Skip to main content
NSF Home

Loading…

IMDRF Draft Guidance: Supplier Controls Move Toward Stronger, Risk-Based Lifecycle Oversight

Date
May 13, 2026
Category

Other Regulations

Description

The IMDRF has opened public consultation on its draft “Guidance on the Control of Products and Services Obtained from Suppliers”, with comments accepted from 6 May to 6 July 2026. All stakeholders, including manufacturers, suppliers, regulators and other interested parties, are invited to review the draft and submit comments during this period.
The document is a revision of the 2008 GHTF supplier-control guidance and is intended to reflect current regulatory expectations, ISO 13485:2016 purchasing controls, ISO 14971:2019 risk-management principles, and today’s more complex medical-device supply chains. 
Although ISO 13485:2016 already requires manufacturers to control outsourced processes and purchased products and services, the standard remains relatively high-level. The new IMDRF draft guidance therefore helps bridge the gap between the general requirements of ISO 13485 and the practical regulatory expectations for implementing supplier controls in a consistent, documented and risk-based manner.

1. Key Change for Manufacturers
The draft makes clear that supplier control is no longer a purchasing-only activity. Manufacturers are expected to manage suppliers across the entire medical-device lifecycle, including pre-market, production, post-market, change management, CAPA, and re-evaluation activities. The guidance applies to all medical devices, including IVDs and combination products regulated as medical devices. 
A major emphasis is the manufacturer’s responsibility: even where activities are outsourced, delegated, or performed by internal corporate entities under separate QMS arrangements, the legal manufacturer remains accountable for ensuring conformity, safety, performance, and regulatory compliance. Internal suppliers must be controlled similarly to external suppliers when they operate under a separate QMS. 

2. What Is New or Strengthened?
Compared with the 2008 GHTF guidance, which was structured around supplier planning, technical/process information, supplier identification, risk identification and controls, the new IMDRF draft expands the approach into a more mature lifecycle model: planning, selection, evaluation/acceptance, finalization of controls, delivery/monitoring, feedback, communication and CAPA. 
The draft also modernizes terminology and references. It aligns definitions with ISO 13485:2016, ISO 9000:2015, and ISO 14971:2019, and introduces broader examples covering software, AI-related software, regulatory services, clinical/pre-clinical services, sterilization, packaging, calibration, transport, storage, distributors, authorized representatives and other service providers. 
An important practical addition is that the guidance includes worked examples to support implementation. These examples illustrate how supplier controls may be applied and provide practical implementation support for manufacturers and supplier quality teams.

3. Practical Impact on Manufacturers
Manufacturers should expect stronger expectations for documented, risk-based supplier decisions. Supplier selection must be based on predefined criteria, including quality capability, technological capability, operational performance, business reliability, continuity of supply, disaster planning, and the ability to consistently meet safety, performance and regulatory requirements. 
The guidance explicitly warns against relying solely on certificates. ISO certification may support supplier evaluation, but it is not sufficient by itself. Manufacturers must collect and assess objective evidence, which may include questionnaires, supplier audits, first articles, first lots, prototypes, testing data, subcontractor controls and valid statistical methods where appropriate. 
Supplier approval must be formal and documented. The approval record should define the supplier, approval date and expiry, approved scope, restrictions, evaluation results and the responsible authorized person. Only approved suppliers should be used, typically through an Approved Supplier List. 

4. Stronger Change Control and CAPA Expectations
One of the most important messages for supplier quality manager is the strengthened focus on change notification and communication. Agreements should ensure that suppliers notify the manufacturer of changes that could affect product quality, product realization processes or the QMS. This includes changes arising from CAPA, process improvements, regulatory updates, operational changes or business needs. 
The draft also clarifies that CAPA activities may be partly delegated to a supplier, but the manufacturer retains overall responsibility. Manufacturers must ensure that supplier corrections and corrective actions are communicated back, documented and assessed for effectiveness. 

5. Recommended Manufacturer Actions
Given that this is draft guidance open for consultation, medical-device manufacturers should consider taking the following preparatory actions:

  • Review current supplier-control procedures against the proposed IMDRF lifecycle model to identify potential gaps and areas for alignment.
  • Assess whether current supplier risk classification approaches adequately cover product/service criticality, patient impact, single-source risk, business continuity and geopolitical/supply-chain risks, as reflected in the draft.
  • Evaluate existing supplier agreements and consider whether enhancements may be needed (e.g. change notification, CAPA, subcontractor control, communication timelines) in line with the draft expectations.
  • Revisit the current reliance on supplier certificates and determine where additional assurance mechanisms (audits, testing, incoming inspection, enhanced monitoring) may be appropriate under a future state aligned with the draft guidance.
  • Review and, where necessary, strengthen periodic re-evaluation criteria, including trending of supplier performance, nonconformities, complaints, delivery reliability and regulatory changes.
  • Actively participate in the consultation process by reviewing the draft in detail and submitting comments, particularly where implementation may be unclear, burdensome, or require further clarification.

6. Bottom Line
While this document is still a draft and not yet final or binding, it provides a strong indication of the direction of travel for global regulatory expectations on supplier management: risk-based, evidence-driven, lifecycle-oriented and fully integrated into the manufacturer’s QMS.
Manufacturers should therefore treat this consultation as an opportunity not only to influence the final guidance through feedback, but also to proactively assess their current systems against likely future expectations.
For manufacturers, the key takeaway is simple: outsourcing may transfer activities, but it does not transfer regulatory responsibility – and this principle is expected to be further reinforced in the final version of the guidance.