Outsourced Device Testing: What Raw Data Must Your Contract Deliver?

The Contract Question Is Reconstruction, Not a Prettier PDF

When a medical device manufacturer outsources safety or bench performance testing, the commercial deliverable offered by default is often a signed summary report: a pass/fail matrix, a laboratory seal, and a director signature. For many project managers racing toward a 510(k) submission, that polished document appears to represent the completion of the milestone. For FDA reviewers and BIMO investigators, a summary is an assertion—it is not the primary evidence.

The core regulatory question governing outsourced testing is not whether a report looks authoritative, but whether the testing documentation allows a competent third party to independently reconstruct and evaluate the study from original observations. If a regulatory reviewer raises a technical challenge during substantive review, or if an FDA investigator conducts a Bioresearch Monitoring (BIMO) inspection, the manufacturer must be able to substantiate data points, calculations, environmental conditions, and specimen configuration. Informal goodwill that the laboratory will keep those records is not a reconstruction package.

On 20 February 2024, FDA issued a letter reminding sponsors and manufacturers to evaluate third parties that conduct performance testing and to independently verify testing results before submitting them. The agency reported that third-party test labs have generated fabricated data, data duplicated from other device submissions, or otherwise unreliable data, including from numerous facilities in China and India, leaving FDA unable to authorize devices and calling the integrity of the entire file into question. Partnering with a laboratory voluntarily accredited under ASCA does not relieve the device manufacturer of its duty to independently qualify suppliers and scrutinize all submitted data.

This guide establishes the concrete contractual requirements that medical device regulatory affairs (RA) and quality assurance (QA) teams must enforce when drafting testing agreements, quality agreements, and master service agreements (MSAs) with contract research organizations (CROs) and commercial test facilities. It delineates the boundaries between premarket submission files, manufacturer design records, primary raw data, and long-term archival obligations under 21 CFR Part 58 (GLP) and 21 CFR Part 820 (QMSR).

Four Deliverable Layers: FDA File, Complete Results, Raw Data, Archive

A widespread point of confusion among medical device development teams is conflating what is submitted to the FDA in an electronic submission file (such as an eSTAR package) with what must be delivered by the contract laboratory and maintained inside the manufacturer’s Design History File (DHF). To maintain absolute regulatory control, device manufacturers must partition outsourced testing deliverables into four distinct operational layers.

flowchart TD
  subgraph L1["Layer 1: Premarket Submission File"]
    direction TB
    A1["Test Report Summary"]
    A2["ASCA Summary Test Report"]
    A3["Declaration of Conformity (DoC)"]
    A4["Complete Test Report (when mandated)"]
  end

  subgraph L2["Layer 2: Complete Test Report & Results"]
    direction TB
    B1["Approved Protocol & Deviations"]
    B2["Individual Specimen Data"]
    B3["Statistical Transformations"]
    B4["Contributing Scientist Signatures"]
  end

  subgraph L3["Layer 3: Reconstruction-Grade Raw Data"]
    direction TB
    C1["Contemporaneous Bench Worksheets"]
    C2["Native Instrument Data & Spectra"]
    C3["Machine Calibration Logs"]
    C4["Raw Photographs & Audit Trails"]
  end

  subgraph L4["Layer 4: Custody, Archival & Transfer"]
    direction TB
    D1["Designated Archive Location"]
    D2["Dual-Clock Retention Matrix"]
    D3["MDSAP / BIMO Audit Inspection Rights"]
    D4["Mandatory Transfer-on-Closure Covenant"]
  end

  L3 -->|Synthesized Into| L2
  L2 -->|Abstracted Into| L1
  L3 -.->|Governed by Archival Terms| L4
  L2 -.->|Preserved in DHF / QMS| L4
  L1 -->|Submitted to| FDA["FDA / Notified Body"]

Each layer serves a different legal purpose, resides in a different repository, and requires distinct contractual specifications before laboratory work commences.

When structuring commercial contracts with testing laboratories, RA/QA leaders must ensure that deliverables are not defined solely as Layer 1 artifacts. A contract that only obligates the laboratory to deliver an “FDA submission-ready test report” leaves the manufacturer completely vulnerable at Layers 2, 3, and 4.

