Legacy Medical Device Transfer to a CDMO: Change Control, DMR Migration, Process Revalidation, and Regulatory Continuity

Why Legacy Product Transfer Is Different from New Product Tech Transfer

Transferring a legacy medical device to a contract development and manufacturing organization (CDMO) is not the same as transferring a newly developed product. A new product still has its development team, its institutional memory, its living design history file, and its original engineering intent fresh in everyone's minds. A legacy product often has none of these advantages.

Legacy products are typically mature devices that have been manufactured for years — sometimes decades. The engineers who designed them may have left. The original development rationale may be buried in obsolete documentation systems. The manufacturing process may have been incrementally optimized through tacit operator knowledge that was never fully documented. The bill of materials may include components from suppliers who no longer exist or specifications that were superseded by newer revisions without clean traceability.

Yet this product is still on the market, still generating revenue, still cleared or approved under specific regulatory submissions, and still subject to all current good manufacturing practice requirements. Transferring it to a CDMO means moving an entire manufacturing ecosystem — process knowledge, quality history, supplier relationships, regulatory standing — without breaking the chain of compliance or continuity.

The FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference. Under ISO 13485 Clause 7.3.8 (Design and Development Transfer) and Clause 7.5 (Production and Service Provision), the transfer must be managed as a controlled change within your quality management system. The OEM retains ultimate regulatory responsibility throughout and after the transfer. That regulatory ownership does not transfer to the CDMO.

This post covers the full lifecycle of a legacy product transfer to a CDMO: the pre-transfer assessment, the documentation handoff, the tacit knowledge problem, the process requalification strategy, the regulatory notification framework, and the common failure modes that turn an 8-month project into an 18-month emergency.

Deciding to Transfer: Strategic Triggers and Risk Assessment

Why Companies Transfer Legacy Products

Legacy product transfers to CDMOs are typically triggered by one or more of these strategic drivers:

Manufacturing facility closure or capacity constraint. A plant is being shut down, or it has reached capacity and the product is no longer a priority for internal manufacturing resources. This is the most common trigger and often the most time-pressured.

Cost optimization. Internal manufacturing costs have escalated, and the product's margin no longer justifies in-house production. CDMO economics — particularly for mid-volume, stable products — can be significantly more favorable.

Regulatory market access. The product needs to be manufactured in a different geographic region to support local market access, tariff optimization, or local content requirements. A CDMO with facilities in the target region can serve this need.

Portfolio rationalization. The company is divesting or sunsetting product lines, and a CDMO can provide a lower-overhead manufacturing platform for products that are still commercially viable but no longer strategically central.

Quality system maturity gap. The incumbent manufacturer's quality system may not meet current regulatory expectations — particularly under the new QMSR — and a CDMO with an established ISO 13485 QMS may provide a faster path to compliance than upgrading legacy systems.

Transfer Feasibility Assessment

Before committing to a transfer, conduct a formal feasibility assessment that covers:

Product complexity. How many components, sub-assemblies, and process steps are involved? A simple disposable device with 5 components and 3 process steps transfers very differently from an electro-mechanical capital device with 200 components, 30 process steps, and embedded software.

Documentation condition. How complete and current is the Device Master Record (DMR) — or under QMSR, the Medical Device File (MDF)? Is the bill of materials accurate? Are the work instructions reflective of what actually happens on the production floor, or have they drifted from practice?

Regulatory footprint. What markets is the product sold in? What submissions is it cleared or approved under? What are the change notification requirements for each market? A product sold only in the US under a single 510(k) has a very different regulatory transfer profile than a product sold in 40 countries under multiple registrations.

Supply chain. Who are the critical suppliers? Are any sole-sourced? Are there long-lead components? Does the CDMO have relationships with these suppliers or will they need to be established from scratch?

Timeline pressure. Is this a planned strategic transfer with 12–18 months of runway, or a forced transfer driven by facility closure with 6 months before supply interruption?

