ISO 13485:2016 Medical Device Assembly Suppliers

The single requirement that most distinguishes ISO 13485 assembly from commercial work is clause 7.5.6, validation of processes for production and service provision. When the output of an assembly step cannot be fully verified by subsequent inspection, the process itself must be validated and the validation documented. For device assembly this captures the steps that matter most: adhesive bonding, ultrasonic and laser welding, heat staking, sterile barrier sealing, and torque-controlled fastening where the joint integrity cannot be non-destructively confirmed. Validation under ISO 13485 follows the familiar IQ/OQ/PQ structure. Installation qualification confirms the equipment is installed and operating to specification; operational qualification establishes the process window across the range of inputs; performance qualification demonstrates the process produces conforming product consistently under production conditions. Each is documented with a protocol and a report, and the validated parameters become controlled. A change to a validated process triggers revalidation under clause 7.5.6 and a change-control record. Clause 7.5.9 on traceability is also stricter than ISO 9001, and for implantable and certain active devices it is mandatory at the component level. The assembler must be able to trace each finished device to the specific lots of components and materials used, the equipment, and the personnel. This is what enables a targeted field action or recall rather than a blanket one.

Many medical assemblies are built in controlled environments, and ISO 13485 clause 6.4.1 (work environment) and 7.5.2 (cleanliness of product) require the assembler to define, control, and monitor the conditions necessary for product cleanliness. For devices with a sterile barrier or a critical fluid path, assembly commonly occurs in an ISO 14644 classified cleanroom, often ISO Class 7 or Class 8 depending on the bioburden and particulate requirements of the device. The assembler must monitor and record the relevant parameters, which can include particulate counts, viable monitoring, temperature, humidity, and gowning compliance. For products where residual bioburden affects the downstream sterilization validation, the assembly environment is part of the sterility assurance chain and is audited as such. Cleanliness controls extend to handling, packaging materials, and the sterile barrier system itself, which is frequently sealed and validated as part of the assembly operation. Buyers should confirm that the supplier's cleanroom classification, monitoring records, and gowning procedures match what their device requires. A device that needs ISO Class 7 assembly cannot be built in an uncontrolled area regardless of how good the rest of the quality system is.

For devices sold in the United States, ISO 13485 and the FDA Quality System Regulation under 21 CFR Part 820 cover much of the same ground, and the FDA has moved to harmonize the QSR with ISO 13485 through the Quality Management System Regulation. The device history record (DHR) concept in 21 CFR 820.184 corresponds to the per-unit or per-lot production records ISO 13485 requires, and the device master record (DMR) under 820.181 corresponds to the controlled documentation defining how the device is built. For an assembly supplier, this means a credible ISO 13485 system should be producing DHR-equivalent records: the build documentation that shows each device or lot was manufactured according to the DMR, including component lots, acceptance results, and the identities of those who performed and approved each step. Design controls under 820.30 generally sit with the device owner, but if the supplier performs any design or process development, those controls flow to them. Buyers who are themselves the legal manufacturer should remember that an ISO 13485 certificate does not by itself prove FDA compliance; it provides strong alignment. The device owner remains responsible for the regulatory filing, and supplier controls under their own quality agreement are how that responsibility is met at the assembly level.

Verification starts with the certificate but goes well beyond it. Confirm the ISO 13485:2016 certificate is issued by an accredited certification body, is within its three-year cycle with current surveillance, names the facility doing your work, and carries a scope that explicitly covers medical device assembly. A scope limited to component manufacturing does not cover finished-device assembly. Beyond the certificate, a serious medical assembler should welcome a supplier quality agreement that defines change notification, record retention, complaint and CAPA cooperation, and right of audit. Ask to see redacted examples of their validation protocols, their cleanroom monitoring trend data, and their CAPA log structure. Red flags include reluctance to sign a quality agreement, inability to produce validation documentation for the exact processes your device needs, and a cleanroom classification that does not match your device requirement. Because regulatory liability for a medical device ultimately rests with the legal manufacturer, the depth of this vetting is proportional to the device risk class. A Class II or III device assembly partner warrants an on-site audit, not just a paper review.