When Part 58 Raw Data Is a Legal Object—and When It Is Not

In discussions surrounding medical device testing, professionals frequently misuse the term “GLP” (Good Laboratory Practice). It is commonplace to hear project teams demand “GLP raw data” for standard mechanical pull testing, or claim that an electromagnetic compatibility (EMC) test was “performed under GLP.” In the U.S. regulatory system, Good Laboratory Practice is not a colloquial synonym for good laboratory technique; it is a rigid federal regulation codified at 21 CFR Part 58.

The Legal Definition of Raw Data Under 21 CFR 58.3(k)

Under 21 CFR 58.3(k), raw data is defined with exacting legal precision as:

This definition establishes that raw data is not merely the final table of calculated averages; it encompasses the original, unmanipulated observations—whether recorded in wet ink on paper laboratory worksheets or captured as binary bitstreams by automated instrument detectors.

The Scope of Part 58 and the “GLP-Washing” Trap

Pursuant to 21 CFR 58.1, Part 58 prescribes GLP for nonclinical laboratory studies that support or are intended to support FDA research or marketing permits, including medical devices for human use, to assure the quality and integrity of safety data. 21 CFR 58.3(d) defines a nonclinical laboratory study as in vivo or in vitro experiments in which test articles are studied prospectively in test systems under laboratory conditions to determine their safety. The regulation explicitly excludes:

• Studies utilizing human subjects, clinical studies, or field trials in animals; and

• Basic exploratory studies carried out to determine whether a test article has any potential utility, or studies carried out only to determine physical or chemical characteristics of a test article.

This exclusion is critical: routine physical, mechanical, electrical, and dimensional testing (e.g., tensile testing, burst strength, fatigue testing, drop testing, EMC, or accelerated aging) are not Part 58 nonclinical laboratory studies. They are design verification activities governed by design controls under 21 CFR Part 820 (QMSR) and design verification, not Part 58. Labeling an ordinary tensile or EMC test as “GLP compliant” is GLP-washing. If a study is claimed as GLP, BIMO inspectors will evaluate it against Part 58, including study director designation, QAU inspections, and facility procedures. Missing those controls is noncompliance with the claimed GLP status, not a colloquial label.

Conversely, nonclinical safety evaluations—such as ISO 10993 biocompatibility assays involving living test systems (for example cytotoxicity, systemic toxicity, sensitization, intracutaneous reactivity, implantation, and genotoxicity) are the kind of prospective safety experiments 58.3(d) describes. That is not a claim that every ISO 10993 activity is automatically a Part 58 study: chemical characterization that only determines physical or chemical characteristics can fall outside the nonclinical-laboratory-study definition even when Attachment E still wants a complete test report in the FDA file. Under 21 CFR 814.20(b)(6), a PMA’s nonclinical laboratory studies section must include a statement that each such study was conducted in compliance with Part 58, or a brief statement of the reason for noncompliance. That PMA content rule is not a claim that every 510(k) bench test is a GLP study.

GLP Final Report Mandates and the Insolvency Transfer Rule

When Part 58 applies, 21 CFR 58.185 dictates the mandatory contents of the final study report. Beyond methods, test systems, calculations, and signed contributing-scientist reports, the final report must contain two specific operational declarations:

1. The Storage Locations of All Artifacts: Under 21 CFR 58.185(a)(13), the final report must state the exact locations where all specimens, raw data, and the final report are to be stored.

2. The Quality Assurance Unit Statement: Under 21 CFR 58.35(b)(7) and 58.185(a)(14), the report must include a signed QAU statement specifying the dates inspections were made and findings reported to management and the study director. Separately, 58.35(b)(6) requires the QAU to review the final study report to assure that reported results accurately reflect the raw data. Those are two duties, not one certification sentence.

21 CFR 58.130 also governs how those original observations are made. Non-automated data must be recorded directly, promptly, and legibly in ink, dated, and signed or initialed; changes must not obscure the original entry and must state a reason. For automated collection, the person responsible for direct data input must be identified; changes must not obscure the original entry and must be dated and explained. A quality agreement that only orders a signed PDF does not capture those contemporaneous records.

