FDA GMP Purchasing Controls

Manufacturers distributing finished devices in the U.S. must manage purchasing and suppliers in conformance with ISO 13485:2016

21 CFR Part 820GMP ComplianceQMSR RequirementSince 2009

Purchasing Controls & Supplier Management Under the FDA QMSR (ISO 13485:2016, Clause 7.4)

For medical device manufacturers, how you select and oversee suppliers is now governed by the FDA’s Quality Management System Regulation (QMSR), in force since February 2, 2026 and replacing the former Quality System Regulation (QSR). The purchasing requirements that once lived in Subpart E (§820.50) of 21 CFR Part 820 are now drawn from ISO 13485:2016, Clause 7.4 (Purchasing) — spanning the purchasing process (7.4.1), purchasing information (7.4.2), and verification of purchased product (7.4.3) — incorporated into the regulation by reference through §820.10. Manufacturers distributing finished devices in the U.S. must manage purchasing and suppliers in conformance with ISO 13485:2016, alongside the FDA-specific requirements the QMSR retains.

Because the quality of a finished device depends heavily on its components, materials, and outsourced processes, strong purchasing controls are central to compliance and patient safety. LMG offers experienced supplier management, QMS, and cGMP consulting to help you establish, document, and maintain a purchasing system that meets the QMSR and ISO 13485:2016. Our support includes:

Supplier qualification criteria
Supplier evaluation and approval procedures
Purchasing documentation requirements
Receiving inspection procedures
Supplier performance monitoring

LMG assists medical device manufacturers with GMP gap assessments, document development, and audit preparation for all 21 CFR Part 820 subsystems.

Frequently Asked Questions

Common questions about FDA QMSR Purchasing Controls.

Do I have to audit every supplier under the QMSR?

No. ISO 13485:2016 Clause 7.4 is risk-based, so the depth of control should match the risk the purchased product poses to the finished device. A supplier of a critical component or an outsourced sterilization process warrants tighter qualification and oversight than a supplier of low-risk consumables. An on-site audit is one tool, but evaluation can also rely on questionnaires, certifications, performance history, or sample testing — the key is that your approach is documented and justified by risk.

My suppliers aren't ISO 13485 certified — is that a problem?

Not automatically. The QMSR holds you, the device manufacturer, responsible for ensuring purchased product meets your specified requirements; it doesn’t mandate that every supplier hold ISO 13485 certification. What matters is that you qualify suppliers appropriately, define purchasing requirements clearly, verify what you receive, and monitor performance over time. Certification can simplify qualification, but its absence just means you carry more of the verification burden yourself.

What's actually different from the old §820.50 purchasing controls?

Conceptually, not much — both require qualifying suppliers, documenting purchasing requirements, and verifying purchased product. The shift is in framing and terminology: ISO 13485 Clause 7.4 emphasizes a risk-proportionate approach more explicitly, uses terms like “purchasing information” and “verification of purchased product,” and expects defined criteria for evaluation, selection, monitoring, and re-evaluation. Most QSR-compliant purchasing systems transition with procedure updates and re-referencing rather than a wholesale rebuild.