Contract Packaging Vendor Qualification for Medical Devices: ISO 11607 Compliance, Audit Approach, and Quality Agreement

Why Contract Packaging Vendor Qualification Demands Rigor

Packaging failures are among the most frequent causes of medical device recalls. When a sterile barrier system loses integrity, when a seal weakens during distribution, or when a label carries the wrong UDI, the consequences extend directly to patient safety. For medical device manufacturers who outsource packaging operations — which is the majority of the industry — the contract packaging vendor becomes a critical extension of the manufacturer's own quality system. That vendor handles the last manufacturing step before the device ships to a hospital or distributor. A mistake at this stage is invisible to the device manufacturer until it becomes a recall.

Contract packaging in the medical device context is fundamentally different from contract packaging in consumer goods. Medical device packaging must maintain sterility (for sterile devices), protect the device through distribution stresses documented under ASTM D4169, support accurate labeling including UDI compliance per 21 CFR 830 and EU MDR Article 27, and survive shelf life durations validated under ASTM F1980. The packaging vendor must understand ISO 11607 Part 1 and Part 2, must maintain validated sealing processes, must coordinate with sterilization providers, and must operate within a quality management system that satisfies ISO 13485 and FDA QMSR requirements.

Qualifying a contract packaging vendor means assessing all of these capabilities before granting them approval, then maintaining oversight through quality agreements, periodic audits, and performance metrics. This guide covers every dimension of that qualification process: selection criteria, audit methodology, ISO 11607 validation capabilities, sterile barrier system expertise, seal process controls, labeling and UDI compliance, sterilization coordination, quality agreement clauses, deviation handling, and ongoing vendor management.

Regulatory Framework Governing Contract Packaging

ISO 13485:2016 — Purchasing Controls and Sterile Barrier Requirements

ISO 13485 is the quality management system standard that FDA now incorporates by reference through the Quality Management System Regulation (QMSR, effective February 2, 2026). Two sections are most relevant to contract packaging vendors:

Clause 7.4 — Purchasing requires the device manufacturer to establish documented procedures for evaluating, selecting, monitoring, and re-evaluating suppliers based on risk. For a contract packaging vendor, this means the manufacturer must define what capabilities the vendor needs, evaluate the vendor against those criteria, document the evaluation, and continue monitoring the vendor on an ongoing basis. Clause 7.4.2 requires that purchasing information — which includes the quality agreement, specifications, and work orders — clearly describe the product and services to be provided, including specifications, process requirements, quality management system requirements, and requirements for change notification.

Clauses 7.5.5 through 7.5.7 address sterilization processes and sterile barrier systems specifically. Clause 7.5.5 requires documented procedures for product cleanliness and, where applicable, sterility. Clause 7.5.6 requires validation and approval of sterilization processes. Clause 7.5.7 addresses records of sterilization processes. While sterilization is often performed by a separate vendor from the packaging vendor, the two processes are deeply intertwined — the packaging vendor's sterile barrier system must be compatible with the chosen sterilization modality, and the vendor must understand how their packaging performs through the sterilization cycle.

ISO 11607-1:2019 — Materials and Sterile Barrier System Requirements

ISO 11607 Part 1 establishes requirements for materials, preformed sterile barrier systems, and packaging systems for terminally sterilized medical devices. This is the standard that governs what the packaging is made of and how it is designed. A qualified contract packaging vendor must demonstrate competence in the following Part 1 requirements:

Material qualification. All packaging materials — pouch films, Tyvek lids, tray materials, adhesives, inks, and coatings — must be qualified for their intended use. This includes demonstrating biocompatibility (ISO 10993 where there is patient contact or fluid pathway exposure), confirming material compatibility with the sterilization process (ethylene oxide residuals, radiation dose effects on polymer properties, steam temperature tolerance), and establishing that materials meet defined specifications for thickness, tensile strength, puncture resistance, and microbial barrier performance.

Sterile barrier system (SBS) design. The vendor must understand how to design or select a sterile barrier system appropriate for the device. This means considering device geometry and weight, sterilization method constraints, distribution stresses, clinical use requirements (peel-open vs. tear-open), and shelf life targets. A vendor who merely assembles pouches from pre-cut materials without understanding SBS design principles is a higher-risk partner than one who can evaluate and optimize barrier system performance.

Stability testing coordination. Shelf life validation requires accelerated aging per ASTM F1980 followed by performance testing of aged samples, with real-time aging running in parallel. The contract packaging vendor must be able to provide samples for aging studies, maintain traceability of aged samples, and support the device manufacturer's shelf life validation protocol.

ISO 11607-2:2019 — Forming, Sealing, and Assembly Process Validation

ISO 11607 Part 2 addresses the validation of the processes that create the sterile barrier: forming trays, sealing pouches or lids to trays, and assembling multi-component packaging systems. This is where many contract packaging vendors either demonstrate excellence or reveal critical gaps. Part 2 requires:

Installation Qualification (IQ) — verifying that the equipment (sealing machines, forming equipment, labelers) is installed correctly per manufacturer specifications, that utilities (compressed air, electrical, cooling) meet requirements, and that calibrated instruments are in place.

