QMSR Supplier Quality Agreement for Cloud, AI, Cybersecurity, and Testing Vendors: Clause-by-Clause Construction Guide

What This Article Covers / Does Not Cover

This article covers one document: the supplier quality agreement (SQA) that a medical device manufacturer must execute with critical outsourced vendors under FDA QMSR (21 CFR Part 820, effective 2 February 2026, incorporating ISO 13485:2016 by reference) and ISO 13485 Clause 7.4. It provides clause-by-clause construction guidance for five vendor categories that are increasingly critical in 2026: cloud hosting providers, AI model/data vendors, penetration testing firms, ASCA/non-ASCA test laboratories, and sterilization vendors.

It includes a vendor-type-to-clause matrix, sample clause language (clearly labeled as illustrative), a change notification decision tree, common auditor objections with responses, and a pre-audit evidence checklist.

This article does not cover general supplier evaluation, selection, or ranking methodology. For supplier audit checklists, see Supplier Audit Checklist. For third-party vendor cybersecurity risk management, see Medical Device Third-Party Vendor Cybersecurity Risk Management. For QMSR transition details, see QSR to QMSR Transition. For general QMS gap analysis, see QMSR Gap Analysis ISO 13485 Checklist.

Regulatory Basis

QMSR (effective 2 February 2026) incorporates ISO 13485:2016 by reference into 21 CFR Part 820. The purchasing control requirements in ISO 13485 Clause 7.4 now have the force of US federal law. Key provisions:

Additionally, FDA Section 524B (cyber devices) and the updated FDA cybersecurity guidance (February 2026) require manufacturers to extend cybersecurity oversight to third-party software, cloud, and service components. MITRE's April 2026 publication on cybersecurity risk analysis for medical devices explicitly addresses shared security responsibilities for cloud and AI/ML vendors.

Vendor Classification and SQA Requirement Matrix

Not every vendor needs a full quality agreement. Use this classification to determine SQA depth:

Clause-by-Clause Construction Guide

The following sections provide the specific clauses to include in an SQA for each critical vendor type. Language is illustrative — adapt to your organization's templates.

Clause 1: Scope and Outsourced Activities

Purpose: Define exactly what the vendor does that affects device quality, safety, or cybersecurity. Per ISO 13485 Clause 4.1.5, the manufacturer retains full regulatory responsibility for outsourced processes.

Illustrative language:

"This Quality Agreement applies to the following outsourced activities performed by [Vendor Name] on behalf of [Manufacturer Name]: [specific activities]. [Manufacturer Name] retains full regulatory responsibility for these outsourced activities as required by ISO 13485:2016 Clause 4.1.5 and 21 CFR Part 820 (QMSR)."

Clause 2: Regulatory Compliance and Certifications

Purpose: Document the vendor's applicable certifications and regulatory status.

Illustrative language:

"[Vendor Name] shall maintain the following certifications and accreditations: [list]. [Vendor Name] shall notify [Manufacturer Name] within [5 business days] of any change in certification status, scope, or accreditation, including suspension, withdrawal, or voluntary relinquishment."

Clause 3: Change Notification

Purpose: Ensure the vendor notifies the manufacturer before implementing changes that could affect product quality, safety, cybersecurity, or regulatory status.

Decision tree for change notification:

VENDOR PROPOSED CHANGE
│
├─► Does the change affect product quality, safety, or cybersecurity?
│    ├─ YES → Requires written notification [X days] before implementation
│    │    ├─ Does the change affect device specifications or intended use?
│    │    │    ├─ YES → Requires manufacturer written approval before implementation
│    │    │    └─ NO → Notification only; manufacturer has [X days] to object
│    │    └─ Does the change affect the vendor's certification/accreditation?
│    │         ├─ YES → Immediate notification; manufacturer re-evaluates vendor
│    │         └─ NO → Proceed with standard change notification
│    └─ NO → No notification required; document in vendor's internal change log

Vendor-specific change triggers:

Illustrative language:

"[Vendor Name] shall not implement any change that could affect the quality, safety, efficacy, or regulatory compliance of the outsourced services without prior written notification to [Manufacturer Name]. Changes requiring notification include but are not limited to: [list from table above]. [Manufacturer Name] shall have [15 business days] from receipt of notification to provide written approval, objection, or request for additional information."

Clause 4: Vulnerability and Security Incident Notification

Purpose: For cloud, AI, and cybersecurity vendors, define how and when security vulnerabilities and incidents are reported.

Illustrative language:

"[Vendor Name] shall notify [Manufacturer Name] within [24 hours] of becoming aware of any security vulnerability rated CVSS 7.0 or above that affects the services provided under this Agreement, or any security incident involving [Manufacturer Name]'s data or systems. Notification shall include: vulnerability description and CVSS score, affected components, known exploitability, interim compensating controls, and estimated remediation timeline. [Manufacturer Name] reserves the right to invoke its Product Security Incident Response Team (PSIRT) process and to coordinate public disclosure timing in accordance with its coordinated vulnerability disclosure policy."

For more on vulnerability triage, see SBOM-to-VEX Vulnerability Triage Workflow.