The Documentation Package: What to Transfer and Why It Matters

The DMR / MDF Handoff

The Device Master Record (legacy FDA terminology) or Medical Device File (ISO 13485 terminology under QMSR) is the core of the transfer. It contains — or should contain — the complete set of specifications and procedures needed to manufacture the device. A thorough DMR for transfer purposes should include:

• Device specifications: dimensional drawings, material specifications, performance specifications, labeling and packaging specifications
• Process specifications: manufacturing process flow diagrams, work instructions, setup parameters, in-process inspection criteria
• Quality specifications: incoming inspection requirements, in-process testing, final release criteria, sampling plans
• Packaging and labeling specifications: packaging configurations, labeling content, labeling application procedures
• Supplier and material specifications: approved supplier list, material specifications for all components, certificates of analysis or conformance requirements

For legacy products, the DMR is almost always incomplete or inaccurate in critical ways. The documentation may not reflect process changes that accumulated over years of manufacturing. Work instructions may reference obsolete equipment. The bill of materials may not match what purchasing is actually buying.

The DDF / DHF and Its Role in Transfer

Under QMSR, the Design and Development File (DDF) — previously called the Design History File (DHF) under the old QSR — is equally important for transfer. The CDMO needs to understand the design intent, the risk profile, the verification and validation basis, and the rationale behind key design and process decisions.

For legacy products, the DHF/DDF may be fragmented across multiple systems, storage locations, and organizational memories. Critical elements include:

• Design inputs and outputs with traceability
• Risk analysis (ISO 14971) — the FMEA, fault tree analysis, or hazard analysis that identified manufacturing process risks
• Design verification and validation protocols and reports
• Design transfer records from the original development-to-manufacturing transfer
• Change history — all design and process changes made since initial release

The Tacit Knowledge Problem

This is the single most underestimated risk in legacy product transfers. Tacit knowledge is the undocumented know-how that production operators, quality inspectors, and manufacturing engineers have accumulated over years of making the product. It includes:

• How to set up a particular machine that has undocumented quirks
• Which incoming lots of a specific material tend to process better and why
• How to recognize that a process is drifting before it shows up in any data
• The sequence of steps that the work instruction got wrong but everyone knows to do differently
• Why a particular fixture was designed the way it was and what happens if you modify it

Capturing tacit knowledge requires deliberate effort. The most effective approach is to conduct structured workshops between the current production team and the CDMO team, observing the actual manufacturing process in action — not just reviewing the written documentation. Arrotek's guidance on medical device tech transfer emphasizes spending time bringing the CDMO through the non-conformance and CAPA history to ensure previous mistakes are not repeated, and documenting all knowledge transfer activities formally.

Speaking directly with production line operators — not just the engineers who wrote the SOPs — is critical. Operators often know the practical realities that engineering documentation does not capture.

Selecting the CDMO for a Legacy Transfer

Capability Matching

For legacy transfers, the CDMO selection criteria differ from new product partnerships. The key question is not "can they develop a process" but "can they replicate an existing process on their equipment and maintain it." Specific evaluation criteria include:

Equipment compatibility. Does the CDMO have equivalent or adaptable equipment? If the legacy process was validated on a specific model of injection molder, ultrasonic welder, or test equipment, can the CDMO replicate those process parameters on their equipment? Significant equipment changes drive revalidation scope.

Cleanroom and environmental capability. Does the CDMO have the right cleanroom classification, environmental monitoring program, and facility layout for the product? If the product requires ISO Class 7 assembly with specific temperature and humidity controls, the CDMO must have that capability already in place.

Regulatory track record. Has the CDMO been through FDA inspections? What were the outcomes? Do they have experience with the type of device being transferred? A CDMO with a strong regulatory history but no experience with your device type may be preferable to one with device experience but recent inspection findings.

Quality system maturity. Is the CDMO's quality system robust enough to absorb a legacy product without disruption? This is particularly important for complaint handling, CAPA management, and change control — the three areas where legacy product transfers most commonly generate compliance gaps.

Supply chain access. Can the CDMO access your critical suppliers, or will they need to qualify alternative sources? For sole-source components, this can be a transfer-limiting constraint.

