, third-party components, remote access, expected support life, and end-of-support plans. Information security and biomedical engineering teams should participate in the review.

7. Who Should Be Involved In Medical Device Compliance Review?

The appropriate group may include procurement, clinical users, quality assurance, regulatory affairs, risk management, biomedical or clinical engineering, infection prevention, information security, privacy, supply-chain personnel, and legal counsel. Cross-functional review is especially important for high-risk, sterile, implanted, or connected devices.