Guides / Regulatory
EU MDR and Machined Components: The Documents to Request From Your Machining Supplier
October 30, 2026
The EU Medical Device Regulation names no list of documents that a component machine shop must hand over. It puts duties on the device manufacturer, and a few of them can only be met with paper from the shop. This guide maps the MDR text to the documents you can ask a machining supplier for, so that each request has a reason you can state in your own file.
Nothing here is regulatory advice, and every device is different. Your regulatory lead decides what your technical documentation needs. The aim is to ask the right questions at quote stage, when a supplier can still say yes or no cheaply.
What the MDR actually asks of you
Three provisions drive the supplier paperwork.
Article 10(9) requires a quality management system that is proportionate to the risk class and the type of device. Among the aspects it must address is resource management, “including selection and control of suppliers and sub-contractors”. It also lists management of modifications, corrective and preventive actions and product realisation.
Annex II, section 3 sets the design and manufacturing information in the technical documentation. It calls for complete specifications for the manufacturing processes and their validation, their adjuvants, continuous monitoring and final product testing. It also calls for identification of all sites, including suppliers and sub-contractors, where design and manufacturing activities are performed.
Annex IX, section 2.2 lists what the quality system documentation must describe to a notified body. Where manufacture or final verification is carried out by another party, the description has to cover the methods for monitoring the quality system and in particular the type and extent of control applied to that party. The same section requires that the calibration of test equipment can be traced back.
Read together, they say this: you must know who makes your part and where, you must hold the validation behind the processes that make it, and you must be able to show how much control you apply to the shop. The documents below are the evidence.
The documents to request
| Document from the shop | What it supports | What to check |
|---|---|---|
| Quality system certificate with scope and site address | Control of suppliers, Article 10(9) | Scope names machining and the site that cuts your part, see reading an ISO 13485 certificate |
| Site and sub-contractor list for your part | Annex II section 3, identification of sites | Every site for machining, passivation, heat treat, marking, cleaning and any outside processing, with addresses |
| Material certificates traced to the heat or lot | Product realisation and traceability | Standard and revision, chemistry, condition, heat number, see bar stock certificates |
| Validation records for special processes | Annex II section 3, processes and their validation | Cleaning, passivation, heat treat and marking: protocol, report and date of last review |
| List of processing aids with safety data sheets | Annex I section 10.4.1, processing residues; Annex II section 3, adjuvants | Cutting fluid, tooling lubricant, cleaning agent and deburring media by name, see ISO 10993 and machining residue |
| Inspection plan and records, gauge identification and calibration trace | Annex IX section 2.2, test equipment and its calibration | Gauge ID on each result, calibration due dates, measurement system evidence, see inspection plans |
| Change notification and quality agreement | Article 10(9), management of modifications | Named triggers, notice period in days and an acceptance step, see change notification |
| Nonconformance, corrective action and complaint cooperation procedure | Article 10(9), corrective and preventive action | How the shop tells you, how fast and what it holds |
| UDI or lot marking verification record | Article 10(9), verification of UDI assignments | Mark content checked against your data, see UDI laser marking |
| Record retention commitment | Article 10(8), retention of technical documentation | Period at least as long as yours, and where the records live if the shop closes |
| Right of access to premises and records | Annex IX sections 3.3 and 3.4; Annex VII section 4.5.2 | Your notified body and a competent authority may need to visit |
Two of these rows deserve a note.
The processing aids row rests on the Regulation’s wording. Annex II calls them “adjuvants”, and Annex I section 10.4.1 asks that risks from “processing residues” be reduced as far as possible. The Regulation does not define the term for a machine shop. Our reading is that cutting fluids, cleaning agents and deburring media belong there, because they are the substances used in making the part that could end up on it. Check that reading with your notified body.
The access row matters more than it looks. Article 93(3)(b) lets competent authorities carry out announced and unannounced inspections of the premises of economic operators, suppliers and sub-contractors. Annex IX section 3.4 requires a notified body to carry out random unannounced audits at the manufacturer and, where appropriate, at its suppliers and sub-contractors at least once every five years. A shop that refuses access in the agreement leaves you unable to meet that.
What the MDR does not ask a component shop for
It helps to know the limits, so that you do not demand paperwork that has no home in your file.
- No CE marking on the component. Article 10(6) puts the declaration of conformity and the CE marking on the manufacturer of the device. A shop that machines a part to your drawing does not mark it.
- No certificate requirement. The Regulation asks you to control suppliers. It does not say a supplier must hold a certificate. Many manufacturers still require one, which is a choice and not a mandate.
- No supplier “MDR compliance”. A component shop cannot be compliant with a device regulation that does not apply to it. A shop that markets itself that way is either confused or hoping you are.