Quality Agreement Structure for Legacy Products

The quality agreement for a legacy product transfer must address specific issues that new product agreements do not:

Change control ownership. Who initiates, who evaluates impact, who approves, and who notifies regulators? The OEM retains regulatory responsibility, but the CDMO must have a change control process that feeds into the OEM's system.

DMR / MDF ownership. The OEM owns the DMR/MDF. The CDMO maintains controlled copies and must follow them exactly. Any deviation requires formal change control.

Complaint and adverse event handling. The CDMO must have a process for receiving, evaluating, and escalating complaints related to the transferred product. This feeds into the OEM's medical device reporting obligations.

CAPA interface. CAPAs initiated by the CDMO for the transferred product must be visible to and approved by the OEM. The quality agreement must specify timelines, escalation criteria, and root cause analysis expectations.

Regulatory inspection support. The CDMO must allow and support FDA inspections that cover the transferred product. They must provide access to records, personnel, and facilities.

Transition period provisions. The agreement should include specific provisions for the transition period, including parallel manufacturing runs, joint quality reviews, and defined criteria for transferring full responsibility.

The Transfer Execution: A Phase-Gated Approach

Phase 1: Planning and Gap Analysis (Months 1–3)

The transfer begins with a comprehensive gap analysis between the current manufacturing state and the target state at the CDMO. This analysis drives the entire project plan.

Equipment and process gap analysis. Compare every process step against the CDMO's equipment and capabilities. Identify where equipment is identical (minimal risk), equivalent (moderate risk, requires some revalidation), or different (high risk, requires full revalidation). For legacy products, this comparison must extend to fixtures, tooling, test equipment, and environmental controls.

Documentation gap analysis. Review the DMR/MDF against actual manufacturing practice. Identify gaps where documentation does not match practice. Resolve these gaps before transfer — do not transfer inaccurate documentation to the CDMO.

Regulatory gap analysis. Assess the regulatory impact of every change identified in the equipment and process gap analysis. Determine which changes require regulatory notification and which can be managed internally. For products sold in multiple markets, this analysis must cover each jurisdiction's requirements.

Supply chain gap analysis. Map all suppliers, identify sole-source dependencies, and determine whether the CDMO can use existing suppliers or must qualify alternatives. For components where the CDMO proposes alternative suppliers, conduct formal change impact assessments.

Timeline and resource planning. Build the timeline from the bottom up based on workstream estimates, not from a target completion date. Industry data consistently indicates that the initial tech transfer and kick-off to the first at-scale batch typically takes six months or more. Add contingency buffers to each phase and treat the transfer steps as non-linear — start every activity as early as possible.

Phase 2: Knowledge Transfer and Setup (Months 2–5)

Technical workshops. Conduct structured, deep-dive technical workshops between the existing manufacturing team and the CDMO. Multiple workshops are typically needed, each focused on specific process areas. These should cover not just what the process does but why it was designed that way, what has gone wrong historically, and what the critical control points are.

Operator training. If the CDMO will use new operators, they must be trained on the product-specific requirements. For legacy products, this training should include exposure to the current manufacturing site — having CDMO operators observe the incumbent process is far more effective than classroom training alone.

Equipment qualification. All equipment at the CDMO that will be used for the transferred product must be qualified. Installation qualification (IQ), operational qualification (OQ), and where necessary, performance qualification (PQ) must be completed before process validation begins.

Fixture and tooling transfer or replication. If fixtures and tooling are being physically moved, inspect and recalibrate them at the new site. If new fixtures are being fabricated, validate them against the original design specifications and process requirements.

Phase 3: Process Validation (Months 4–8)

Process validation is where most legacy transfers encounter their most significant challenges. The scope of validation depends on how much has changed:

Lift and shift transfer. If the equipment, tooling, and processes are substantially identical at the CDMO, the validation scope may be limited to process performance qualification (PPQ) — typically three consecutive batches demonstrating that the CDMO can produce the product consistently to specification. This is the fastest path but requires genuinely equivalent equipment and processes.