Furthermore, 21 CFR 58.190 and 58.195 govern archival and retention. All raw data, documentation, protocols, final reports, and specimens (with the wet-specimen exceptions in 58.195(c)) must be retained in an indexed archive with limited access. Retention periods in 21 CFR 58.195(b) are the shortest of: at least 2 years following FDA approval of the supported research or marketing permit (IND and IDE records instead follow 58.195(b)(2)); at least 5 years following the date results are submitted to FDA; or, if the study is not submitted, at least 2 years after the study is completed, terminated, or discontinued. 58.195(a) states that these periods do not supersede other 21 CFR retention duties. 58.195(g) allows original records or true copies.

21 CFR 58.195(h)—not 58.195(g)—is the close-out rule that must be mirrored in the contract: If a facility conducting nonclinical testing goes out of business, all raw data, documentation, and other material specified in this section shall be transferred to the archives of the sponsor of the study. The Food and Drug Administration shall be notified in writing of such a transfer. The archive may remain at the laboratory if it is indexed and retrievable; the manufacturer still needs contractual access and a transfer plan. If the quality agreement does not name the archive, grant retrieval and inspection rights, and require transfer-on-closure with FDA notice when Part 58 applies, the sponsor can lose the reconstruction package when the laboratory closes or is acquired.

Non-GLP Bench Performance: Summaries Versus Complete Test Reports

While safety testing follows Part 58, the vast majority of physical testing outsourced by medical device companies consists of non-clinical bench performance testing. In September 2019, the FDA finalized its guidance, Recommended Content and Format of Non-Clinical Bench Performance Testing Information in Premarket Submissions. This guidance establishes how testing performed by both internal teams and third-party laboratories should be documented.

For this guidance, non-clinical bench performance testing is performance testing done by the manufacturer or a third-party testing facility. It includes, but is not limited to, mechanical and biological engineering performance (such as fatigue, wear, tensile strength, compression, and burst pressure); bench tests using ex vivo, in vitro, and in situ animal or human tissue; and animal-carcass or human cadaveric testing. The same document explicitly excludes several categories that have their own guidances:

• Biocompatibility testing (governed by ISO 10993-1 guidance);

• Reprocessing and sterilization validation;

• Human factors and usability engineering validation;

• Software verification and validation (SaMD / SiMD);

• Computational modeling studies;

• Clinical investigations and animal studies; and

• In vitro diagnostic (IVD) performance characteristic studies.

Complete Test Reports Versus Test Report Summaries

For applicable bench testing, the FDA outlines two presentation formats: Test Report Summaries and Complete Test Reports. The FDA recommends that premarket submissions include test report summaries for all bench performance tests, accompanied by complete test reports when appropriate.

A complete test report means the entirety of the testing documentation for a study. It may be one document or several (for example a protocol plus a report). FDA recommends that complete test reports identify:

1. Test Description and Objective: The test that was performed and the purpose of that test.

2. Test Article Identification: Device description and sample identification, including sample size.

3. Methods and Standards: Test methods and applicable standards, including deviations from recognized consensus standards.

4. Acceptance Criteria: For the companion test-report summary, acceptance criteria with clinical, scientific, or engineering justification. That summary element is not a license to omit the complete report from the manufacturer’s records.

5. Deviations and Anomalies: Unexpected results and significant deviations, with an explanation of how they do not affect the overall conclusion.

6. Complete Results and Discussion: Results, including pass/fail or descriptive values as applicable. Summaries, protocols, and reports should be clear, legible, and in English or accompanied by English translations.

The FDA notes that complete test reports are typically not necessary inside Special 510(k) submissions and for some testing in Abbreviated 510(k)s, consistent with least-burdensome review. “When appropriate” remains a case-by-case review judgment for Traditional 510(k)s, De Novo requests, IDEs, HDEs, and PMAs. That file-brevity rule does not tell the laboratory it may withhold the complete testing documentation from the manufacturer.

For non-ASCA use of recognized consensus standards, FDA’s September 2018 guidance Appropriate Use of Voluntary Consensus Standards in Premarket Submissions for Medical Devices still governs when a declaration of conformity should be accompanied by a complete test report or other supplemental documentation, depending on whether the standard includes test methods and acceptance criteria. A declaration of conformity is the manufacturer’s statement, not the laboratory’s certificate alone, and must not be promissory. Deviations from the normative standard change what supporting documentation is needed.

