Off-the-Shelf Single-Use Components Qualification for Medical Devices: A Practical Guide

The Hidden Complexity of Catalog Parts

Medical device manufacturers assemble products from hundreds of purchased components. Many of these are off-the-shelf items: Luer connectors from Qosina, tubing from Freudenberg, stopcocks from Nordson Medical, syringes from BD, clamps from specialty distributors. They arrive from a catalog with a part number, a datasheet, and sometimes a certificate of conformance. They look simple. They are not.

Every off-the-shelf component that enters a medical device assembly carries the same regulatory weight as a custom-machined implant. ISO 13485 Clause 7.4 and FDA QMSR (effective February 2, 2026, incorporating ISO 13485:2016 by reference) require the manufacturer to evaluate suppliers, define purchasing requirements, verify purchased product, and maintain traceability. The fact that a component is available from a catalog does not reduce these obligations. If anything, it complicates them, because the manufacturer has less visibility into how the component was made, what changed between lots, and whether the supplier's quality system is adequate.

This guide covers the full lifecycle of qualifying off-the-shelf single-use components for medical devices: from risk-based supplier classification and initial evaluation, through biocompatibility and functional evidence, incoming inspection strategy, ongoing monitoring, and the change control problems that cause the most regulatory trouble.

What Counts as an Off-the-Shelf Single-Use Component

For this discussion, off-the-shelf single-use components are standard catalog parts manufactured by a supplier who sells the same part to multiple customers, not made to your custom drawings or specifications. They are intended for one-time use and disposed of after a single procedure or application.

The most common categories include:

Fluid-path connectors. Luer lock and Luer slip connectors, needleless connectors, stopcocks, check valves, y-sites, T-connectors, and sampling ports. These are governed by ISO 80369 (replacing ISO 594 for many applications), which defines dimensional and performance requirements for small-bore connectors by clinical application — enteral, respiratory, neuraxial, limb cuff, and iv.

Tubing and flow-path components. PVC, silicone, TPE, and polyurethane tubing in standard sizes; extension sets; transfer lines; drainage tubes; pump-grade tubing rated for peristaltic or roller pump use. Material certifications such as USP Class VI compliance are typical purchasing requirements.

Syringes and dispensing components. Standard syringes in enteral-specific or luer configurations, disposable dispensing tips, and irrigation syringes.

Clamps, clips, and closure devices. Slide clamps, roller clamps, occlusion clips, and tube seals. Often available in polypropylene or polycarbonate variants.

Filters and vents. Hydrophilic and hydrophobic membrane filters, air elimination filters, and vented caps for single-use fluid paths.

Kitting and tray components. Procedure trays, drapes, swabs, sponges, absorbent pads, and instrument guards used in custom procedure pack assemblies.

Bag and container components. Injection ports, spike ports, rupture seals, and fill/drain ports for single-use bags and containers.

What unifies all of these is that the manufacturer (the medical device company) does not control the component design, the raw materials, or the manufacturing process. The supplier does. The medical device manufacturer's job is to qualify that the component is fit for its intended use in the finished device and to maintain control over time.

Regulatory Framework

ISO 13485:2016 — Clause 7.4 Purchasing

ISO 13485 Clause 7.4.1 requires manufacturers to document their purchasing processes, evaluate and select suppliers based on their ability to supply product that meets requirements, establish criteria for selection, evaluation, and re-evaluation, and maintain records of these activities. Clause 7.4.2 requires that purchasing information describe the product to be purchased, including requirements for approval of product, procedures, processes, and equipment, requirements for qualification of supplier personnel, and quality management system requirements.

Clause 7.4.3 requires verification of purchased product — inspection or other activities necessary to ensure that purchased product meets specified purchasing requirements.

FDA QMSR (21 CFR Part 820)

Effective February 2, 2026, the FDA's Quality Management System Regulation replaces the legacy QSR. QMSR incorporates ISO 13485:2016 by reference, which means the purchasing control requirements of Clause 7.4 now form the core of FDA expectations for supplier management. FDA-specific provisions (such as definitions in 820.3 and record requirements in 820.35) supplement the ISO framework.