Engineered transfer. If equipment or processes have been adapted, the validation scope expands to include re-qualification of the modified process steps. This may require new IQ/OQ for changed equipment, followed by PPQ. Global Interconnect, a contract manufacturer specializing in energy-based medical devices, emphasizes that thorough validation planning and verification testing are critical to successful transfers.

Full revalidation. If the process has been substantially redesigned for the CDMO's equipment, the validation scope approaches that of a new product. This includes complete process characterization, IQ/OQ/PQ for all critical process steps, and potentially new process capability studies.

The FDA's 2011 process validation guidance framework (Stage 1: Process Design, Stage 2: Process Qualification, Stage 3: Continued Process Verification) applies to legacy transfers. The challenge is that Stage 1 data — the original process development and characterization — may be limited for legacy products. In such cases, the OEM must rely on the accumulated manufacturing history, historical statistical process control data, and the original risk analysis to support the validation rationale.

First Article Inspection

The First Article Inspection (FAI) is a critical milestone. It is a formal, documented inspection of the first product manufactured at the CDMO. FAI best practices include:

• Define acceptance criteria in advance, mirroring product release criteria from the DMR/MDF
• Both OEM and CDMO quality teams must be involved
• Fully document the FAI, including all measurements, test results, and observations
• Any failures must trigger a formal non-conformance process with root cause investigation
• For complex products, consider conducting FAI across multiple production batches to confirm consistency

Phase 4: Production Ramp-Up and Monitoring (Months 7–10)

After successful process validation, the CDMO transitions to production ramp-up. This must be a controlled and structured process with defined key performance indicators:

• Production yield and first-pass inspection rate
• Non-conformance rate and type distribution
• CAPA volume, closure rate, and effectiveness
• Cycle time and throughput against target
• On-time delivery performance
• Customer complaint rate for the transferred product

During ramp-up, the OEM should maintain a higher level of oversight — more frequent quality reviews, more detailed batch record reviews, and faster escalation of any adverse trends. Over time, as the CDMO demonstrates stable performance, oversight can transition to a routine monitoring cadence.

Regulatory Notification and Filing Strategy

FDA Requirements

Under the QMSR (and the legacy QSR before it), manufacturing site changes for medical devices are managed through the change control provisions of the quality system regulation. The specific regulatory notification requirements depend on the product's classification and registration status:

For 510(k)-cleared devices. Manufacturing site changes generally do not require a new 510(k) submission, but they must be managed through the change control process. If the transfer results in changes to the device's specifications, manufacturing process, or labeled claims, a new 510(k) may be required. The OEM must document the change impact assessment and the basis for the regulatory determination.

For PMA-approved devices. Manufacturing site changes for PMA devices typically require a PMA supplement. The type of supplement (180-day, 30-day, or special) depends on the nature and significance of the change. A site change without process changes may qualify for a 30-day notice, while a site change accompanied by process modifications may require a 180-day supplement.

For EU MDR devices. Manufacturing site changes must be reported to the Notified Body through the appropriate notification pathway. The Notified Body will assess whether the change affects the conformity assessment and may require additional evidence or assessment before approving the change.

Change Control Documentation

Every aspect of the transfer must be documented through the OEM's change control system. The change order should include:

• Description of what is changing and why
• Risk assessment of the change's impact on product quality, safety, and efficacy
• Validation activities required to confirm the change does not adversely affect the product
• Regulatory assessment of notification or submission requirements
• Implementation plan with defined acceptance criteria
• Approval by appropriate functions (quality, regulatory, engineering, operations)

The change control record becomes a critical regulatory document. It demonstrates to inspectors that the transfer was planned, controlled, validated, and properly assessed for regulatory impact.

Common Failure Modes

Underestimating Timeline

The most common failure mode is underestimating how long the transfer will take. Industry data consistently shows that the initial tech transfer to first at-scale batch takes six months or more, even with good planning. When the documentation is incomplete, the process knowledge is concentrated in a few individuals, and the CDMO's equipment differs significantly from the incumbent's, the timeline easily extends to 12–18 months.

Building the timeline from workstream estimates rather than a target completion date is the most effective countermeasure. Add contingency to each phase and resist pressure to compress the validation timeline.

