Medical Device Contract Manufacturing (CMO) Selection and Quality Agreements: Complete Guide

Outsourcing Manufacturing Is a Strategic Decision, Not Just Procurement

Medical device original equipment manufacturers (OEMs) increasingly rely on contract manufacturing organizations (CMOs) to manage complex and capital-intensive production. The decision to outsource is driven by access to specialized manufacturing capabilities, speed to market, cost efficiency, and the ability to scale without building internal capacity. But when you transfer manufacturing to a third party, you do not transfer regulatory responsibility. The OEM — the company whose name appears on the product label — remains accountable to the FDA, notified bodies, and every regulatory authority in every market where the device is sold.

The regulatory climate entering 2026 is a no-tolerance regime for contract manufacturing lapses. The FDA expects sponsors to have demonstrable oversight — binding quality agreements, regular audits, incoming material testing, and complete traceability — or face enforcement. This guide covers the complete process of CMO selection, quality agreement negotiation, and ongoing oversight for medical device manufacturers.

CMO Cooperation Models

OEM (Original Equipment Manufacturer) Model

The OEM provides complete design specifications, tooling, and processes. The CMO executes manufacturing exactly as specified. The OEM retains full control over design, materials, and process parameters. This model is best when the OEM has mature design transfers and established manufacturing processes.

ODM (Original Design Manufacturer) Model

The CMO designs and manufactures the device based on the OEM's functional requirements. The CMO contributes design expertise and may suggest materials, components, or process improvements. This model benefits companies new to the medical device industry that want to leverage the CMO's experience.

Hybrid Model

Many companies combine OEM and ODM approaches. They retain critical technology and core processes in-house while outsourcing less critical components or sub-assemblies. This model provides flexibility — the OEM controls what matters most while gaining efficiency on standardized elements.

Contract Manufacturing vs. Contract Development

Regulatory Framework

FDA Requirements (21 CFR Part 820 / QMSR)

The Quality Management System Regulation, effective February 2, 2026, incorporates ISO 13485:2016 by reference. Both the legacy QSR and the new QMSR require documented control over outsourced processes:

• Section 820.50 / ISO 13485 Clause 7.4: Purchasing controls require that suppliers, contractors, and consultants are selected based on their ability to meet specified requirements.
• ISO 13485 Clause 4.1.5: Control of outsourced processes must be identified within the quality management system. The organization retains responsibility for conformity to requirements even when a process is outsourced.
• ISO 13485 Clause 7.4.2: Documented agreements with suppliers must address quality requirements, including communication plans, change notification requirements, and roles and responsibilities.
• FDA Quality Agreement Expectations: While the FDA's formal quality agreement guidance (2016) addresses drug manufacturing, the agency applies the same principles to device contract manufacturing through 21 CFR 820.50 purchasing controls. The FDA expects written quality agreements that explicitly assign responsibilities for process controls, testing, change control, and reporting.

The FDA has reiterated in 2025-2026 enforcement actions that quality agreements must require CMOs to immediately notify the sponsor of any out-of-specification (OOS) results, equipment excursions, or process deviations. FDA warning letters in 2025-2026 have specifically cited sponsors for inadequate quality agreement provisions, insufficient CMO audit programs, and failure to exercise oversight over contract manufacturing changes. The agency treats contract manufacturing oversight as a direct reflection of the sponsor's quality system maturity.

EU MDR Requirements

• Article 16: Manufacturers remain responsible for conformity of devices they place on the market, even when manufacturing is subcontracted.
• Article 14: Importers and distributors have specific obligations when they make devices available on the EU market.
• Annex I GSPR 14.2: Manufacturing processes must ensure reproducibility and conformity, whether performed in-house or by a contract manufacturer.
• Notified bodies audit the sponsor's supplier management system, including quality agreements and audit records, during conformity assessments.

Global Requirements

CMO Selection Criteria

1. Quality Certifications and Regulatory Compliance

The most critical selection criterion. Verify:

• ISO 13485:2016 certification — Current, with scope covering the type of manufacturing you need (sterile, non-sterile, assembly, packaging, labeling)
• FDA registration — Establishment registration and device listing if the CMO will manufacture devices distributed in the US
• MDSAP certification — Required if you sell in MDSAP member countries (US, Canada, Brazil, Japan, Australia)
• Regulatory audit history — Request copies of recent FDA inspections, notified body audit reports, and any warning letters or 483 observations
• Country-specific certifications — KGMP (Korea), BGMP (Brazil), NMPA registration (China) if manufacturing for those markets

2. Technical Capabilities

Evaluate the CMO's capability to manufacture your specific device:

• Manufacturing processes: Do they have the equipment, cleanroom classification, and process expertise you need?
• Sterilization capability: Can they perform or manage ethylene oxide, gamma, e-beam, or steam sterilization?
• Assembly and packaging: Experience with your device's assembly complexity, packaging requirements, and labeling specifications
• Testing capability: In-house testing for in-process controls, final release testing, and stability studies
• Cleanroom classification: ISO Class 5, 7, or 8 as required by your device

