ISO 13485:2016 clause 7.4 requires a device manufacturer to evaluate, select and monitor its suppliers in proportion to risk. In the U.S., 21 CFR Part 820 (QMSR), in force since February 2, 2026, incorporates ISO 13485:2016 by reference; EU OEMs work under (EU) 2017/745 (MDR).
An ISO 13485 contract manufacturer of components supports your purchasing controls with a supplier questionnaire and certificate copies, notification before any change of process, material, supplier or site, and flow-down of the OEM's requirements into the purchase order. See component contract manufacturing.