Written and maintained by CASRAI Editorial Board
Last updated
Contract manufacturing for medical devices means that a company other than the device owner makes, assembles, sterilizes, packages or otherwise processes the device or part of it. Under US rules the contract manufacturer is not a bystander: FDA’s definition of “manufacturer” in 21 CFR 820.3 covers anyone who designs, manufactures, fabricates, assembles or processes a finished device, and it expressly names contract sterilization among the functions that make a party a manufacturer. This page is for quality, regulatory and sourcing staff, and students, who need to know who counts as the manufacturer, which rules apply since 2 February 2026, and where components and finished devices part ways.
What contract manufacturing means
A device owner (the party that develops the specification) can outsource some or all production steps: molding, assembly, packaging, labeling or sterilization. The outsourced party is a contract manufacturer. “Medical supply contract manufacturing” and “contract manufacturer” describe the same arrangement; what matters legally is the function performed, not the commercial label. The written responsibilities between the two parties are usually set out in a quality agreement; see quality agreements for how those are structured.
Who FDA treats as a manufacturer
21 CFR 820.3 states: “Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device.” It adds that the term “includes, but is not limited to, those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions.” (Text of 21 CFR 820.3 as published by the Cornell Legal Information Institute, checked 30 October 2026.)
| Function named in 21 CFR 820.3 | What it means for the party performing it |
|---|---|
| Contract sterilization | Named in the definition, so a sterilization provider is itself a manufacturer, not only the factory that made the device. See gamma irradiation sterilization for one such process. |
| Relabeling and repacking | Both named in the definition of manufacturer. |
| Installation | Named in the definition of manufacturer. |
| Specification development | Named in the definition, so writing the specification is itself a function within the term. |
| Remanufacturing | Named in the definition. 820.3 defines a remanufacturer as anyone who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes its performance or safety specifications, or intended use. |
| Initial distribution for a foreign entity | Initial distributors of foreign entities performing these functions are included. |
The list is introduced by “includes, but is not limited to”, so it is not exhaustive. Registration and listing duties for these parties are covered in FDA establishment registration and listing.
QMSR and ISO 13485 since 2 February 2026
FDA states that its Quality Management System Regulation (QMSR) is effective 2 February 2026. It amends the device current good manufacturing practice requirements in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, together with the terms and definitions in clause 3 of ISO 9000:2015. If an ISO 13485 clause conflicts with the FD&C Act or FDA’s regulations, the Act and regulations control. Source: FDA, Quality Management System Regulation (QMSR) page, checked 30 October 2026. The structure of the regulation is explained in 21 CFR Part 820, and the standard itself in ISO 13485 certification.
The QMSR applies to finished device manufacturers who intend to commercially distribute medical devices. In the preamble to the final rule (89 FR 7496, 2 February 2024), FDA says the rule requires manufacturers of finished devices to apply an ongoing risk-informed assessment of suppliers to ensure the provision of quality products or services, including related to components. Discussing the customer property clause (ISO 13485 clause 7.5.10), the preamble gives an example: a manufacturer is expected to ensure that the integrity of a component provided by a contract manufacturer is not compromised before it is incorporated into the device being manufactured. Supplier assessment in practice is covered in supplier audits and vendor qualification.
Components versus finished devices
The line that decides whether the QMSR applies is the finished device. 21 CFR 820.3 defines a finished device as “any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized”. A component is “any raw material, substance, piece, part, software, firmware, labeling, or assembly that is intended to be included as part of the finished, packaged, and labeled device.”
- Component makers: in the final-rule preamble FDA agreed that manufacturers of components or parts of finished devices are not subject to the QMSR. It also noted it keeps legal authority under the FD&C Act to inspect component manufacturers, and encouraged them to consider the rule’s provisions as appropriate.
- Accessories: FDA treats an accessory as a finished device, so accessories are subject to the QMSR. The FDA QMSR page gives blood tubing as an example.
- Contracts can go further: FDA stated the rule does not preclude a contract between manufacturers that requires compliance with it. A device owner can therefore require a component supplier to follow QMSR-style controls by contract.
Common mistakes
- Assuming only the production plant is the manufacturer. Under 820.3 a contract sterilizer, relabeler, repacker or specification developer is also a manufacturer.
- Citing the old Quality System Regulation text for supplier controls. Part 820 was rewritten as the QMSR effective 2 February 2026, so check the current text before quoting a section number.
- Treating “component” and “accessory” as interchangeable. An accessory is itself a finished device; a component is a part intended to be included in one.
FAQ
What is the difference between a contract manufacturer and a component supplier?
A contract manufacturer that makes, assembles, sterilizes or otherwise processes a finished device falls within the 21 CFR 820.3 definition of manufacturer. A maker of components or parts of finished devices is, according to FDA’s 2024 final-rule preamble, not subject to the QMSR, although FDA can inspect it under the FD&C Act.
Is a contract sterilizer a manufacturer?
Yes. 21 CFR 820.3 lists contract sterilization among the functions included in the definition of manufacturer.
What does medical supply contract manufacturing involve?
It is the same arrangement described above: an outside party performs production, packaging, labeling or sterilization of a device or accessory for its owner. Whether the QMSR applies depends on whether the product is a finished device, an accessory (treated as a finished device) or only a component.
Which standard governs a device quality system now?
The QMSR, effective 2 February 2026, incorporating ISO 13485:2016 by reference.
Sources
- 21 CFR 820.3, Definitions: law.cornell.edu/cfr/text/21/820.3 (checked 30 October 2026).
- FDA, Quality Management System Regulation (QMSR): fda.gov QMSR page (checked 30 October 2026).
- Federal Register, Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496, 2 February 2024: federalregister.gov 2024-01709 (published text checked 30 October 2026; FDA copy: fda.gov/media/177022/download).