3. Supply Chain Management

• Supplier qualification programs and approved supplier lists
• Inventory management systems and real-time visibility
• Multiple sourcing options for critical components
• Business continuity and disaster recovery plans
• Cold chain management if applicable

4. Regulatory Submission Support

Experienced CMOs can provide manufacturing data required for regulatory submissions:

• Process validation documentation (IQ/OQ/PQ protocols and reports)
• Manufacturing process descriptions for technical files and 510(k) submissions
• Batch record templates and production documentation
• Change control records for manufacturing process modifications

5. IP Protection and Data Security

• Confidentiality agreements (NDAs) signed before sharing any proprietary information
• Physical and logical separation of your intellectual property from other customers
• Data encryption, access controls, and audit trails for electronic records
• Background checks on personnel handling your proprietary processes
• IP insurance or contractual indemnification

6. Financial Stability and Business Continuity

• Financial statements and credit reports
• Insurance coverage (product liability, commercial general liability)
• Business continuity plans for manufacturing disruptions
• Succession planning and key person dependencies
• Customer concentration risk (are they dependent on a single large customer?)

7. Cultural Fit and Communication

• Responsiveness during the selection process (a proxy for ongoing communication quality)
• Language capabilities for global operations
• Willingness to adapt to your quality system requirements
• Track record of collaborative problem-solving
• Geographic proximity or time zone compatibility for your team

Quality Agreement: Structure and Requirements

The quality agreement is a legally binding document that governs quality and cGMP-related activities between the sponsor and the CMO. It is distinct from the commercial supply agreement (which covers pricing, volumes, and business terms) and is a focus of regulatory inspections.

Mandatory Elements

Critical Quality Agreement Clauses

Change Control The quality agreement must explicitly require the CMO to notify the sponsor before implementing any change that could affect product quality, process validation, or regulatory filings. This includes:

• Changes to raw materials or components
• Changes to manufacturing equipment or process parameters
• Changes to test methods or acceptance criteria
• Changes to the manufacturing environment (facility modifications, cleanroom changes)
• Changes to key personnel responsible for quality or manufacturing

Final Product Release Define clearly who has authority for final product release. Under FDA regulations, the manufacturer (the entity whose name is on the label) is responsible for approving or rejecting devices. If the CMO performs final release testing, the sponsor must review and approve the batch record before the product enters distribution.

Immediate Notification Requirements The quality agreement should require the CMO to notify the sponsor immediately (within 24 hours) of:

• Any OOS result
• Any critical or major deviation
• Any regulatory inspection or inquiry
• Any product complaint suggesting a serious quality issue
• Any equipment failure affecting product quality

CMO Audit Program

Initial Qualification Audit

Before signing a quality agreement, conduct a comprehensive on-site audit:

• Quality system documentation: Review the quality manual, SOPs, and quality policy for alignment with ISO 13485 and FDA requirements
• Manufacturing capability walkthrough: Verify that equipment, cleanrooms, and processes match what was represented during selection
• Process validation records: Review IQ/OQ/PQ protocols and reports for processes relevant to your device
• Personnel qualifications: Verify training records for operators, quality staff, and management
• Corrective action history: Review open and closed CAPAs for systemic issues
• Supplier management: Review how the CMO manages its own suppliers (your supply chain is only as strong as its weakest link)
• Data integrity: Assess electronic record systems for Part 11 compliance, audit trail integrity, and backup procedures

Periodic Surveillance Audits

Schedule on-site audits at least annually, with additional audits triggered by:

• Significant process or equipment changes
• Recurring deviations or CAPA escalations
• Regulatory inspection findings at the CMO
• Product quality trending indicating potential systemic issues
• Changes in CMO ownership or management

Unannounced Audits

Include the right to conduct unannounced audits in the quality agreement. While rarely exercised, the provision signals that the sponsor takes oversight seriously and provides a mechanism for investigating concerns without giving the CMO time to prepare.

Remote Auditing

Since 2020, remote and hybrid audits have become standard practice. Use remote audits for:

• Document review (SOPs, batch records, training records, CAPA files)
• Process observation via live video walkthrough
• Interview-based assessments of quality culture and personnel competency
• Follow-up on corrective actions from prior audits

Common Pitfalls

1. Insufficient Due Diligence

Selecting a CMO based on price alone without adequate technical and quality assessment. The cost of quality failures — product recalls, regulatory action, market withdrawal — far exceeds any savings from choosing the lowest bidder.

2. Vague Quality Agreements

Quality agreements that do not clearly define responsibilities, notification timelines, and escalation pathways create regulatory risk. Every quality activity should be mapped to a responsible party with no gaps.

3. Inadequate Change Control

Failing to require sponsor approval for manufacturing changes can result in unauthorized process modifications that invalidate regulatory filings. The sponsor may learn about changes only when a product fails in the field.

4. Neglecting Ongoing Oversight

Signing the quality agreement and then never auditing the CMO is a common failure mode. Regulatory inspectors will request audit records, and the absence of documented oversight is a finding in itself.