FDA inspections will evaluate whether manufacturers have robust purchasing controls, documented supplier evaluations, and evidence of ongoing monitoring. Warning letters continue to cite inadequate supplier controls as one of the top findings.

EU MDR 2017/745 — Article 23 and Annex I

Under the EU MDR, manufacturers must ensure that components and raw materials used in their devices meet the requirements of the General Safety and Performance Requirements (GSPRs) in Annex I. Article 23 requires that devices supplied in a sterile state meet applicable sterilization standards, and that components that are critical to device safety are controlled through appropriate supplier agreements and qualification.

GHTF/IMDRF SG3/N17

The GHTF guidance document "Quality Management System — Medical Devices — Guidance on the Control of Products and Services Obtained from Suppliers" provides the foundational framework for supplier control used by both FDA and ISO 13485 auditors. It emphasizes that the manufacturer retains ultimate responsibility for the quality of purchased products and cannot delegate this through contracts.

Risk-Based Supplier and Component Classification

Not every catalog component needs the same level of qualification. ISO 13485 requires a risk-based approach to supplier management, meaning the depth and intensity of qualification activities should be proportional to the risk the component poses to device safety and performance.

Component Risk Tiers

Critical components are those where failure directly affects patient safety. Examples: fluid-path connectors on an infusion set where disconnection could cause air embolism; stopcocks on a cardiopulmonary bypass circuit; Luer connectors on a central venous catheter. These require the most rigorous qualification: on-site supplier audits, comprehensive quality agreements, biocompatibility evidence review, functional testing at incoming inspection, and the most frequent re-evaluation.

Major components affect device performance but pose indirect patient safety risk. Examples: clamps on a drainage set, extension tubing length tolerance, check valve cracking pressure. These require documented evaluation, supplier quality system assessment, and periodic monitoring.

Minor components have low impact on device quality. Examples: packaging inserts, cable ties used in assembly fixtures, non-critical labels. These can be qualified through certificate of conformance review and periodic verification.

Classification Factors

When classifying a component, consider:

• Contact type and duration with the patient or body fluids (direct patient contact, fluid path, external, no patient contact)
• Whether the component is part of a sterile barrier or sterile fluid path
• Whether failure can cause serious injury or death
• Whether the component has moving parts or critical dimensional tolerances
• Whether alternative sources exist (single-source vs. multi-source)
• The supplier's quality history and certification status

Document the risk classification rationale for each component. Auditors will ask why a particular component was classified the way it was, and the answer must trace back to your risk management file.

Qualification Process

Step 1: Define Purchasing Requirements

Before contacting a supplier, define what you need. For off-the-shelf components, this includes:

• Functional specifications. What the component must do in your device: flow rate, pressure rating, disconnect force, leak integrity, dimensional compatibility with mating components.
• Material requirements. Material of construction (e.g., polycarbonate, polypropylene, USP Class VI silicone), colorants, additives.
• Biocompatibility requirements. Based on the finished device's contact classification per ISO 10993-1, determine what biocompatibility evidence the component must have. A component in prolonged skin contact has different requirements from one in indirect blood contact.
• Sterility requirements. Does the component need to be supplied sterile? If you sterilize it after assembly, does the component material withstand your sterilization process (EtO, gamma, steam, e-beam)?
• Regulatory certifications. Does the supplier hold relevant certifications? ISO 13485, FDA device listing for components where applicable, CE marking under EU MDR.
• Packaging and labeling. Lot traceability requirements, expiration dating, packaging integrity for shipping.

Step 2: Supplier Evaluation

For off-the-shelf component suppliers, evaluation typically focuses on:

Quality system assessment. Does the supplier hold ISO 13485 certification? If so, review the scope and recency. Request the supplier's quality manual or summary. If the supplier is not ISO 13485 certified, determine whether their quality system is adequate through questionnaire, audit, or product testing. Under QMSR, FDA expects documented evidence of supplier evaluation — not just a certificate on file.