Operational Qualification (OQ) — establishing process parameter windows (sealing temperature range, pressure range, dwell time range) that produce acceptable seals, and demonstrating that the process produces consistent output across the full range of acceptable parameters. OQ typically uses challenge conditions (minimum and maximum parameter settings) to prove the process window.

Performance Qualification (PQ) — demonstrating that the process consistently produces acceptable output under routine operating conditions with production materials, operators, and shift variations. PQ requires multiple consecutive successful runs to establish statistical confidence.

A contract packaging vendor who cannot produce complete IQ/OQ/PQ documentation for their sealing and forming processes is not qualified. Period. There is no regulatory pathway to waive this requirement.

FDA QMSR and 21 CFR 820

The FDA's Quality Management System Regulation, which took effect on February 2, 2026, adopts ISO 13485:2016 as the base quality system requirement for medical device manufacturers in the United States. This means that FDA investigators will evaluate purchasing controls and process validation against the ISO 13485 framework. However, the FDA retains supplemental requirements, and investigators carry decades of enforcement precedent from the original Quality System Regulation (21 CFR 820).

The key FDA requirements relevant to contract packaging include:

Process validation (now aligned with ISO 13485 clause 7.5.6). Packaging and sealing processes for sterile devices must be validated. FDA investigators routinely request validation protocols and reports during facility inspections. If your contract packaging vendor performed the validation, the FDA expects your firm to have reviewed and approved those protocols and reports.

Purchasing controls (now aligned with ISO 13485 clause 7.4). You must evaluate and select contract packaging vendors based on their ability to meet your requirements. You must document that evaluation. You must maintain an approved supplier list. You must communicate requirements through purchasing documents and quality agreements.

Device master record and device history record (21 CFR 820.181 and 820.184). Packaging specifications, labeling specifications, and process parameters belong in the device master record. Each production batch must generate a device history record documenting that the packaging and labeling were completed per the DMR. If a contract packager generates these records on your behalf, your quality agreement must specify how those records are created, reviewed, and made available to you.

Labeling controls (21 CFR 820.120). Labeling operations must be controlled to prevent mix-ups. This includes label verification, storage of blank and printed labels, and records of labeling operations. At a contract packager, these controls must be demonstrably in place and auditable.

EU MDR Requirements

The EU Medical Device Regulation (MDR 2017/745) imposes additional requirements on device manufacturers regarding packaging and labeling:

Article 10(9) requires manufacturers to have a quality management system that covers, among other things, supplier and subcontractor control.

Article 10(14) requires manufacturers to ensure that subcontractors comply with the manufacturer's quality management system requirements.

Article 27 establishes the UDI system, requiring that devices bear a UDI carrier on their packaging. The contract packager must be capable of applying and verifying UDI labels per the GS1, HIBCC, or ICCBBA standards.

Annex I, Section 11.3 requires that the packaging and label information be clear, legible, and remain intact during transport and storage.

Annex II, Section 6 requires that technical documentation include results and analyses of all validation tests, which includes packaging validation data.

Vendor Selection Criteria

Distinguishing Assembly-Only Vendors from Design-and-Validation Vendors

Not all contract packaging vendors are the same, and the first step in vendor qualification is understanding what type of vendor you need. The market divides broadly into two tiers:

Assembly-only vendors execute packaging operations per your specifications. They seal pouches, form trays, apply labels, and kit components according to work instructions and drawings you provide. They operate equipment that you or they have validated (though the validation must still be complete). They do not design packaging, select materials, or develop validation protocols. These vendors are appropriate when your own packaging engineering team has already completed the design and validation work and you simply need execution capacity.

Design-and-validation vendors provide packaging engineering services in addition to execution. They can recommend packaging configurations, select and qualify materials, develop ISO 11607 validation protocols, perform ASTM testing (seal strength, integrity, accelerated aging, transport simulation), and deliver a complete packaging validation package. Firms like Packaging Compliance Labs (PCL), PRO-TECH Design, and some divisions of Arterex and Remington operate in this space. Some vendors also offer pre-validated packaging solutions (such as CompliancePack configurations) that can significantly accelerate launch timelines for companies without dedicated packaging engineering resources.

The distinction matters because it determines what you are auditing for. An assembly-only vendor needs robust process execution controls, trained operators, and strict adherence to your specifications. A design-and-validation vendor needs deep packaging engineering expertise, validated test equipment, and the capability to own validation protocols. The audit approach and quality agreement differ accordingly.

Core Capability Assessment

Regardless of tier, every contract packaging vendor must be assessed across these capability domains:

Quality management system certification. ISO 13485 certification is the baseline. Confirm the certificate scope covers the specific services you are engaging the vendor for — packaging operations, sterilization coordination, labeling, or all three. Verify that the registrar is reputable and that the certificate is current. Pull the registrar's surveillance audit reports if available. A vendor with only ISO 9001 certification is not automatically disqualified, but the gap analysis is significant — ISO 9001 does not require process validation, design controls, or the level of traceability that medical device packaging demands.

