How to Select a Medical Device Contract Manufacturer (CMO/CDMO)

Most medical device startups will outsource manufacturing at some point, many from day one. The decision of which contract manufacturer to work with is not purely a cost or lead-time decision. It is a regulatory, quality, and operational decision. The wrong partner can delay your regulatory submission, generate FDA inspection findings at your account, or produce devices that fail in the field even if they pass internal acceptance criteria.

CMO vs. CDMO: What Is the Difference?

In medical devices, these terms are sometimes used interchangeably, but there is a practical distinction:

• CMO (Contract Manufacturing Organization): Focuses on production. You provide design specifications, bill of materials, and processes; the CMO makes the device. A CMO relationship typically begins after design transfer.
• CDMO (Contract Development and Manufacturing Organization): Also supports development work, including design for manufacturability, process development, and validation. A CDMO relationship can start much earlier in the device development lifecycle.

For a device company without in-house manufacturing engineering, a CDMO that can support design for manufacturability (DFM) earlier in development often reduces the cost and time of design transfer. For a company with strong internal development capabilities, a CMO focused on production is sufficient.

The Regulatory Framework for Supplier Control

Under the FDA's QMSR (effective February 2, 2026), supplier control requirements flow from 21 CFR 820.10 (which incorporates ISO 13485:2016 by reference) and ISO 13485:2016 Clause 7.4 (Purchasing) and Clause 4.1.5 (Control of outsourced processes). (Source: eCFR.)

The core regulatory principle is straightforward: you cannot outsource regulatory responsibility. If your device label carries your company's name, FDA holds you accountable for the quality and safety of every device that CMO produces.

Key QMSR/ISO 13485 requirements for supplier control:

Clause 7.4.1 (Purchasing process): The organization must establish criteria for evaluating and selecting suppliers based on their ability to meet requirements. Criteria must consider the type and extent of control appropriate to the supplier and the purchased product, and the effect that purchased product has on device quality.

Clause 7.4.2 (Purchasing information): Purchasing documents must clearly describe what is being procured, including quality requirements, applicable procedures, and specifications.

Clause 7.4.3 (Verification of purchased product): Incoming product must be verified against specifications. The nature and extent of verification should reflect the criticality of the supplier's role and the manufacturing controls in place at the supplier.

Clause 4.1.5 (Outsourced processes): Processes that are outsourced must be controlled. The organization must identify the controls to be applied to outsourced processes, which may include on-site auditing, regular reporting, or contractual quality requirements.

Supplier control records (approved supplier list, supplier evaluations, quality agreements, audit reports, incoming inspection records) are maintained as part of the Quality Management System and are subject to FDA inspection.

Step 1: Establish Your Requirements Before You Talk to CMOs

Before evaluating contract manufacturers, document what you need:

• Device category and manufacturing processes: Machining, injection molding, extrusion, electronics assembly, catheter manufacturing, clean-room production, sterile fill, and so on.
• Regulatory requirement: Does the CMO need to be an FDA-registered establishment? Are they subject to EU MDR or other international registrations?
• Quality system requirements: ISO 13485:2016 certification is the baseline for regulated medical device manufacturing globally. Some programs also require AS9100 (aerospace), ISO 9001, or additional certifications.
• Capacity and scalability: Can the CMO handle your current volume and scale as you grow?
• Location and logistics: Domestic vs. offshore trade-offs in lead time, quality system oversight, and supply chain risk.
• IP protection: How does the CMO handle proprietary design information, and what contractual protections are in place?

Step 2: Evaluate Quality System Maturity, Not Just Certification

An ISO 13485:2016 certificate from an accredited notified body is necessary but not sufficient for evaluating a contract manufacturer. The certificate tells you the QMS meets minimum requirements at the time of the last audit. It does not tell you how that QMS performs under production pressure.

Indicators of quality system maturity beyond the certificate:

Audit history: A contract manufacturer of a finished device must itself register with FDA as a device establishment under 21 CFR 807.20 (Part 807, Subpart B) and is subject to FDA inspection. You can review its registration and any inspection history through FDA's Establishment Registration and Device Listing resources. A history of repeat findings in the same areas is a warning sign.

CAPA system performance: Ask to see summary metrics on CAPA cycle times, CAPA effectiveness rates, and open versus closed CAPAs. A backlog of aged open CAPAs suggests the system is not working.

Document control: Is their SOP and document control system electronic and auditable? Physical paper-based systems are not disqualifying, but they tend to produce inconsistent execution and slower response to changes.

Change control discipline: Ask how they handle Engineering Change Orders (ECOs) when a supplier changes a component or a process parameter drifts. Changes to processes for FDA-regulated devices require documentation and, in some cases, re-validation or regulatory notification. CMOs without strong change control tend to make undocumented changes.

Deviation and nonconformance records: Request summary data on their deviation and nonconformance rates for devices similar to yours. Some rate of deviation is normal in manufacturing; the question is how they are handled and resolved.