Regulatory history. Has the supplier been subject to FDA warning letters, EU non-compliance reports, or recalls affecting components similar to yours? Check the FDA warning letter database and MAUDE adverse event database.

Technical capability. Can the supplier consistently produce the component to specification? Review their process controls, measurement capability (Cpk data if available), and lot-to-lot consistency. For critical components, request process validation summaries.

Business continuity. Does the supplier have the capacity, financial stability, and business continuity plans to sustain supply? Single-source off-the-shelf components are a risk because you cannot control the supplier's decision to discontinue a catalog part.

Sub-tier transparency. Does the supplier control their own raw material sources? For components where raw material purity matters (e.g., fluid-path tubing), understand whether the supplier changes resin suppliers without notification.

Step 3: Biocompatibility and Material Safety

This is where most medical device manufacturers underestimate the work required for off-the-shelf components.

USP Class VI is not biocompatibility. USP Class VI testing (per USP <88>) evaluates the biological reactivity of plastic materials in vivo through systemic toxicity, intracutaneous reactivity, and muscle implantation tests. It is a material-level screening test, not a device-level biocompatibility assessment. Many off-the-shelf component suppliers advertise USP Class VI compliance, but this alone does not satisfy ISO 10993 requirements for the finished device.

ISO 10993 applies to the finished device, not to individual components. However, component-level biocompatibility data can support the overall biological evaluation. When a supplier provides ISO 10993 test data for a component material, review whether the testing covers the relevant endpoints for your device's contact classification and duration. A cytotoxicity test alone is not sufficient for a component in prolonged tissue contact.

Extractables and leachables. For fluid-path components, consider extractables and leachables testing. This is particularly important for components in contact with drug formulations, blood, or other body fluids. Some suppliers (particularly tubing and connector manufacturers serving the biopharma industry) provide extractables data packages. For others, you may need to conduct this testing yourself.

Sterilization compatibility. If you sterilize the assembled device after incorporating the component, verify that the component's material properties are not degraded by your sterilization process. Many off-the-shelf polypropylene components yellow or embrittle after gamma irradiation above certain doses. Silicone tubing can change durometer after repeated EtO cycles. Request the supplier's sterilization compatibility data, or test it yourself as part of qualification.

Step 4: Functional Verification

Functional verification confirms that the component performs as needed in your specific device application, not just that it meets the supplier's catalog specifications.

Dimensional verification. Measure critical dimensions on a statistically significant sample from multiple lots. Compare to both the supplier's specification and your device's acceptance criteria. Pay particular attention to interface dimensions — Luer taper dimensions, tubing inner/outer diameter, connector barb dimensions — because these affect assembly and performance.

Performance testing. Test the component under conditions that simulate your device's intended use. For connectors: leak testing at rated pressure, disconnect force, connector compatibility with mating components from other suppliers (critical for Luer systems). For tubing: burst pressure, flow rate, pump life, kink resistance. For clamps: occlusion force, slide force, closure integrity.

Assembly compatibility. Verify that the component can be consistently assembled into your device using your manufacturing process. This is particularly important for press-fit connectors, bonded joints, and overmolded assemblies where the off-the-shelf component's surface finish, dimensional tolerance, or material compatibility with your adhesive or bonding process may differ from what your design assumed.

Aging and shelf life. If the component has a stated shelf life, verify that it remains functional throughout your device's labeled shelf life. Accelerated aging studies may be needed, particularly for polymeric components that can undergo creep, stress relaxation, or material degradation over time.