ISO 11607 experience. Ask specifically about the vendor's experience with ISO 11607 Part 1 and Part 2 validations. How many validations have they completed? What device types? What sterilization modalities? What packaging formats (pouches, rigid trays, flexible form-fill-seal)? A vendor who has completed dozens of ISO 11607 validations across multiple sterilization types brings knowledge that reduces your project risk.

Sterilization coordination capability. If your device requires terminal sterilization (ethylene oxide, gamma irradiation, electron beam, steam, or vaporized hydrogen peroxide), the packaging vendor must coordinate with the sterilization provider. This includes understanding how the packaging performs through the sterilization cycle, managing logistics between packaging and sterilization, and maintaining chain-of-custody documentation. Ask which sterilization vendors the packager works with regularly. Established relationships reduce cycle time and errors.

Labeling and UDI systems. The vendor must have label printing and verification capabilities that support UDI compliance. This includes barcode verification per ISO/IEC 15415 (2D codes) or ISO/IEC 15416 (1D codes), label content verification against your specifications, and controls to prevent label mix-ups between products or lot numbers. Ask to see their label verification procedures and records.

Environmental controls. Packaging operations for sterile devices require controlled environments. The specific requirements depend on whether the device is terminally sterilized (the packaging is assembled before sterilization) or aseptically filled (the device is sterile when placed into the packaging). For terminal sterilization, a controlled but not necessarily classified cleanroom environment may suffice. The vendor must be able to demonstrate environmental monitoring, cleaning procedures, and personnel gowning appropriate to the cleanliness level required.

Traceability and record-keeping. The vendor must maintain complete traceability from incoming materials (lot numbers, certificate of conformance) through packaging operations (equipment used, parameters recorded, operators identified) to outgoing finished goods. Ask to see sample device history records or batch records. Traceability must be sufficient to support a recall if one becomes necessary.

Recommended Reading

Contract Cleanroom Assembly Qualification for Medical Devices: Audit, Approval, and Ongoing Control

Manufacturing Quality Systems2026-05-11 · 35 min read

The Audit Approach

Pre-Audit Information Gathering

Before conducting an on-site audit, request and review the following documentation:

• Current ISO 13485 certificate with scope
• Most recent surveillance or recertification audit report (if the vendor will share it)
• Organizational chart showing quality, operations, and packaging engineering teams
• List of packaging equipment with maintenance and calibration status
• Sample validation reports (IQ/OQ/PQ for sealing equipment, with redacted client information)
• Sample device history record or batch record template
• Quality manual or quality system overview
• List of any regulatory actions (FDA 483s, warning letters, Notified Body nonconformities) in the past five years
• Client references in your device type or sterilization modality

If a vendor refuses to provide validation report samples or regulatory history, consider that a significant risk indicator. Transparent vendors understand that pre-qualification information sharing is standard practice.

On-Site Audit Focus Areas

The on-site audit should be structured to evaluate both the quality system and the operational capabilities specific to packaging. Allocate a full day for a first-time qualification audit of a contract packaging vendor. Key focus areas:

Sealing and forming equipment. Walk the production floor. Observe the sealing equipment in operation. Check that equipment is identified, that calibration stickers are current, that preventive maintenance logs are up to date, and that operators can explain the critical process parameters for the equipment they operate. Ask an operator to show you the current sealing parameters for a running job and explain what happens if a parameter goes out of range.

Process validation documentation. Review the actual IQ/OQ/PQ protocols and reports for the sealing and forming equipment that will process your product. Verify that the validation covers the materials you will use. Confirm that process parameter windows are established and that production parameters are set within the validated range. Look for evidence that validation was challenged — did OQ include minimum and maximum parameter limits? Were multiple operators involved in PQ? Were sample sizes statistically justified?

Incoming material control. Trace the path of packaging materials from receiving to production. How are incoming materials inspected or verified? Are certificates of conformance or analysis reviewed and retained? Are materials quarantined until released? How does the vendor handle nonconforming incoming materials? Verify that the vendor's incoming material acceptance criteria align with your material specifications.

Labeling operations. Observe a labeling operation if possible. Check that label content is verified against a master (electronic or approved hard copy). Look at the label storage area — are blank labels for different products segregated to prevent mix-ups? How does the vendor verify that the correct label is applied to the correct product? Is there a first-article verification process? How are label discrepancies caught and corrected?

Environmental monitoring. Review the environmental monitoring program for the packaging area. If the area is classified (ISO Class 7 or 8 cleanroom), review viable and non-viable monitoring data, trend analyses, and excursion investigations. Even if the area is not classified, there should be documented controls for cleanliness, temperature, humidity, and particulate matter appropriate to the product being packaged.

Training records. Pull training records for packaging operators and quality inspectors. Verify that operators are trained on the specific equipment they operate, on the quality system procedures relevant to their role, and on ISO 11607 requirements. Look for evidence of competency assessment, not just attendance at a training session.

Deviation and CAPA system. Review recent packaging deviations. What types of deviations occur most frequently? How are they investigated? How are root causes identified? Are corrective actions effective (verified through follow-up)? A mature deviation and CAPA system is a strong positive indicator. A vendor with few or no deviations may be under-reporting rather than under-deviating.