Step 3: Assess Technical Capability for Your Specific Device

Not all ISO 13485-certified CMOs have the specific technical capability your device requires. Evaluate:

• Process-specific expertise: If your device requires cleanroom assembly, confirm the CMO's cleanroom class and qualification status. If it requires specific sterilization, confirm they have the process or relationships with accredited sterilization contractors.
• Material handling: Biocompatible materials (medical-grade polymers, implant-grade metals) require specific sourcing controls. Confirm the CMO uses qualified suppliers for those materials.
• Test and inspection capability: Can the CMO perform your acceptance tests in-house, or does everything go to an outside lab? In-house capability reduces turnaround time and gives you more visibility.
• Electronics and software: If your device includes electronics or software as a medical device (SaMD), confirm the CMO has electronics manufacturing experience and that their processes address IPC standards and ESD controls.
• Track record: Request references from other medical device OEM customers in your device category. A CMO with a decade of catheter experience is better positioned for your catheter program than one that is entering the category for the first time.

Step 4: Evaluate Tech Transfer Readiness

Design transfer is the process by which your validated design specifications are formally handed off to the CMO for production. ISO 13485:2016 Clause 7.3.8 requires documented procedures for design transfer, and the process is more complex with a contract manufacturer than with in-house manufacturing because it crosses organizational boundaries.

Key tech transfer readiness indicators:

Tech transfer process: Does the CMO have a documented tech transfer procedure? What milestones does it include, and what is the typical timeline? A CMO with no formal tech transfer process is a significant red flag.

Tooling and equipment qualification: Who owns the tooling? What happens to it if you change CMOs? Equipment qualification requirements (IQ/OQ/PQ) at the CMO site need to be addressed in the transfer plan.

Process validation at the CMO site: Your design validation was performed at or with the CMO's pre-production processes. If moving to a new CMO after initial validation, the manufacturing process at the new site requires re-qualification, and depending on the nature of the change, FDA notification or a 510(k) submission may be required.

Document control of manufacturing records: The CMO must generate Device History Records (DHRs) for every production lot. Confirm the format, storage, retention period, and access rights for those records. You need to be able to retrieve DHRs for FDA inspection or in connection with a complaint or adverse event.

Step 5: Structure the Quality Agreement

A Quality Agreement is a contractual document that defines each party's quality responsibilities in the relationship. ISO 13485:2016 Clause 7.4.2 requires that purchasing documents address quality requirements; a Quality Agreement is the standard mechanism for managing that in a CMO relationship. FDA's formal Quality Agreement guidance is a drug CGMP document, so for devices the Quality Agreement is a contractual best practice that supports the ISO 13485 purchasing and outsourcing requirements rather than a standalone device regulatory mandate.

A well-structured Quality Agreement covers:

• Which party is responsible for each element of the QMS that applies to the manufactured device
• Change control: who initiates, who approves, and what triggers notification to the other party or to regulators
• Audit rights: your right to audit the CMO's facilities and records
• Complaint and adverse event handling: timelines and responsibilities for complaint investigation, MDR reporting, and recall coordination
• Device History Record access and retention
• What constitutes a significant change requiring regulatory notification
• Confidentiality and IP protection terms

Red Flags in CMO Evaluation

These are the findings that should cause serious hesitation or disqualification:

• ISO 13485 certificate is lapsed, not from an accredited body, or is scope-limited to activities that do not cover your device category
• Multiple FDA inspection observations in the same area across successive inspections (available in FDA's inspection database)
• Unwillingness to provide audit access, inspection history, or QMS documentation under a reasonable NDA
• No formal tech transfer process or inability to describe how they have handled transfers for previous clients
• No written Quality Agreement template, or resistance to executing one
• Unusually low pricing that cannot be explained by volume efficiencies or location advantage (often indicates cutting corners on qualification, testing, or materials sourcing)
• Significant staff turnover in quality and operations leadership (ask about average tenure of quality management team)

Supplier Qualification in Your QMS

Once you have selected a CMO, the supplier qualification process must be documented in your QMS. A typical supplier qualification file for a critical supplier (a CMO is a critical supplier) includes evidence of ISO 13485 certification, the audit report from your qualification audit, a completed supplier questionnaire, the approved Quality Agreement, and ongoing performance monitoring records (incoming inspection results, complaint data attributable to the supplier, annual review records).

This file is maintained as part of your QMS and is available to FDA inspectors. Gaps in supplier qualification files are a recurring 483 observation area.

How Buzzbox Media Helps Medical Device Companies Build Commercial Momentum

Medical device companies working through CMO selection are often also building their commercial strategy: developing clinical references, identifying distribution partners, and beginning to build search visibility with potential buyers. Contract manufacturing decisions sit alongside your design for manufacturability and new product development work. Buzzbox Media has worked with medical device companies for over 15 years to develop content and search strategies that build awareness and generate inbound interest from clinical and procurement audiences. See our medical device marketing services to learn how we can help.