Clause 5: Audit Rights

Purpose: Reserve the manufacturer's right to audit the vendor's facilities, processes, and records.

Illustrative language:

"[Manufacturer Name] reserves the right to audit [Vendor Name]'s facilities, processes, records, and sub-contractors relevant to the outsourced activities described in this Agreement. Audits may be conducted with [30 days] prior written notice for scheduled audits, or without prior notice in the event of a quality or safety concern. [Vendor Name] shall provide reasonable access to relevant personnel, documentation, and systems during audits. Audit findings shall be addressed through [Vendor Name]'s corrective action process, with responses provided to [Manufacturer Name] within [15 business days] of audit report issuance."

Clause 6: CAPA Cooperation

Purpose: Define how the vendor participates in the manufacturer's corrective and preventive action process.

Illustrative language:

"In the event that a nonconformance, complaint, or adverse event is attributable to or involves the services provided by [Vendor Name], [Vendor Name] shall cooperate fully with [Manufacturer Name]'s investigation and CAPA process. This includes providing relevant records, participating in root cause analysis, implementing agreed corrective actions, and providing objective evidence of effectiveness. [Vendor Name] shall respond to SCARs (Supplier Corrective Action Requests) within [15 business days]."

Clause 7: Records and Documentation

Purpose: Define what records the vendor must maintain and make available.

Clause 8: Sub-Contracting and Sub-Processing

Purpose: Control the vendor's use of sub-contractors who may affect product quality.

Illustrative language:

"[Vendor Name] shall not sub-contract any portion of the outsourced activities described in this Agreement without prior written approval from [Manufacturer Name]. Where sub-contracting is approved, [Vendor Name] shall: (a) ensure the sub-contractor meets equivalent quality and regulatory requirements, (b) maintain a quality agreement or equivalent controls with the sub-contractor, (c) remain fully responsible for the sub-contractor's performance, and (d) notify [Manufacturer Name] of any sub-contractor changes. For cloud hosting services, [Vendor Name] shall maintain a current list of sub-processors and notify [Manufacturer Name] of additions or changes at least [30 days] before they take effect."

Common Auditor Objections and How to Address Them

Pre-Audit Evidence Checklist

Before your next FDA inspection or ISO 13485 surveillance audit, verify the following for each critical vendor:

• SQA executed: Quality agreement signed by both parties, current version
• Scope defined: Outsourced activities clearly enumerated per ISO 13485 Clause 4.1.5
• Certifications current: Vendor certification copies on file; expiration dates tracked; renewal monitoring in place
• Change notification clause: Specific change triggers enumerated per vendor type; notification timeline defined
• Vulnerability notification clause (cloud/AI/cybersecurity vendors): CVSS thresholds, timelines, PSIRT coordination defined
• Audit rights clause: Reserved in SQA; audit schedule defined; last audit report on file
• CAPA cooperation clause: SCAR process defined; response timelines specified; last SCAR on file with closure evidence
• Records clause: Retention period specified (minimum 10 years); record types enumerated; access guaranteed
• Sub-contracting clause: Prior approval required; sub-contractor list maintained; quality controls specified
• ASCA accreditation verification (test labs): Verified on FDA ASCA list within last 30 days; status change notification clause in SQA
• Annual vendor review: Vendor performance review completed per ISO 13485 Clause 7.4.1; documented in QMS
• Risk assessment: Vendor risk classification documented; controls commensurate with risk level

Sample SQA Template Structure

For those building from scratch, use this section order:

1. Parties and Effective Date
2. Scope of Outsourced Activities (Clause 4.1.5 reference)
3. Regulatory Framework (ISO 13485, QMSR, FDA Section 524B where applicable)
4. Vendor Certifications and Qualifications
5. Requirements and Specifications (product/service specifications per Clause 7.4.2)
6. Change Notification (enumerated triggers, timelines, approval requirements)
7. Vulnerability and Security Incident Notification (for cloud/AI/cybersecurity vendors)
8. Verification and Acceptance (Clause 7.4.3 — how manufacturer verifies purchased product/service)
9. Audit Rights (scheduled, unscheduled, remote, on-site)
10. CAPA Cooperation and Complaint Handling
11. Records and Documentation (types, retention, access)
12. Sub-Contracting and Sub-Processing Controls
13. Confidentiality and Data Protection
14. Term, Termination, and Transition (data return/destruction upon termination)
15. Dispute Resolution
16. Signatures and Date

Key Regulatory References

Internal Links

• QSR to QMSR Transition — QMSR overview
• QMSR Gap Analysis ISO 13485 Checklist — QMSR compliance mapping
• Supplier Audit Checklist — supplier audit procedures
• Medical Device Third-Party Vendor Cybersecurity Risk Management — vendor cybersecurity
• FDA ASCA Test Report Acceptance Package — ASCA evidence package
• SBOM-to-VEX Vulnerability Triage Workflow — vulnerability triage
• CAPA Guide — corrective and preventive actions
• ISO 13485 Implementation Guide — QMS implementation
• Contract Manufacturing Organization Selection — CMO quality agreements
• FDA QMSR Inspection Preparation — FDA inspection readiness