5. Single-Source Dependency

Relying on a single CMO without a qualified backup creates supply chain risk. If the CMO experiences a quality system failure, natural disaster, or business closure, the sponsor has no alternative manufacturing capacity.

6. Misaligned Quality Cultures

If the CMO's quality culture prioritizes production throughput over compliance, the partnership will generate constant friction. Assess quality culture during the selection audit, not after problems arise.

Step-by-Step CMO Selection Checklist

Phase 1: Requirements Definition

• Define the manufacturing scope (components, sub-assemblies, finished devices)
• Specify required certifications (ISO 13485, MDSAP, FDA registration)
• Identify technical requirements (cleanroom classification, sterilization, testing)
• Establish geographic preferences (proximity to your facility, tariff considerations, regulatory jurisdiction)
• Define volume requirements and growth projections
• Set budget parameters

Phase 2: Candidate Identification and Screening

• Identify 5-10 candidate CMOs through industry networks, trade shows, and directories
• Issue a Request for Information (RFI) covering certifications, capabilities, and references
• Screen candidates based on must-have criteria (certifications, technical capabilities, financial stability)
• Narrow to 3-5 candidates for detailed evaluation

Phase 3: Detailed Evaluation

• Conduct confidential disclosure presentations to share device specifics
• Issue Request for Proposal (RFP) with detailed technical and quality requirements
• Evaluate proposals against weighted scoring criteria
• Conduct reference checks with current medical device clients
• Review regulatory audit history and warning letter status

Phase 4: On-Site Audit

• Conduct comprehensive quality system and manufacturing capability audit
• Evaluate process validation records, training programs, and CAPA systems
• Assess cleanroom conditions, equipment calibration, and maintenance programs
• Interview quality and production leadership
• Document findings and classify observations (critical, major, minor)

Phase 5: Quality Agreement Negotiation

• Draft the quality agreement based on FDA guidance and ISO 13485 requirements
• Negotiate responsibility assignments, notification timelines, and audit rights
• Establish change control thresholds and approval requirements
• Define dispute resolution and agreement termination provisions
• Have regulatory and legal counsel review before execution

Phase 6: Technology Transfer and Qualification

Technology transfer is the highest-risk phase of CMO engagement. A poorly executed transfer can delay market launch by months and create quality issues that persist for the product's lifetime.

• Documentation transfer: Transfer the Device Master Record (DMR), work instructions, specifications, and quality procedures. Verify the CMO's document control system accurately captures all transferred documents.
• Process knowledge transfer: Go beyond documents — transfer process knowledge through on-site demonstrations, joint production runs with your manufacturing engineers present, and documented process parameter rationale.
• IQ/OQ/PQ qualification: Conduct or oversee installation, operational, and performance qualification at the CMO facility. Verify that equipment, tooling, and processes perform equivalently to the original site.
• Qualification batches: Produce at least three consecutive batches and verify product equivalence through comprehensive testing (dimensions, functionality, sterility, biocompatibility as applicable).
• Packaging and sterilization validation: Validate packaging, labeling, and sterilization processes at the CMO.
• Regulatory notifications: File FDA annual report supplements for manufacturing site changes to 510(k) devices. Notify the EU notified body under EU MDR. Allow 60-90 days for regulatory review before commercial production.

Phase 7: Ongoing Oversight

• Establish the audit schedule (annual minimum, plus event-triggered audits)
• Implement quality metric tracking (batch acceptance rates, deviation frequency, CAPA closure timeliness)
• Conduct periodic management reviews of CMO performance
• Review and update the quality agreement annually
• Maintain a qualified backup CMO for supply chain resilience

Cost Considerations

Direct Costs

Indirect Costs

• Internal staff time for CMO management (typically 0.5-1.0 FTE for a single CMO relationship)
• Quality system maintenance for outsourced process oversight
• Travel expenses for on-site audits and technology transfer activities
• Inventory carrying costs (higher safety stock to buffer against CMO disruptions)

Total Cost of Ownership

When evaluating CMO proposals, consider the total cost of ownership — not just the per-unit manufacturing price. A CMO with a 15% lower unit price but frequent quality issues, requiring additional oversight, rework, and potential regulatory action, will cost more in the long run than a higher-priced but more reliable partner.

Key Takeaways

1. Regulatory responsibility does not transfer. The OEM retains full accountability for device quality and compliance, regardless of whether manufacturing is in-house or outsourced.
2. Quality agreements are legally binding and inspectable. They must explicitly define responsibilities, change control requirements, notification timelines, and audit rights.
3. ISO 13485 Clause 4.1.5 and 7.4, plus FDA 21 CFR 820.50, require documented control of outsourced processes. The QMSR effective February 2026 incorporates these requirements by reference.
4. CMO selection should evaluate quality certifications, technical capabilities, regulatory history, supply chain resilience, and cultural fit — not just price.
5. Ongoing oversight through regular audits, quality metric tracking, and annual quality agreement reviews is mandatory. Signing the agreement and walking away is a regulatory and business risk.
6. Maintain a qualified backup CMO to protect against single-source supply chain disruption.