Step 5: Quality Agreement

Even for off-the-shelf catalog parts, a quality agreement is essential for critical and major components. The quality agreement with a catalog supplier differs from one with a custom manufacturer because you are not specifying the design. Instead, the agreement focuses on:

• Change notification. The supplier must notify you before making changes to the component's material, manufacturing process, manufacturing site, or sub-tier suppliers. This is the single most important clause. Without it, the supplier can change a resin grade, move production to a different facility, or switch sub-suppliers without your knowledge, and the first indication may be a field complaint.
• Lot traceability. The supplier must provide lot/batch identification and traceability to raw materials. At minimum, certificates of conformance must identify the lot shipped, the specification revision, and the date of manufacture.
• Continuity of supply. For critical components, the agreement should include notification requirements if the supplier plans to discontinue the part, with sufficient lead time for you to qualify an alternative.
• Audit rights. The right to audit the supplier's facility, particularly for critical components where you rely on the supplier's quality system rather than incoming inspection.
• Deviation and CAPA notification. The supplier must notify you of deviations or CAPA activities that could affect the component's conformity.

Step 6: Incoming Inspection Strategy

ISO 13485 Clause 7.4.3 requires verification that purchased product meets purchasing requirements. For off-the-shelf components, incoming inspection strategies fall on a spectrum:

Certificate review only. Review the supplier's certificate of conformance (CoC) and certificate of analysis (CoA) for each incoming lot. Verify that the lot number, specification revision, and test results match requirements. This approach is appropriate for minor components and for suppliers with extensive quality history and robust statistical evidence of consistency.

Identity verification. Inspect the component visually and verify part number, lot number, packaging integrity, and quantity. Perform a basic identification test (e.g., material confirmation via FTIR or visual/tactile inspection). This is a middle ground suitable for major components.

Full incoming inspection. Perform dimensional measurement, functional testing, and material verification on each incoming lot using a sampling plan (e.g., ANSI/ASQ Z1.4 or an equivalent skip-lot plan). This is appropriate for critical components, new suppliers, and components with a history of nonconformances.

Skip-lot testing. After accumulating sufficient quality history (typically 10-20 consecutive conforming lots), transition to a skip-lot inspection plan where only a fraction of lots are tested. Document the statistical basis for this transition. If a lot fails, revert to 100% inspection and investigate.

Whatever strategy you choose, document it in a written incoming inspection procedure that specifies acceptance criteria, sampling plans, measurement methods, and the disposition of nonconforming material.

ISO 80369 and Connector Safety

The transition from ISO 594 to the ISO 80369 series of standards for small-bore connectors represents a significant change for device manufacturers using off-the-shelf connectors. ISO 80369 addresses misconnection risk — the danger that a connector intended for one clinical application can be physically connected to a different application's port, causing wrong-route administration.

Each part of ISO 80369 defines a unique connector design for a specific clinical application:

• ISO 80369-3: Enteral feeding connectors (ENFit)
• ISO 80369-5: Limb cuff connectors
• ISO 80369-6: Neuraxial connectors
• ISO 80369-7: Intravascular connectors (replacing ISO 594 for IV applications)

If your device uses connectors in any of these applications, you must verify that the off-the-shelf components you purchase comply with the applicable part of ISO 80369. Suppliers like Qosina and Nordson Medical now offer ISO 80369-compliant connector lines, but legacy inventory and older designs may still be in the supply chain.

Ongoing Monitoring and Re-evaluation

ISO 13485 Clause 7.4.1 requires ongoing monitoring and re-evaluation of suppliers. For off-the-shelf component suppliers, this includes:

Supplier performance metrics. Track on-time delivery, lot rejection rate, number of deviations, corrective action response time, and change notification compliance. Set thresholds that trigger escalation — for example, a rejection rate exceeding 2% triggers a supplier corrective action request and increased incoming inspection.

Periodic audits. For critical suppliers, conduct on-site audits at defined intervals (typically every 1-3 years depending on risk and performance). For major suppliers, desk audits or questionnaires may suffice. Document the audit scope, findings, and any required corrective actions.

Re-evaluation schedule. Re-evaluate suppliers at defined intervals as specified in your purchasing control procedure. This is not optional — it is a specific ISO 13485 requirement and a frequent audit finding when neglected. The ClariMed 2025 year-end checklist identified overdue supplier evaluations as one of the most common compliance gaps heading into the QMSR era.