Change control. Evaluate the vendor's change control process. When equipment is modified, when materials are changed, when process parameters are adjusted, or when personnel with new responsibilities are assigned, is there a documented change control process that evaluates the impact of the change and notifies affected clients? This is critical — uncontrolled changes at a contract packager can invalidate your packaging validation without your knowledge.

Packaging Validation Capabilities

ISO 11607 Part 1: What the Vendor Must Demonstrate

For a vendor who participates in packaging design or material selection, assess their capability to execute or support the following Part 1 activities:

Material qualification and selection. The vendor should be able to present material qualification data for the packaging materials they commonly use. This includes physical property testing (tensile strength, puncture resistance, tear resistance), microbial barrier testing (per ASTM F1608 or equivalent), and compatibility data with common sterilization modalities. If the vendor has pre-qualified material systems (specific film-and-lid combinations with validated performance data), this can reduce your qualification timeline.

Sterile barrier system performance testing. After sterilization and after accelerated aging, the sterile barrier system must be tested to confirm integrity and strength. The vendor should be able to perform or coordinate the following tests:

• ASTM F88 — Seal strength testing, which measures the force required to peel open a seal. Seal strength must meet minimum thresholds defined in your specifications. The vendor should have tensile testing equipment calibrated per applicable standards and should be able to run F88 tests with appropriate sample sizes and conditioning.

• ASTM F2096 — Bubble leak test for sterile barrier integrity. Bubble testing detects gross leaks (approximately 250 microns and larger) in sealed pouches or trays by pressurizing the package and submerging it in water. Dye penetration (ASTM F1929 for porous materials, ASTM F3039 for non-porous materials) detects smaller channel leaks and seal defects. The vendor should have equipment and trained operators for these methods.

• ASTM D4169 — Transport simulation testing, also known as distribution simulation. This standard defines test sequences that simulate the stresses of shipping — vibration, drop, impact, compression, and low pressure (for air transport). The vendor should either have in-house D4169 capability or a validated relationship with a test laboratory that does. Post-simulation package integrity testing confirms that the sterile barrier survives distribution.

ISO 11607 Part 2: Process Validation Requirements

The vendor's process validation capability is where qualification audits most often reveal gaps. A robust process validation program for packaging must include:

Process failure modes and effects analysis (PFMEA). Before validation begins, the vendor should conduct or participate in a PFMEA for the packaging process. This identifies potential failure modes (incomplete seals, wrinkled seals, misaligned labels, material damage) and their causes, and drives preventive controls into the process and equipment parameters.

Installation Qualification. Review IQ protocols and reports. They should confirm that the equipment manufacturer's installation specifications were met, that utilities comply with requirements, that all instruments are calibrated, and that the equipment configuration matches the intended packaging process. IQ should be documented in a report signed by both the vendor's quality team and, where applicable, the device manufacturer's representative.

Operational Qualification. OQ is the most critical phase for packaging validation because it defines the process window. The vendor should demonstrate that they can produce acceptable seals across a range of parameters. For a heat-sealing process, this means varying temperature, pressure, and dwell time to identify the lower and upper limits of each parameter that still produce acceptable seal strength and visual quality. The OQ report should include seal strength data per ASTM F88 at each parameter combination, visual inspection results, and any other acceptance criteria defined in the protocol.

Performance Qualification. PQ demonstrates that the process works consistently under routine conditions. The vendor should run three or more consecutive production-scale batches (or simulated production runs) using production materials, trained operators, and routine process parameters. All PQ samples must pass acceptance criteria including seal strength, integrity testing, and visual inspection. PQ runs should ideally include different operators and different shifts to demonstrate robustness.

Ongoing process monitoring. Validation is not a one-time event. The vendor should have a program for ongoing monitoring of sealing process performance. This typically includes periodic seal strength testing, visual inspection of seals at defined frequencies, and trending of process parameters. If the vendor monitors seal parameters in real time (some modern sealers provide continuous parameter recording), this is a strong capability.

Sterile Barrier System Expertise

The sterile barrier system is the minimum package that prevents ingress of microorganisms and allows the device to be presented sterile at the point of use. It is the most critical element of medical device packaging, and the contract packaging vendor must demonstrate deep understanding of SBS principles.

SBS Design and Selection

For vendors who participate in SBS design, evaluate their ability to:

• Match packaging format to device characteristics. An orthopedic implant in a rigid tray with a Tyvek lid has different packaging requirements than a catheter in a flexible pouch. The vendor should be able to explain why a particular format is recommended and what alternatives were considered.

• Account for sterilization method constraints. Ethylene oxide sterilization requires porous materials (Tyvek, medical-grade paper) to allow gas penetration. Radiation sterilization (gamma or e-beam) can use fully impermeable films but requires materials that maintain properties after radiation exposure. The vendor must understand these constraints and select or recommend materials accordingly.

• Design for distribution and clinical use. The SBS must survive ASTM D4169 transport simulation testing and must be openable by clinical staff without contamination. Ease of opening in the sterile field, presence of easy-peel features, and absence of fiber generation on opening are all design considerations the vendor should address.

