Guides / Choosing a Supplier

Qualifying a Medical Machining Supplier: A Working Checklist

September 25, 2026

Supplier qualification for a machined medical component fails in one of two directions. Either it never really happens, and a purchase order goes out on the strength of a logo, or it becomes a 40 page questionnaire that the supplier’s sales engineer fills in from a template and nobody reads.

This is the middle version: four stages, in order, with the questions that actually change the answer.

Before anything else, one framing point. Qualification is yours. It sits inside your quality system, the decision to add a shop to an approved supplier list is yours to make and defend, and no intermediary, directory or matching service can do it for you. Anyone who implies otherwise is selling you an invisible risk.

Stage 0: decide how much qualification this part deserves

ISO 13485 clause 7.4.1 asks for criteria proportionate to the risk of the purchased product. That word is doing work. Applying the same package to a Class III implant and to an equipment bracket is not thorough, it is undifferentiated, and it reads in an audit as a file that was never thought about.

Write one paragraph before you start: what the part is, what it does in the device, what happens if it is wrong, and therefore what level of control is appropriate. This is the most commonly missing page in a supplier file and it takes ten minutes.

Stage 1: the desk review

Everything here happens over email before anyone’s time gets expensive.

Ask for:

• The ISO 13485 certificate as a document. Read the scope line, check the issuing body is accredited, check the site that will make your part is named, check it is current. This has enough traps in it that it is worth its own read.
• The quality manual contents page. Not the manual. The contents page tells you whether the system is real and whether it is structured in a way your auditor will recognise.
• The material traceability procedure. One question: can you tell me which bar a part came from two years later? If they cannot, nothing else matters.
• The change control procedure. See stage 4.
• The calibration schedule and whether it is traceable to a national standard.
• Last audit findings and their closure. Shops that share these are usually the ones worth having. A shop with zero findings ever is either exceptional or not being audited hard.

Red flags at this stage: a certificate “in progress” with no body and no date; a scope line that does not name machining; no named quality manager; reluctance to send the certificate as a document.

Stage 2: the capability review

The certificate says nothing about whether they can make your part. This stage does.

• Machines, by model and count, and which one your part runs on.
• Materials they run weekly. Not the list on the website, the list from the shop floor. Ask which of your materials they have cut in the last six months.
• In house against outsourced for cleaning, passivation, electropolish, heat treat and marking. Every outsourced step is a handoff, a lead time and a sub-tier you are now indirectly exposed to.
• Inspection equipment, and whether the CMM is calibrated and whether anyone runs gage studies on the small features.
• Capacity, honestly. A shop that is the right shop but full is not the right shop this year.

The most useful question in this stage is the one that invites a no: what on this drawing would you rather not quote? A shop that names something has read the drawing. A shop that says it is all straightforward either has not read it, or is about to learn on your part.

Stage 3: validation evidence

Where the result cannot be fully verified by inspecting the finished part, the process has to be validated. In a machine shop that usually means cleaning and passivation, sometimes marking, occasionally a special process.

You cannot look at a part and see whether the passivation bath was in specification. That is exactly why it is validated instead.

Ask them to show IQ, OQ and PQ records rather than describe them. The difference between a shop that has these and a shop that talks about these is visible in about four seconds. For passivation, the records should tie to a standard such as ASTM A967 with the method, bath, time and test result recorded per lot.

Stage 4: the agreement, and the clause that matters

If you write only one thing into the purchase agreement, write the change notification clause.

FDA’s MDSAP purchasing module says its auditors confirm a written agreement in which the supplier notifies the manufacturer of changes to the product. The module text we opened gives no clause number. Purchasing information is clause 7.4.2 of ISO 13485 according to the RAPS clause comparison table, and that table is the only basis for the number here. We did not read the ISO text, so we cannot say whether the standard requires the agreement in every case; our advice is the same either way: get an agreement that the supplier tells you before implementing a change that could affect conformity. In a machine shop, “a change that could affect conformity” quietly includes:

• a different bar supplier or a different heat
• a moved passivation, plating or heat treat sub-tier
• a new tool coating or a different coolant, which matters enormously on PEEK
• a different machine, or the same part moved to another site
• a process route change that makes the part identical on the print and different in the metal

Then check they have read it. Plenty of shops sign one and still move a plating vendor without telling anyone, not out of bad faith but because nobody connected the clause to the decision.

The rest of the agreement: record retention period, right to audit, sub-tier control, what happens to a non-conforming lot, and who pays for what when one arrives.

Stage 5: the on-site audit, if the risk justifies it

When you go, look at the floor rather than the conference room.

• Lot segregation. Are parts from different lots physically separated, or is it a bench and good intentions?
• Traveller discipline. Pick up a traveller at random. Is it filled in as the job runs, or all at once in the same pen?
• Non-conforming material control. Is there a locked, labelled area, and is there anything in it? An empty one is a warning, not a reassurance.
• The marking station and the packing area. These are the last two operations and the least supervised in most shops.
• Ask an operator what they do when a part measures out of tolerance. The answer tells you more about the quality culture than the manual does.

The six answers that should end it

1. “ISO 13485 is basically ISO 9001 with extra paperwork.”
2. “We’re QMSR certified.” There is no such thing, and a component supplier is not in scope for the QMSR in the first place.
3. “The certificate is in progress.” Without a body and a date, this means nothing.
4. “We’d let you know if anything major changed.” Not a change control process.
5. “Passivation and cleaning are included free.” Free means unrecorded.
6. “Yes” to every part family you name.

None of those are about price or machines. All of them are about whether the shop understands that its product includes a file you have to defend.

A realistic timeline

Three to six months for an implant or instrument supplier. Less for non-patient-contacting work. Most of it is calendar rather than effort: waiting for documents, scheduling an audit, getting a first article through.

Start it before you need the parts. The qualification that gets compressed into three weeks because a programme slipped is the one that gets written up at the next inspection, and the finding is never about the supplier. It is about you.

The whole route, from the risk paragraph to monitoring and requalification, is in our guide to medical device supplier qualification.

Where we fit

We match device buyers with machining suppliers and we check the certificate number, the issuing body and the expiry before a shop sees an RFQ preview. That is stage 1, partially, and nothing else on this page. We do not audit, we do not qualify suppliers on your behalf and we hold no certification of our own.

The full list of what we check and what we refuse to claim is on how we check a supplier. If you have a drawing and want a shorter list to start from, send it here.

Sources

• ISO 13485:2016, Medical devices, Quality management systems
• FDA, Quality Management System Regulation (QMSR)
• FDA, MDSAP training module: Purchasing process
• ASTM A967, chemical passivation treatments for stainless steel parts

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

Keep reading

• In-house vs outsourced machining for medical device components
• Common Mistakes When Sourcing a Machined Medical Component