Biocompatibility and Chemical Characterization: Attachment E Still Wants Complete Reports

Biocompatibility evaluations sit at the intersection of material science, toxicology, and regulatory compliance. Under the FDA’s guidance, Use of International Standard ISO 10993-1, “Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process” (issued September 2023), the agency provides explicit expectations for biological safety documentation in Attachment E: “Biocompatibility Test Report Information.”

Attachment E establishes a definitive policy: Whenever biocompatibility or chemical characterization testing information is included in a premarket submission, the FDA recommends providing complete test reports for all tests performed. The only exceptions recognized by the agency are:

• When the testing was conducted under the ASCA program and an ASCA Summary Test Report is sufficient; or

• When an unsupplemented Declaration of Conformity to an FDA-recognized standard is appropriate under the voluntary consensus standards policy.

Dual-Burden Reporting for GLP Biocompatibility

For biocompatibility studies that are governed by 21 CFR Part 58 (for example animal implantation or systemic toxicity), the laboratory deliverable has a dual burden: it must meet 21 CFR 58.185 reporting, and all test reports—GLP and non-GLP—should also include the sections in Attachment E and the reporting provisions of any referenced standard. Attachment E is a submission-content recommendation, not a laboratory commercial catalog.

Chemical Characterization Complete Reports and Reconstruction Files

Attachment E also covers chemical characterization information in a submission. A table of detected compounds is not a complete test report. Because 58.3(d) can exclude studies that only determine physical or chemical characteristics from the GLP definition, this is usually a complete-report and purchasing-control problem, not a Part 58 raw-data object. Before samples ship, the quality agreement should still require reconstruction-grade files the manufacturer can use to independently assess third-party data after FDA’s 2024 letter, including:

• The complete test report, including methods, sample identity, extraction or preparation conditions as actually performed, deviations, and results;

• Original instrument observations or exact copies sufficient to evaluate the report (chromatograms, spectra, integration or processing records, blanks, and calibration records as applicable);

• How identifications and quantified results were derived, including any library matches and the reason for excluding signals; and

• Named archive location, retention that meets the longest applicable of Part 58 (if it applies) and QMSR record control, and copy rights in human-readable and electronic form.

• Subcontractor flow-down if a contributing analytical laboratory performs part of the work.

If a laboratory withholds original instrument records as “proprietary methods,” the manufacturer cannot independently assess the data FDA told firms to scrutinize. That is a purchasing-control and quality-agreement failure, not a claim that any particular analytical standard’s clause text is reproduced here.

ASCA: Unadulterated Summaries in the File, Complete Results to the Manufacturer

ASCA is a voluntary program. ASCA-accredited laboratories work to ISO/IEC 17025:2017 plus FDA program specifications, currently covering listed biocompatibility and basic safety and essential performance standards (including EMC methods in that family). It is designed so that an unadulterated ASCA Summary Test Report plus a declaration of conformity usually reduces what FDA intends to re-review about testing methodologies. Other recognized standards remain eligible for ordinary declarations of conformity; they do not receive ASCA file-brevity unless they are in the ASCA scope.

Under the ASCA model, an accredited testing laboratory evaluates the medical device and completes a standardized ASCA Summary Test Report. The manufacturer includes that summary, as received, to support a declaration of conformity, together with a cover letter stating that the submission contains an ASCA Summary Test Report from an ASCA-accredited laboratory. When those criteria are met, FDA has said it will have confidence in the laboratory’s methods and results and does not intend to request additional information regarding testing methodologies. That is a review-efficiency statement, not a statement that FDA will never request a complete report, and not a statement that the manufacturer may discard complete results.

The ASCA Manufacturer Receipt Rule

Because FDA rarely requested complete test reports in 2025 ASCA-supported reviews, some commercial laboratories market ASCA testing as a summary-only package or treat complete results as an optional surcharge. FDA’s manufacturer page describes a different workflow.