A related point for shops that make more than components. If a shop makes the whole finished device for you, Article 10(15) says the identity of that other party is part of the information submitted to the economic operator registration system. That is a different relationship from machining a titanium blank, and it carries more paper.
How risk class changes the request
Article 10(9) ties the quality system to risk class, so the same document set does not suit every part. Annex VIII, Rule 8, classifies implantable and long-term surgically invasive devices as class IIb by default, with exceptions. Total or partial joint replacements go to class III, except ancillary components such as screws, wedges, plates and instruments. Implantable devices that contact the spinal column also go to class III, with the same exception for components such as screws, wedges, plates and instruments.
In practice that means a hip stem and a bone screw can sit in different classes even though both are machined from the same titanium bar. It also means the retention period differs by device type: Article 10(8) requires 15 years for implantable devices, against 10 years for others. The manufacturer decides the class with its notified body, so treat this paragraph as orientation and not as a classification.
A lighter part earns a lighter pack. An equipment bracket needs the certificate, the material certificate and a change clause. An implant component needs everything in the table, with the validation reports read and not merely filed.
What a notified body does with your supplier file
Annex VII section 4.5.2 tells notified bodies to identify a manufacturer’s suppliers and sub-contractors when they plan an audit, and to consider whether to audit any of them. It adds that the notified body should audit the control of processes at supplier premises when the conformity of finished devices is significantly influenced by a supplier’s activity, “in particular” when the manufacturer cannot demonstrate sufficient control over its suppliers.
That last condition is the practical one. If your file shows risk-based evaluation, signed change terms, read validation reports and a way into the shop’s premises, an audit of the supplier becomes less likely or at least easier. If your file holds a certificate and a purchase order, the audit programme has a reason to go to the shop.
How to ask without slowing the quote
Send the request with the drawing, not after the order. Three habits keep it workable:
- Put the table above in the RFQ as a one-page list and ask the shop to mark each item as available, available after the order or not available.
- Ask for the documents you will actually read. A validation report nobody opens is a cost for the shop and a false comfort for you.
- Keep the answers in one place per supplier, in the order your auditor will follow: scope, sites, material, special processes, inspection, change control, records.
Our guide on how to write an RFQ for machined medical parts shows where this list sits in the request. Shops that cannot supply an item are not disqualified by that alone. Their answer is information, and some items can be produced for a price, as the documentation line article explains.
The EU documents sit inside the wider file described in the guide to medical device supplier qualification.
Next step
Before you issue the next RFQ, mark which rows of the table your device class makes mandatory, which are optional and which you have never asked for. Then request a quote with that list attached.
We match buyers with machining suppliers and the buyer pays us nothing. We are not a machine shop and we do not qualify a supplier for you, because qualification, the audit and the quality agreement belong to your own quality system. We reply within 24 business hours.
Sources
- Regulation (EU) 2017/745 on medical devices, Articles 10 and 93, Annexes I, II, VII, VIII and IX (EUR-Lex)
- European Commission, MDCG endorsed documents and other guidance (index, including MDCG 2021-19 on UDI in the quality system)
- FDA, Quality System Regulation Amendments, final rule (89 FR 7496), incorporation of ISO 13485:2016
- ISO 13485:2016, Medical devices, Quality management systems
Standards and regulations change. Check the current text at the source before you rely on it in a submission.
Frequently asked questions
Does the EU MDR require my machining supplier to be ISO 13485 certified?
No. Article 10(9) requires your quality system to cover the selection and control of suppliers and sub-contractors. A certificate is one common way to show control, and for an implant it is rarely enough alone. The Regulation does not name a certificate for component shops.
Can a notified body audit my machine shop?
Yes, where it judges that necessary. Annex IX sections 3.3 and 3.4 let a notified body audit a manufacturer's suppliers and sub-contractors, including without notice. Annex VII section 4.5.2 points to supplier audits when the manufacturer cannot show sufficient control over a supplier whose work significantly affects the device.
How long must supplier records be kept under the MDR?
Article 10(8) sets at least 10 years after the last device was placed on the market, and at least 15 years for implantable devices. That period applies to the manufacturer's technical documentation. Write a retention period into the quality agreement that covers the supplier records your file depends on, and confirm it with your regulatory lead.
Is the document set different from what FDA expects?
The core is the same: control the supplier, validate the special processes, keep traceable records. FDA's QMSR incorporates ISO 13485 by reference. The EU adds explicit wording that your technical file identify every site, including suppliers and sub-contractors, that performs manufacturing.
Need a quote for this part?
Send the drawing. We match you with up to 3 medical machining suppliers and reply within 24 business hours.
Get matched with a medical machining supplier