SBS Integrity Testing

The vendor must be able to perform or coordinate integrity testing of the sterile barrier system. The two primary methods are:

Dye penetration testing (ASTM F1929 for porous materials / ASTM F3039 for non-porous materials). A dye solution is injected into or applied to the sealed package. Any breach in the seal allows the dye to penetrate, making leaks visible. ASTM F1929 detects channel leaks in porous packaging (such as Tyvek pouches) down to approximately 50 microns. ASTM F3039 covers the same approach for non-porous film and foil packaging.

Bubble emission testing (ASTM F2096). The package is submerged in water and pressurized. Any leak produces a stream of bubbles, allowing detection and location of the leak. This method is useful for detecting gross leaks (approximately 250 microns and larger) and for verifying overall package integrity after accelerated aging or transport simulation.

Both methods require trained operators, controlled test conditions, and documented procedures. Ask the vendor to demonstrate their integrity testing capability during the audit.

Recommended Reading

Biological Specimen Raw Material Sourcing for IVD Development: Human Serum, Plasma, and Matrix Materials

Manufacturing IVD & Diagnostics2026-05-11 · 21 min read

Seal Process Controls

Seal quality is the single most critical output of the contract packaging process. A compromised seal means a compromised sterile barrier. The vendor's seal process controls must be rigorous and documented.

Critical Process Parameters

For heat-sealing processes (the most common method for medical device packaging), the critical process parameters are:

Temperature. The sealing surface temperature must be controlled within the validated range. The vendor's equipment should have calibrated temperature displays and, ideally, independent temperature verification. Ask how temperature is verified — some vendors use external thermocouples or temperature-indicating labels to confirm that the displayed temperature matches the actual sealing surface temperature.

Pressure. The sealing pressure (often controlled by pneumatic systems) must be within the validated range. Verify that the equipment displays or records pressure, that pressure is verified during setup, and that deviations from the pressure setpoint trigger alarms or stop the equipment.

Dwell time. The duration of the sealing cycle must be within the validated range. Modern sealers control dwell time electronically, but mechanical cam-driven sealers rely on machine speed, which must be verified.

The vendor should document these parameters for each production batch in the device history record. If the equipment provides continuous monitoring and recording (data logging), this is superior to manual recording and provides a more robust record for regulatory inspection.

Seal Inspection and Monitoring

Beyond parameter control, the vendor should inspect seals at defined intervals:

Visual inspection. Every sealed package should receive visual inspection for seal quality — checking for complete seals, absence of wrinkles or channels, correct seal width, and absence of material defects. Visual inspection criteria should be documented and operators should be trained and qualified for visual inspection.

Destructive testing. Periodic seal strength testing per ASTM F88 during production (typically at defined intervals such as start-up, mid-run, and end of run) provides quantitative data on seal performance. The vendor should have a schedule for destructive testing that is risk-based and documented.

Statistical process control. Advanced vendors may use statistical process control (SPC) charts to monitor seal strength trends over time. SPC can detect gradual process drift before it results in out-of-specification seals, enabling proactive correction.

Labeling Accuracy and UDI Compliance

Label Control Requirements

The contract packaging vendor's labeling operations must prevent mix-ups and ensure accuracy. Evaluate the following:

Label generation and approval. Labels should be generated from an approved electronic source — not manually typed or copied from a previous batch. The approved label content (including UDI, product code, lot number, expiration date, and all regulatory markings) should be maintained in a controlled system. Any change to label content must go through the vendor's change control process and, per your quality agreement, may require your approval before implementation.

Label verification. First-article verification (comparing the first printed label to the approved master) and in-process verification (periodic checks during the print run) must be documented. For UDI labels, barcode verification per ISO/IEC 15415 or ISO/IEC 15416 should be performed using a barcode verifier (not just a scanner — a verifier grades barcode quality on a scale from A to F and produces a documented quality report).

Label segregation and storage. Labels for different products must be physically segregated to prevent application of the wrong label. Blank label stock should be controlled. Labels from previous jobs must be removed from the labeling area or destroyed before a new job begins.

Label application verification. After labels are applied, there should be a verification step to confirm that the correct label is on the correct product. This may be visual inspection, barcode scanning, or vision system verification.

UDI-Specific Requirements

Unique Device Identification adds complexity to labeling operations at the contract packager:

UDI composition. The UDI includes a Device Identifier (DI, which identifies the specific version or model of the device) and a Production Identifier (PI, which includes lot number, serial number, expiration date, and/or manufacturing date). The contract packager must correctly compose the UDI from the DI (provided by you) and the PI (generated during production). Errors in PI composition are a common labeling failure at contract packagers.

UDI carrier formats. The UDI must be presented in both plain text and as a machine-readable carrier (typically a GS1 DataMatrix 2D barcode or a GS1-128 1D barcode). The contract packager's labeling system must be capable of encoding and printing both formats correctly.

UDI assignment. Clarify in your quality agreement who is responsible for UDI assignment — the device manufacturer or the contract packager. In most cases, the device manufacturer assigns the DI and defines the PI format, while the contract packager generates the PI values and composes the complete UDI. This division of responsibility must be unambiguous.

