Guides / Quality and Compliance

The Quality Agreement With a Machine Shop: What to Put In It

September 26, 2026

A machining supplier’s ISO 13485 certificate tells you their quality system was audited. It does not tell you what happens between you and that supplier when something changes, when a lot fails, or when a record needs to exist for the next ten years. That is the job of the quality agreement, and a surprising number of buyer-supplier relationships in this space run without a real one.

What a quality agreement is not

It is not the purchase order. A purchase order specifies the part, the quantity, the price and the delivery date. It says nothing about how the supplier is expected to behave between orders.

It is not the certificate. A certificate is evidence the supplier’s quality system was audited on a given date against a given scope. It is not a commitment about this specific relationship.

It is not the quality manual the supplier sends you. That describes their system in general. A quality agreement describes what applies specifically to your parts, your risk level, and your expectations.

What clause 7.4.2 covers and what auditors confirm

Under the QMSR, purchasing requirements read from ISO 13485 clause 7.4 rather than the old 21 CFR 820.50. According to the RAPS clause comparison table, clause 7.4.2 covers purchasing information; that table is the only basis for the number here. FDA’s MDSAP purchasing module says its auditors confirm a written agreement in which the supplier notifies the manufacturer of changes to the product, but the module text we opened gives no clause number. We did not read the ISO text, so we cannot say whether the standard requires the agreement in every case. The content to write is an agreement where the supplier notifies you of changes to the purchased product before they are implemented, where those changes could affect conformity.

That single sentence is doing most of the real work in a quality agreement, and it is the clause most commonly missing in practice, or present in the quality manual but never actually signed into the specific supplier relationship.

What “changes to the purchased product” means in a machine shop

This phrase sounds abstract until you translate it into what actually happens on a shop floor. It quietly covers:

A different bar supplier or a different heat. Same alloy, same standard, different mill certificate.
A moved sub-tier. Passivation, plating, heat treat or laser marking sent to a different vendor than the one qualified.
A tool coating or coolant change. Especially consequential on PEEK, where contamination risk changes with the tooling history.
A different machine, or the same part moved to a different site, including a sister plant in the same company that is not on the certificate.
A process route change that produces an identical-looking part through a different sequence of operations.

None of these show up on the finished part’s drawing. All of them can affect conformity. A shop that has not connected this clause to these decisions will make one of them without telling you, not out of bad faith, but because nobody wired the obligation to the daily reality of running a shop.

What to put in the agreement

Change notification, in writing, tied to specific triggers. Not “we’ll let you know if anything major changes.” Name the triggers: material source, sub-tier processor, process route, tooling or coolant on sensitive materials, and manufacturing site.

Record retention period. How long the supplier keeps lot travellers, material certificates, first article reports and inspection records, and what happens to those records if the relationship ends.

Right to audit. Your right to visit the facility, with reasonable notice, and to review records relevant to your parts.

Sub-tier control. A requirement that the supplier’s own suppliers (passivation, sterilization, testing) are themselves controlled to a standard you have visibility into, not a black box.

Non-conforming material handling. What happens when a lot fails inspection: who is notified, how fast, and what the remedy looks like (rework, replace, credit) before it becomes a dispute.

Risk-proportionate scope. ISO 13485 clause 7.4.1 expects criteria proportionate to the risk of the purchased product. Write down, in the agreement or in your own file, why the level of control matches the part.

The two questions that reveal whether a shop takes this seriously

“What would you tell me about before you changed it?” A shop that takes change notification seriously answers with a list: material supplier, sub-tier processor, process route, major tooling changes. A shop that does not take it seriously answers with something closer to “we’d let you know if anything major changed,” which commits to nothing specific.

“Can I see a quality agreement you’ve signed with another medical customer?” They cannot show you the customer’s name or details, but a shop that has genuinely done this before can describe the shape of the document without hesitating. A shop encountering the concept for the first time in your conversation is telling you something.

Where this sits

The quality agreement is yours to write and yours to keep in your supplier file. No matching service, directory or intermediary can create it for you or substitute for it, because it is part of your own quality system. What we do before a supplier sees an RFQ preview is a lighter, disclosed check, explained in full at how we vet. For the wider qualification process this agreement sits inside, see qualifying a medical machining supplier.

The agreement is step five of medical device supplier qualification, after the evidence review and any audit, before the approved supplier list.

Sources

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

Is a quality agreement the same as a purchase order?

No. A purchase order covers what, how many and when. A quality agreement covers how the supplier tells you about changes, what records it keeps, how long, and what happens when a lot does not conform. Many buyer-supplier relationships in this space run on a purchase order and a certificate, with no separate quality agreement, which is the gap this article is about.

Do I need a quality agreement for every supplier?

Proportionate to risk, per ISO 13485 clause 7.4.1. A supplier machining an implant component warrants a full written agreement. A supplier making a non-patient-contacting bracket may be adequately covered by purchasing data and a lighter set of terms. The point is to be able to explain why the level you chose matches the part.

What if the supplier will not sign a change notification clause?

That is useful information before you place the order, not after. A shop unwilling to commit in writing to telling you before a material, process or sub-tier change is telling you something about how the relationship will actually run.

Who owns the quality agreement in an audit?

You do. It is part of your purchasing controls and your quality system, and an investigator reviewing your supplier file will expect to see it, not just a certificate on file.

Need a quote for this part?

Send the drawing. We match you with up to 3 medical machining suppliers and reply within 24 business hours.

Get matched with a medical machining supplier