FDA’s manufacturer page, Manufacturers: How to Participate in ASCA, describes this workflow: The testing laboratory conducts testing and submits the complete test results and Summary Test Report(s) to the manufacturer. The manufacturer includes the Summary Test Report as received from the laboratory, with no changes, additions, or deletions, to support a declaration of conformity. ASCA does not alter the manufacturer’s responsibility to document how testing supports premarket authorization. Submissions with ASCA testing generally do not need to include complete test reports associated with ASCA standards unless recommended in the standards-specific guidance or if deviations from the standard are noted.

The FDA calendar year 2025 ASCA Annual Report provides illuminating empirical evidence regarding the program’s operational reliability:

While these statistics show that FDA requested complete reports in 1 of 136 submissions, that file-brevity rate is not a legal exemption for the manufacturer to discard or fail to collect complete results. ASCA does not modify the manufacturer’s responsibility to document how testing supports authorization, populate design and purchasing records, or survive QMS and BIMO inspection.

The FDA-Initiated Withdrawal Trigger

On 18 September 2025, FDA updated the ASCA-accredited laboratory database with a new status: “FDA Initiated Withdrawal.” During audits, FDA determined that certain laboratories did not meet FD&C Act section 514(d) and related ASCA program guidances; in some cases it identified data-integrity concerns. ASCA Summary Test Reports from laboratories with that status will no longer be accepted. The contract should require notice of any suspension, withdrawal, or scope change that affects issued reports, and should preserve the manufacturer’s right to the complete results already generated.

That status can change after a report is issued. Select the laboratory against its current ASCA scope using the ISO/IEC 17025 laboratory-selection and ASCA packaging articles already on this site, and write notification plus complete-results delivery into the quality agreement so a later withdrawal does not leave the manufacturer with only a summary it can no longer file.

QMSR Purchasing: Laboratory Evidence Is a Specified Purchased Service

On February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) final rule took full legal effect, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference (21 CFR 820.7 and 820.10). Under the QMSR framework, external laboratory testing is not an informal vendor consultation; it is a purchased service and an outsourced process that directly impacts product conformity.

ISO 13485 Clause 7.4 and Outsourced Processes

The QMSR final rule maps purchasing to ISO 13485 Clause 7.4. MDSAP purchasing tasks expect documented purchasing information covering, where appropriate, procedures, processes, equipment, personnel qualification, sterilization services, and other QMS requirements, plus a current view of outsourced processes and critical suppliers. Outsourced laboratory testing that affects product conformity is a purchased process/service the manufacturer must specify and control. This page does not reproduce paywalled ISO clause text. Operational checkpoints include:

• Supplier evaluation and selection: Criteria for evaluation, selection, and monitoring of test laboratories based on their ability to supply testing that meets specified requirements. Using an ASCA-accredited laboratory does not substitute for that qualification.

• Purchasing information: Documented purchasing information describing, where appropriate, requirements for approval of product, procedures, processes, and equipment, qualification of personnel, and quality-management-system requirements related to the purchased testing.

• Verification of purchased testing: Inspection or other activities necessary to ensure that purchased testing meets specified purchase requirements—including a manufacturer QC of the complete report against the protocol and reconstruction files—not a signature on a cover page.

Under the Medical Device Single Audit Program (MDSAP) audit approach, auditors sample purchasing and outsourced-process controls. Documented purchasing information includes, where appropriate, requirements for approval of product, procedures, processes, equipment, qualification of personnel, sterilization services, and other QMS requirements. Organizations must determine the extent of outsourcing of processes that affect product conformity and keep the critical-supplier list current. This article does not assign those expectations to a single MDSAP task number, because AU P0002 still cites historical 21 CFR 820.50 numbering in places.

Reconciling the Dual-Retention Clocks: Part 58 Versus QMSR

A frequent nonconformity is destroying testing records at the Part 58 floor. 21 CFR 58.195(b) can permit disposal 2 years after approval or 5 years after submission, whichever of the listed clocks is shortest. Under QMSR, laboratory evidence used as a QMS record is also subject to ISO 13485 Clause 4.2.5 as incorporated plus the additional U.S. content in 21 CFR 820.35. This page does not reprint the ISO retention-period sentence.