EUDAMED and GUDID submission. UDI records must be submitted to the FDA's Global Unique Device Identification Database (GUDID) for the US market and to EUDAMED for the EU market. This is typically the device manufacturer's responsibility, not the contract packager's. However, the quality agreement should specify that the contract packager provides all production-level UDI data (lot numbers, expiration dates) to the manufacturer in a timely manner to support these submissions.

Sterilization Coordination

The Packaging-Sterilization Interface

Terminal sterilization (sterilization after the device is sealed in its packaging) creates a critical interface between the contract packager and the sterilization provider. The contract packager's role includes:

Packaging compatibility with sterilization. The packaging materials and design must be compatible with the chosen sterilization method. For ethylene oxide sterilization, the packaging must allow gas penetration and dissipation. For radiation sterilization, materials must maintain physical and barrier properties through the maximum anticipated dose. The contract packager must understand these requirements and ensure that materials are selected and qualified accordingly.

Post-sterilization integrity verification. After sterilization, the sterile barrier must be re-tested for integrity. This is typically done by the device manufacturer or a test laboratory, not the contract packager, but the packager may be responsible for coordinating sample submission. The quality agreement should specify responsibilities for post-sterilization testing.

Logistics and chain of custody. The contract packager must manage the logistics of sending packaged devices to the sterilization provider and receiving sterilized devices back. This includes maintaining lot identity, documenting shipment conditions, and verifying that sterilization processing was completed per specifications before releasing finished goods. The packager should have procedures for handling quarantine status — product should not be released for distribution until sterilization confirmation is received and verified.

EtO residuals management. For ethylene oxide sterilization, the packaged device must undergo aeration to reduce EtO residuals to acceptable levels per ISO 10993-7. The contract packager may need to coordinate aeration time and conditions, and must understand that releasing product before adequate aeration is a serious quality and safety failure.

Quality Agreement Provisions for Sterilization

The quality agreement between you, the contract packager, and potentially the sterilization provider (in a three-party agreement or in separate bilateral agreements) must address:

• Who selects and qualifies the sterilization provider
• Who defines the sterilization cycle parameters
• How sterilization load configuration is communicated
• How sterilization confirmation is documented and transmitted
• Who is responsible for post-sterilization testing
• How quarantine is managed between packaging and sterilization release
• What happens when a sterilization failure occurs (quarantine, re-sterilization, or scrap)

Recommended Reading

Process Validation Ownership at a CMO/CDMO: Who Writes, Who Runs, Who Approves

Manufacturing Quality Systems2026-05-11 · 13 min read

Quality Agreement Specifics for Packaging Vendors

The quality agreement is the most important contractual document governing the relationship between a device manufacturer and a contract packaging vendor. It must be specific enough to prevent ambiguity and comprehensive enough to address the scenarios that routinely cause problems.

Mandatory Quality Agreement Clauses

Scope of services. Define exactly what the vendor will do. "Packaging services" is not sufficient. Specify: forming, sealing, labeling, kitting, sterilization coordination, distribution, and any other services. If the vendor is providing packaging design or validation services, include those explicitly.

Specifications and documentation. Identify the specifications the vendor must follow — packaging drawings, material specifications, labeling specifications, process parameters. Specify that the vendor must not deviate from these specifications without prior written approval from the device manufacturer.

Change notification. This is arguably the most critical clause. The vendor must notify you of any change that could affect product quality, including changes to packaging materials, equipment, process parameters, facilities, key personnel, subcontractors, or the quality management system. Define the notification timeline — 30 or 60 days before implementation of a planned change, and immediate notification for an unplanned or emergency change. Specify that no change affecting your product may be implemented without your written approval.

Deviation handling. Define what constitutes a deviation, who is responsible for investigating deviations, how investigations will be conducted, and who has approval authority for deviation dispositions. Specify that the device manufacturer must be notified of any deviation affecting their product within a defined timeframe (typically 24 to 48 hours). Clarify that the device manufacturer has the right to approve or reject the vendor's proposed disposition for critical deviations.

Right of access and audit rights. The vendor must grant the device manufacturer, regulatory authorities, and the device manufacturer's Notified Body (for EU MDR) the right to access the vendor's facilities, records, and personnel for the purpose of audits and inspections. This right must be unconditional and not subject to unreasonable limitations. Specify that the device manufacturer will conduct periodic audits (annually at minimum for critical vendors) and for-cause audits when warranted.

Record retention and access. Define which records the vendor must maintain, the retention period (typically the life of the device plus a defined period, or a minimum number of years per your quality system requirements), and how records will be made available to the device manufacturer upon request. Records should include device history records, environmental monitoring data, calibration records, training records, deviation reports, CAPA records, and change control records.

Complaint handling. Specify how product complaints that the vendor receives (or that you receive and determine may be related to packaging) will be communicated and investigated. Define timelines for notification and investigation.

Recall support. The vendor must agree to support any recall or field corrective action initiated by the device manufacturer. This includes providing traceability records, segregating affected inventory, and cooperating with regulatory authority requests.