Transferring Inaccurate Documentation

If the DMR/MDF does not accurately reflect the actual manufacturing process, the CDMO will build their process against wrong specifications. This leads to out-of-specification results, failed validation runs, and wasted time and money. Invest the time upfront to audit the documentation against practice before initiating the transfer.

Losing Tacit Knowledge

When the engineers and operators who hold the product's undocumented knowledge leave before the transfer is complete, critical information is permanently lost. Capture tacit knowledge early — through process observation, structured interviews, and video documentation of key process steps — before any organizational changes affect the incumbent team.

Inadequate CDMO Quality System Integration

The CDMO's quality system must be capable of supporting the transferred product's requirements. If the CDMO's complaint handling, CAPA, or change control processes are not robust enough, compliance gaps will emerge quickly. Evaluate the CDMO's quality system maturity specifically against the transferred product's requirements, not just their general certification status.

Regulatory Surprises

Failing to properly assess the regulatory impact of the transfer — particularly for products sold in multiple markets — can result in unexpected notification requirements, delayed approvals, or even supply interruptions if a regulatory authority objects to the transfer. Conduct the regulatory impact assessment early and update it as the transfer scope evolves.

Continued Process Verification After Transfer

Under the FDA's process validation lifecycle approach, Stage 3 (continued process verification) applies after the transfer is complete. The CDMO must establish monitoring programs that confirm the process remains in a state of control during routine production.

For legacy products, this means the CDMO must maintain — or establish — statistical process control charts, conduct periodic review of process capability indices, monitor complaint and non-conformance trends, and report any adverse trends to the OEM through the quality agreement mechanisms.

The OEM should conduct periodic audits of the CDMO's production and quality records for the transferred product. Under the QMSR's risk-based inspection approach, FDA inspectors may review the OEM's oversight of the CDMO, including management review records, audit findings, and supplier evaluation activities — documents that were historically less accessible to inspectors but are now explicitly reviewable.

Transition of Supply and Dual-Running Period

Most legacy transfers require a dual-running period where both the incumbent manufacturer and the CDMO are producing the product simultaneously. This ensures supply continuity while the CDMO's process is being validated and ramped up.

During the dual-running period:

• Maintain strict lot segregation and traceability between the two sites
• Compare quality metrics between the two sites to identify any emerging differences
• Manage inventory carefully — build safety stock at the incumbent site before beginning the transition
• Coordinate regulatory notifications to ensure no market experiences an unnotified change
• Define clear criteria for when the incumbent site can be decommissioned for this product

The dual-running period is expensive but necessary. The cost of a supply interruption during transfer almost always exceeds the cost of maintaining parallel production during the transition.

Post-Transfer Governance

After the transfer is complete and the CDMO is in routine production, the OEM's oversight transitions to ongoing governance:

• Scheduled quality reviews (typically quarterly) covering production metrics, complaints, CAPAs, and change requests
• Annual quality audits of the CDMO's operations for the transferred product
• Periodic DMR/MDF reviews to ensure documentation remains current and accurate
• Supplier performance monitoring including the CDMO's management of the product's sub-tier suppliers
• Regulatory inspection readiness — ensuring both the OEM and CDMO are prepared for FDA or other regulatory authority inspections

The quality agreement should specify the governance framework, including meeting frequency, data sharing requirements, escalation paths, and the criteria for triggering additional oversight or intervention.

Key Takeaways

Transferring a legacy medical device to a CDMO is a regulated, knowledge-intensive process that requires careful planning, thorough documentation, and disciplined execution. The OEM retains regulatory responsibility throughout. The most common pitfalls — underestimated timelines, inaccurate documentation, lost tacit knowledge, and regulatory surprises — can be mitigated through rigorous pre-transfer assessment, structured knowledge transfer, and comprehensive change control.

The transfer is not complete when the first batch ships from the CDMO. It is complete when the CDMO has demonstrated sustained, consistent production that meets all quality and regulatory requirements, and when the OEM's governance framework provides adequate ongoing oversight.