ISO 13485 QMS certification as a Supplier

[Emaru]

Hi everyone,
Whilst there is a lot of content regarding manufacturer's evaluation, control and so on over suppliers, is there a way to find content from the Supplier's perspective and what their obligations (and exemptions) are when becoming certified under the ISO 13485 standard? How to best adapt the QMS to reflect supplier status?

 

[William55401]

Welcome to the Cove! Please tell us more. What sort of supplier are you? Components? Services? This information may help you get a better response.

 

[Emaru]

Thanks so much for the welcome and happy holidays!
So we are a supplier of non-critical components and already have our QMS ISO 13485 certified however we must now address the non-conformities that were brought about by our lack of knowledge regarding what applies or what doesn't apply to us in having supplier status as opposed to manufacturer. Funnily enough it is proving more difficult to know what to exclude rather than know that we must cover all of the requirements.

 

[Tagin]

So we are a supplier of non-critical components and already have our QMS ISO 13485 certified however we must now address the non-conformities that were brought about by our lack of knowledge regarding what applies or what doesn't apply to us in having supplier status as opposed to manufacturer.

Can you provide the text of the NCs?

 

[Emaru]

Can you provide the text of the NCs?

Frustratingly so it very broadly only states that we should 'carefully read the standard' and assess its applicability to us as a supplier

 

[Tagin]

Frustratingly so it very broadly only states that we should 'carefully read the standard' and assess its applicability to us as a supplier

Hmm, that doesn't sound like a proper NC. It should be specific and it should reference the exact clause that the NC is against.

 

[William55401]

Here's a start. You can justify not following requirements for sections 6, 7, and 8. However, you must explicitly address requirements from sections 1 to 5. One more. You say your firm makes non-critical components. Be careful with this language. Your customer, not you, is responsible for intended use and overall Risk Mgmt File per EN14971. For you to be a good supplier (and partner) and to follow the intent of the 13485:2016, risk management is important. If you implement your QMS correctly (IMHO), you take great care with your customer's highest risk features (important to quality / safety / process / function) and take action in a commensurate way. What does this mean? A critical feature (per your customer) that is nonconforming should have the proportionate level of handling to disposition that NC. What if your customer does not identify critical features? I would make this a part of contract review (yes, a dated term) to ensure your org knows what is important about each and every item you make.

I agree with prior responders that the NC from your Notified Body sounds broad.

HTH. Have fun. Enjoy the ride.

 

[Emaru]

Here's a start. You can justify not following requirements for sections 6, 7, and 8. However, you must explicitly address requirements from sections 1 to 5. One more. You say your firm makes non-critical components. Be careful with this language. Your customer, not you, is responsible for intended use and overall Risk Mgmt File per EN14971. For you to be a good supplier (and partner) and to follow the intent of the 13485:2016, risk management is important. If you implement your QMS correctly (IMHO), you take great care with your customer's highest risk features (important to quality / safety / process / function) and take action in a commensurate way. What does this mean? A critical feature (per your customer) that is nonconforming should have the proportionate level of handling to disposition that NC. What if your customer does not identify critical features? I would make this a part of contract review (yes, a dated term) to ensure your org knows what is important about each and every item you make.

I agree with prior responders that the NC from your Notified Body sounds broad.

HTH. Have fun. Enjoy the ride.

This is quite helpful advice and insight, thank you so much.

 

[chris1price]

I would suggest the most important point is to identify what your customer wants from you. Certification to ISO13485 is the first step. How and when you communicate change controls and how you respond to complaints and CAPAs tend to be the more important quality related issues. Get these right and you'll have a good relationship.