Subcontracting. The vendor must not subcontract any portion of the agreed services to a third party without prior written approval from the device manufacturer. If subcontracting is approved, the subcontractor must be subject to the same quality requirements and must be included in the vendor's quality system.

Termination and transition. Define what happens when the agreement ends — how records will be transferred, how inventory will be managed, and what transition support the vendor will provide.

Differentiating the Quality Agreement by Vendor Tier

For an assembly-only vendor, the quality agreement should emphasize strict adherence to your specifications, process parameter documentation, and immediate notification of any deviation. The vendor's responsibility is execution fidelity.

For a design-and-validation vendor, the quality agreement should additionally address ownership of validation protocols and reports, responsibility for validation maintenance (revalidation triggers, ongoing monitoring), engineering change processes, and the vendor's authority to make packaging design decisions within defined boundaries.

Handling Packaging Deviations and Sterility Breaches

Deviation Classification

Packaging deviations at a contract packager should be classified by severity, and the classification should drive the response:

Critical deviations directly affect sterile barrier integrity or patient safety. Examples: confirmed sterile barrier breach, seal strength below minimum specification, use of wrong packaging materials, application of wrong labels or wrong UDI, sterilization failure or missed sterilization step. Critical deviations require immediate product quarantine, notification to the device manufacturer within 24 hours, a formal investigation, and disposition by the device manufacturer's quality team. Product affected by a critical deviation must not be released without explicit approval from the device manufacturer.

Major deviations affect packaging quality but may not directly compromise sterility. Examples: seal parameters outside validated range but with acceptable seal strength on testing, cosmetic defects in packaging that do not affect barrier integrity, environmental monitoring excursions within defined limits. Major deviations require documented investigation and notification to the device manufacturer within a defined period (typically 48 to 72 hours). The vendor may propose a disposition, but the device manufacturer should approve.

Minor deviations are procedural or documentation issues that do not affect product quality. Examples: incomplete batch record entries corrected per procedure, minor calibration overdue corrected before product impact. Minor deviations should be documented and trended but may not require immediate notification if the quality agreement so specifies.

Sterility Breach Response

A confirmed or suspected sterility breach at a contract packager is a high-severity event that requires a defined response protocol:

1. Immediate quarantine of all potentially affected product — not just the specific unit where the breach was found, but all units from the same batch, the same sealing equipment run, or the same time window, depending on the investigation scope.

2. Notification to the device manufacturer within hours, not days. The quality agreement should specify that the vendor contacts a named individual at the device manufacturer by phone for any suspected sterility breach.

3. Investigation that includes review of sealing parameters, equipment performance, environmental conditions, material certificates, operator training, and any recent changes. The investigation must determine whether the breach is an isolated event or a systemic issue.

4. Root cause analysis using appropriate tools (5 Why, fishbone diagram, fault tree analysis). The root cause must be identified before corrective actions are defined.

5. Corrective action that addresses the root cause and prevents recurrence. The corrective action must be verified for effectiveness.

6. Disposal or rework decision made by the device manufacturer's quality team, not the contract packager. Product with confirmed sterility breaches must be scrapped unless a validated re-sterilization and repackaging process exists and is approved.

7. Regulatory assessment by the device manufacturer to determine whether the event constitutes a reportable incident, triggers a recall, or requires notification to regulatory authorities.

Ongoing Vendor Oversight

Qualification is the beginning, not the end, of vendor management. Once a contract packaging vendor is approved and operational, ongoing oversight ensures that the vendor maintains the capabilities and performance that justified their qualification.

Periodic Audits

Conduct on-site audits annually at minimum for contract packaging vendors classified as critical (which they almost always are for sterile devices). The audit frequency should be risk-based — a vendor with a history of deviations or quality issues may warrant semi-annual audits, while a consistently high-performing vendor may be audited annually with remote assessments in between.

Audit scope should rotate to ensure comprehensive coverage over a multi-year cycle. One year may focus on process validation and equipment controls, the next on deviation management and CAPA effectiveness, and the next on labeling operations and UDI compliance.

Key Performance Indicators

Track vendor performance using quantifiable metrics:

On-time delivery rate. Late deliveries from a contract packager disrupt the entire supply chain and may affect sterilization schedules, distribution timelines, and customer commitments.

Deviation rate. The number of deviations per batch or per unit produced. Track trends over time. An increasing deviation rate may indicate equipment degradation, personnel turnover, or system breakdown.

Right-first-time rate. The percentage of batches completed without deviation, rework, or rejection. This is a measure of process robustness and operator competence.

Seal strength consistency. Monitor seal strength data from the vendor's ongoing monitoring program. Track mean, standard deviation, and capability indices (Cpk) over time. A declining Cpk indicates process drift that should trigger investigation before out-of-specification product is produced.

Label accuracy rate. Track label-related deviations and errors. Label errors are preventable with robust controls, and any label deviation should be treated as a serious indicator.

CAPA closure timeliness. Track whether corrective actions from deviations and audits are implemented and verified within the agreed timelines. Chronic late CAPA closures indicate a vendor with insufficient quality resources or insufficient management commitment.

