I am not sure how to attach a seperate thread here ...... its all a bit new to me

but I started a new discussion based on a similar question:
My company was recently audited by NB and was given a finding because the audit criteria used to audit a Supplier - Contract Manufacturer - was not audited first to ISO13485:2016 and then to MDSAP or MDR. The audit was conducted to ISO9001 as the supplier was 9001 certified. I accept they should have been audited to ISO13485 but I am confused as to the MDSAP and MDR requirement.
The CM in question is based in US so understand that 21 CFR is applicable but I presume that is all? Can anyone clarify? We do sell the product in Austrialia, Canada and Brazil but as my company is the Legal Manufacturer I presume we must meet TGA, HC and ANVISA requirements and not the CM?
We also sell the product in EU so does MDR apply to CM? I would have thought it applies to the Legal Manufacturer only.
I tried to get some further info from the auditor but didnt get very far!
If anyone can help that would be great!