Because 21 CFR 58.195(a) states that Part 58 retention does not supersede other 21 CFR duties, the quality agreement should keep test records for the longest applicable duration across Part 58 and QMSR record control. Invented device-lifetime years are not quoted here; the manufacturer defines lifetime in its own QMS and then applies the longer of that duty and the GLP floor.

Electronic Copies, Audit Trails, and Independent Scrutiny After the 2024 FDA Letter

When testing laboratories utilize computerized systems—such as Laboratory Information Management Systems (LIMS), automated chromatographic data systems (CDS), or digital tensile software—the resulting records are electronic records governed by 21 CFR Part 11. Part 11 applies when electronic records are used to meet a predicate-rule record requirement (including Part 58 and Part 820 records). A paper-only GLP study is not automatically a Part 11 system.

21 CFR 11.10 Controls for Closed Systems

Under 21 CFR 11.10, testing facilities operating closed electronic systems must execute documented procedures and technical controls to ensure record authenticity and integrity. Key contractual requirements include:

• Generation of Accurate Copies (11.10(b)): The system must maintain the ability to generate accurate and complete copies of records in both human-readable and electronic form suitable for inspection, review, and copying by the agency.

• Protection of Records (11.10(c)): Protection of records to enable their accurate and ready retrieval throughout the required records retention period.

• Computer-Generated Audit Trails (11.10(e)): Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes must not obscure previously recorded information.

Independent Scrutiny in Practice

In its 20 February 2024 letter, FDA told device firms to qualify third-party labs and closely scrutinize testing data they did not generate, especially biocompatibility and other performance testing. FDA also said it may be difficult for an individual firm to know if data were copied from an unrelated marketing submission, and that it expects firms to identify results that are improbable or impossible on their face or inconsistent with known information about the device. Independent scrutiny is not a claim that a reviewer can detect every duplicated data set. Practical checks upon receipt include:

1. Sample Accountability and Traceability: Verify that the quantity, lot numbers, serial numbers, packaging configurations, and sterilization states of specimens received by the laboratory precisely match internal shipping manifests and Device History Records (DHR).

2. Chronological and Environmental Consistency: Check instrument run timestamps against technician timesheets, calibration logs, and environmental chamber monitoring records. Verify that tests were not purportedly performed during scheduled equipment downtime or maintenance intervals.

3. Forensic Evaluation of Analytical Baselines: Identical baseline curves or identical retention profiles across distinct physical samples are a reason to investigate possible duplication; they are not, by themselves, proof that a data set was copied from another submission.

4. Independent Recalculation of Derived Endpoints: Extract raw force-displacement data, voltage outputs, or titration values and recalculate all reported means, standard deviations, and percentage recoveries using validated internal statistical tools. Confirm that manual peak integrations were justified and documented.

Pre-Shipment Quality-Agreement Checklist and Close-Out Acceptance

To guarantee that your organization receives the necessary evidentiary deliverables, testing terms must be locked down before test articles leave your loading dock. Attempting to negotiate raw data access or archive transfer rights after testing is completed and invoices are settled results in costly commercial disputes and prolonged submission delays.

Before shipping test samples, RA/QA should lock a quality agreement. The following eight exhibits are an evidence-mapped checklist, not model legal clauses and not FDA-required form language:

1. Exhibit 1: Revision-Controlled Protocol Freeze: A formal covenant that testing will be executed strictly against an approved, revision-controlled protocol signed by both the manufacturer and the laboratory Study Director / Technical Lead. The agreement must state that no deviations or modifications may be implemented without prior written authorization from the sponsor.

2. Exhibit 2: Granular Deliverables Schedule: A contractually binding exhibit itemizing artifacts across Layers 1, 2, and 3: the test-report summary, the complete test report, contemporaneous worksheets, native instrument files or exact copies, calibration records for measurement equipment used, and signed contributing-scientist statements when Part 58 applies.

3. Exhibit 3: Non-Proprietary Digital Formats: A clause specifying export formats and copy rights so the manufacturer can generate accurate and complete copies in human-readable and electronic form for FDA inspection, without asserting that a laboratory LIMS is “Part 11 certified.”