Complaint and field data feedback. Monitor whether complaints or adverse events involving your device trace back to off-the-shelf component failures. If a connector keeps leaking, a tube keeps cracking, or a clamp keeps failing to occlude, the component qualification may need to be revisited.

Change Control: The Biggest Risk

Change control is where most problems with off-the-shelf components originate. The scenario is common and predictable: a catalog supplier changes their raw material, manufacturing process, or sub-tier supplier without adequately notifying the device manufacturer. The change seems minor to the supplier — a different plasticizer in a PVC compound, a new molding machine, a different colorant. But the change affects the finished device's biocompatibility, mechanical performance, or sterilization compatibility, and the first indication is a field complaint or a failed release test.

Why change notification fails. Catalog suppliers serve many customers across many industries. Your medical device application may represent a small fraction of their business. Their change control process may not flag your requirements, particularly if the quality agreement is vague about what constitutes a reportable change.

What to do. Be specific in your quality agreement about what changes require notification. Do not rely on language like "significant changes" because what is significant to you may not be significant to the supplier. Instead, enumerate the types of changes that require notification: raw material source changes, manufacturing site changes, process parameter changes, tooling changes, sub-tier supplier changes, specification changes, and discontinuation.

Incoming inspection as a detection net. When change notification fails, your incoming inspection is the last line of defense. If you are only reviewing certificates, you will not detect a material change. If you are performing dimensional and functional testing, you may catch changes that affect measurable attributes. If you suspect a change, request the supplier's change notification log and compare lot dates to your records.

Single-Source Risk

Many off-the-shelf components are available from only one catalog supplier. If that supplier discontinues the part, experiences a supply disruption, or fails to meet quality requirements, your manufacturing line stops. Mitigate this risk by:

• Qualifying a second source proactively. Even if you purchase primarily from one supplier, qualify an alternative for critical components. This requires testing the alternative to the same acceptance criteria, which takes time and resources.
• Maintaining safety stock. For critical single-source components, maintain inventory sufficient to bridge the gap while qualifying an alternative. The safety stock level should be based on the estimated time to qualify a replacement.
• Monitoring the supplier's business health. Watch for signs of financial distress, acquisition, or product line rationalization. A supplier being acquired often results in part number changes or discontinuation of low-volume catalog items.
• Designing for flexibility. Where possible, design your device to accept components from multiple suppliers. This may mean specifying performance requirements rather than a single part number in your Device Master Record.

Documentation and Traceability

Maintain the following records for each off-the-shelf component:

• Supplier evaluation and approval records
• Quality agreement
• Purchasing specifications (the requirements you place on the component)
• Incoming inspection records for each lot
• Biocompatibility evidence and material safety data
• Certificates of conformance and analysis
• Change notification log
• Supplier performance monitoring data
• Re-evaluation records
• Risk classification rationale

Under QMSR, these records are inspectable by the FDA. The shift to ISO 13485-aligned inspections means auditors will look for documented evidence of risk-based decision-making throughout the purchasing process. Records must demonstrate not just that you evaluated the supplier, but that your evaluation was proportional to the risk and that you made risk-informed decisions about the depth of qualification, the frequency of monitoring, and the stringency of incoming inspection.

Common Audit Findings

The most frequent findings related to off-the-shelf components in FDA inspections and ISO 13485 audits include:

• No documented supplier evaluation for catalog suppliers
• Quality agreements that do not address change notification or sub-tier control
• Incoming inspection that consists only of certificate review for critical components, without documented risk justification for why certificate review is sufficient
• No biocompatibility assessment for components in patient contact
• No re-evaluation of suppliers at defined intervals
• No documented risk classification for purchased components
• Change notifications received but not evaluated for impact on device safety and effectiveness
• Purchasing specifications that reference only a part number, without defining functional or material requirements

Addressing these before your next inspection is far less expensive than addressing them in a warning letter response.