Vendor Re-Evaluation

ISO 13485 clause 7.4.1 requires re-evaluation of suppliers based on performance data and risk. Re-evaluation should be formal and documented at least annually. The re-evaluation should consider:

• Performance against quality metrics and KPIs
• Results of audits (both your audits and the vendor's registrar audits)
• History of deviations, CAPAs, and complaints
• Any changes to the vendor's quality system, facilities, or key personnel
• Any regulatory actions against the vendor
• Feedback from your own production and quality teams

If re-evaluation reveals unacceptable performance, the response should follow your supplier management procedure — which may range from a corrective action request to increased audit frequency to conditional approval to disqualification. Document the decision and the rationale.

Recommended Reading

Calibrators and Controls Traceability for IVD Kits

IVD & Diagnostics Manufacturing2026-05-11 · 15 min read

Common Pitfalls in Contract Packaging Vendor Qualification

Inadequate Process Validation Review

The most common qualification failure is accepting a vendor's statement that processes are "validated" without reviewing the actual validation documentation. Vendors may have outdated validations (equipment has been moved or modified since IQ), incomplete validations (OQ completed but PQ never finished), or validations that do not cover your specific materials or packaging configurations. You must review the protocols and reports, confirm they are current and complete, and verify that your product falls within the validated scope.

Quality Agreements That Are Too Generic

A quality agreement copied from a template without customization to the specific services and risks of the packaging relationship provides little protection. The agreement must address the specific scenarios that matter: what happens when a seal parameter drifts, who approves a change in sealing equipment, how labeling errors are communicated, what the recall support process looks like. Invest the time to negotiate a quality agreement that reflects the actual relationship.

Failure to Define Change Notification Scope

Vendors routinely make changes to their operations — equipment maintenance, software updates, personnel changes, material suppliers, facility modifications. Not all changes affect your product, but some do, and you will not know which if the vendor does not notify you. Define change notification requirements broadly in the quality agreement and err on the side of over-notification. It is far better to receive a few notifications you do not need than to miss the one notification you did.

Neglecting Ongoing Monitoring After Qualification

Qualifying a vendor and then assuming they will maintain that qualification level without oversight is a common and dangerous oversight. Markets shift, personnel turn over, equipment ages, and management priorities change. Without ongoing monitoring through audits, KPI tracking, and open communication, a vendor's capability can degrade without your knowledge until a failure forces the issue.

Confusing ISO 9001 with ISO 13485

Some contract packagers hold ISO 9001 certification but not ISO 13485. While ISO 9001 demonstrates a quality management system foundation, it does not require process validation, design controls, or the level of traceability that medical device packaging demands. An ISO 9001-certified vendor can be qualified, but the burden is entirely on you to verify that their quality system includes the controls that ISO 13485 would mandate. This typically requires a more thorough initial audit and more intensive ongoing oversight.

Selecting the Right Vendor for Your Situation

For Early-Stage Companies

Startups and early-stage medical device companies face a particular challenge: limited packaging engineering expertise in-house, tight timelines, and constrained budgets. For these companies, a design-and-validation vendor is almost always the better choice. A vendor who can provide packaging engineering, material selection, ISO 11607 validation protocol development, test coordination, and production packaging services under one roof reduces the number of vendors you need to manage and provides expertise you may not have internally. Pre-validated packaging solutions (standardized pouch or tray configurations with existing validation data) can accelerate launch timelines by months compared to custom packaging development.

For Established Manufacturers

Companies with dedicated packaging engineering resources and established packaging designs may prefer an assembly-only vendor for routine production, reserving design-and-validation vendors for new product introductions or packaging redesigns. The key is ensuring that your internal team has the bandwidth to support the assembly-only vendor with specifications, validation maintenance, and technical support.

For Multi-Region Products

If your device is sold in both the US and EU, the contract packager must support labeling requirements for both markets — including US UDI (GUDID) and EU UDI (EUDAMED) formats, multilingual labeling where required, and compliance with both FDA and EU MDR packaging and labeling provisions. Confirm the vendor's experience with multi-region labeling operations before engagement.

Conclusion

Contract packaging vendor qualification for medical devices is not a box-checking exercise. It is a systematic evaluation of whether a vendor can protect your device's sterility, maintain your labeling accuracy, coordinate your sterilization processes, and operate within a quality system that meets the requirements of ISO 13485, ISO 11607, FDA QMSR, and EU MDR. The consequences of getting it wrong — packaging-related recalls, sterility breaches, labeling errors, regulatory enforcement actions — are severe and avoidable.

The qualification process must be thorough: assess capabilities before selection, audit the facility and documentation before approval, negotiate a quality agreement that addresses the specific risks of your packaging relationship, and maintain ongoing oversight through performance metrics and periodic audits. The investment in rigorous vendor qualification pays for itself many times over in avoided quality events, regulatory findings, and patient safety incidents.

Whether you select an assembly-only vendor or a full-service design-and-validation partner, the principles are the same: define your requirements precisely, verify that the vendor can meet them, document everything, and never stop monitoring. The sterile barrier is the last line of defense between your device and the patient. Your contract packaging vendor holds that line every day.