4. Exhibit 4: Archive Location and Dual-Clock Retention: Named archive location for raw data and specimens. Retention is the longest applicable of 21 CFR 58.195 and QMSR record control (ISO 13485 Clause 4.2.5 as incorporated plus 21 CFR 820.35), without reprinting ISO retention-period text.

5. Exhibit 5: Subcontractor and Tier-2 Restrictions: No unauthorized secondary subcontracting. Any contributing laboratory (for example a secondary analytical chemistry lab or histology facility) should be pre-approved in writing and bound by the same delivery, QAU, audit, and transfer obligations that apply to the primary laboratory.

6. Exhibit 6: Mandatory Transfer-on-Closure Covenant: Direct contractual incorporation of 21 CFR 58.195(h) when Part 58 applies, plus a commercial close-out plan: if the laboratory closes, is insolvent, or is acquired, specified raw data, documentation, and other material transfer to the sponsor’s archives, with written FDA notice. 58.195(g) separately allows true copies in place of original paper.

7. Exhibit 7: Regulatory and ASCA Status Notification: An obligation for the laboratory to notify the manufacturer in writing, promptly and without an invented calendar, of any FDA Form 483, Warning Letter, BIMO inspection that affects the study, ISO/IEC 17025 accreditation suspension, or FDA Initiated Withdrawal under ASCA.

8. Exhibit 8: Audit and Inspection Rights: A contractual grant of on-site and remote audit rights for the manufacturer’s quality auditors and for FDA BIMO investigators, including access to procedures, training records, calibration logs, and computerized-system audit trails as applicable. Dual-market firms may add notified-body access by separate agreement; that is not an FDA Part 58 term.

Incoming QA Receipt and Close-Out Acceptance Workflow

Upon receipt of the testing package from the contract facility, the manufacturer’s QA team must execute a structured technical acceptance procedure before approving the milestone payment or incorporating the reports into the DHF:

• Reconcile all sample serial numbers, lot numbers, and returned unused test articles against the shipping manifest;

• Verify that the final test report contains all mandatory signatures (Study Director, contributing scientists, and QAU statement if GLP);

• Confirm that the report explicitly lists the storage locations of specimens, raw data, and master records;

• Ensure that protocol deviations are documented, technically explained, and approved by the sponsor before the report is accepted into the DHF;

• Archive the complete report, raw data package, and electronic audit logs in the company’s validated electronic document management system (eQMS) under appropriate DHF change control; and

• Place unadulterated ASCA Summary Test Reports, manufacturer declarations of conformity, and test-report summaries into the premarket file only after the manufacturer has received the complete results.

What This Page Does Not Decide

This guide establishes standard regulatory engineering and quality assurance best practices for managing outsourced medical device testing data. However, readers must recognize the specific methodological and operational boundaries of this information:

• Not Individualized Legal Advice: This guide provides regulatory and quality agreement checklists, not formal legal contracts. Master service agreements and liability allocation terms should be reviewed by qualified legal counsel specialized in life sciences contracting.

• No Reproduction of Copyrighted Standards: This publication does not reproduce copyrighted clause text from ISO 13485:2016, ISO/IEC 17025:2017, or the ISO 10993 series. Readers must obtain official copies of these standards from ISO or ANSI.

• Device-Specific Protocol Design Excluded: Acceptance criteria, sample sizes, and testing parameters depend entirely on the specific device classification, clinical indication for use, material composition, and risk management outputs under ISO 14971. This guide does not formulate technical protocols for any specific product code.

• Commercial SKU Realities: Summary-only commercial testing options exist. Using them is not inherently illegal. Treating an FDA-file summary, ASCA Summary Test Report, or declaration of conformity as permission for the laboratory to withhold complete results from the manufacturer is the risk this page maps.

• No Detection Guarantee: FDA’s 2024 letter states it may be difficult for an individual firm to know whether data were copied from an unrelated marketing submission. Independent assessment of complete results is required; it is not a claim that visual or statistical review will find every duplicated data set.

• Draft ASCA Guidances: Draft ASCA program and standards-specific guidances issued 23 September 2024 are not treated as finalized. Manufacturer-facing ASCA pages and the calendar-year 2025 annual report are used for current operating practice.

• No Invented Demand Metrics: This page does not invent search volume, typical laboratory prices, or a ranked list of “safe” contract labs.