How to select and qualify a contract manufacturer for your medical device.

i. The question before the question

Before evaluating any contract manufacturer, you need to answer a more fundamental question: will you manufacture this device yourself, or will you outsource manufacturing?

This is a direct extension of the strategic decision we covered in our guide on building to sell versus building to run. If you are building to sell, you almost certainly should not be manufacturing — the acquirer has their own manufacturing infrastructure, and capital spent building yours is capital wasted. If you are building to commercialize, you have a genuine choice, and it is worth understanding what each path actually involves before deciding.

ii. The reality of in-house manufacturing

Founders who consider in-house manufacturing typically underestimate the scope by an order of magnitude. “We will just assemble it ourselves” sounds simple. The operational reality is anything but.

Facilities. You need a suitable physical location. That means finding commercial or industrial space, negotiating a lease, obtaining building permits, and complying with local zoning and building codes. The space needs to be designed or refurbished to support regulated manufacturing — properly segregated areas for receiving and incoming inspection, raw material and component warehousing, assembly, labeling and packaging, quality control testing, finished goods storage, quarantine for nonconforming material, and shipping. Each area has specific environmental, lighting, cleanliness, and access control requirements depending on your device type.

People. In-house manufacturing requires hiring across multiple functions that most startups have never staffed: assembly technicians, quality control inspectors, test technicians, warehouse and logistics staff, facilities and maintenance personnel, calibration and preventive maintenance technicians, environmental health and safety personnel, cleaning staff, HR, accounts payable, receiving clerks, and shipping coordinators. Each role requires training, documentation, and ongoing competency management under your QMS.

Quality system scope. A design-and-development QMS covers perhaps 8–12 SOPs. A full manufacturing QMS adds production controls, process validation, environmental monitoring, equipment qualification, calibration management, incoming inspection, in-process inspection, final inspection and release, nonconforming product handling, warehouse management, labeling controls, sterilization management (if applicable), packaging validation, and shipping controls. Your QA team goes from one or two people managing a design-phase system to a full-time department managing a production-scale system.

Regulatory exposure. An in-house manufacturing operation is subject to FDA establishment inspection — comprehensive, multi-day facility inspections covering your entire QMS, manufacturing processes, complaint handling, CAPA system, supplier controls, training records, environmental controls, calibration program, and post-market surveillance. FDA inspectors have broad authority, and findings (483 observations) require formal response and remediation. Warning letters are public and can materially damage your ability to sell to hospitals and health systems.

Environmental and safety compliance. Manufacturing facilities are subject to OSHA requirements, EPA regulations, state and local environmental regulations, fire codes, and potentially industry-specific safety standards. Each requires its own compliance program, inspections, and documentation.

The honest calculation: most founders who carefully evaluate the full scope of in-house manufacturing conclude that it does not make sense at their stage. The capital investment is substantial (often $500K–$2M+ for a compliant facility), the ongoing overhead is high, and the operational complexity diverts management attention from what the startup actually does well — design, development, and clinical/regulatory strategy. The alternative is focusing on your core competency and leaving manufacturing to someone who has it as their core competency — and who can spread the overhead and complexity across multiple clients.

iii. If you outsource: the non-negotiables

If you decide to outsource manufacturing, the selection process matters enormously. A bad CMO selection can delay your commercial launch by a year or more, produce quality problems that trigger FDA action, or lock you into a relationship that is expensive to exit.

Here are two requirements that are absolutely non-negotiable. They are not “nice to haves.” They are binary gates. If the answer to either is no, stop the evaluation and move on.

iv. Walk away from promises

A pattern I have seen repeatedly: a CMO that checks every other box — good facility, experienced team, competitive pricing, perfect location — but is not yet ISO 13485 certified. They assure you they are “in the process” and expect to have it within six to twelve months.

Walk away.

ISO 13485 certification is not a paperwork exercise. It requires building and implementing a complete quality management system, operating it for a sufficient period to generate objective evidence of conformity (typically 6–12 months minimum), passing a Stage 1 documentation audit, passing a Stage 2 on-site certification audit, and then maintaining the system through annual surveillance audits. The process from zero to certification realistically takes 12–24 months — and that assumes everything goes well on the first attempt.

A CMO that promises certification “within a few months” is either underestimating the process (which tells you something about their quality competence) or telling you what you want to hear (which tells you something about their integrity). Neither is a foundation for a manufacturing partnership.

My threshold: the CMO should have a minimum of five years of continuous ISO 13485 certification history. This tells you the system is not just implemented but mature — it has survived multiple surveillance audits, produced and resolved findings, and been refined through actual use. A freshly certified CMO may have a compliant system on paper, but it has not been tested by real production volume, real nonconformances, and real FDA scrutiny.

v. Beyond the non-negotiables

Once you have confirmed FDA registration and ISO 13485 certification with adequate history, the evaluation moves to fit.

Device-type experience. A CMO that specializes in electromechanical assemblies is not the right partner for a sterile single-use diagnostic. Ask specifically: what types of devices do they currently manufacture? How many years of experience with your device category? Can they provide references from clients with similar products?

Quality team depth. Ask about headcount and experience levels. Who is the quality manager and how long have they been in the role? How many quality engineers support production? What does incoming inspection look like? What does final release look like? A CMO with one junior quality technician is a different risk profile than one with a quality manager, two quality engineers, and dedicated inspection staff.

Willingness to undergo a preliminary on-site assessment. Any CMO serious about earning your business should welcome a preliminary assessment. If they resist — “we just passed our ISO audit, you do not need to do your own” — that is a signal. Your assessment evaluates whether this specific CMO is suitable for your specific product, not whether they meet the generic requirements of the standard.

vi. Your consultant’s role in CMO qualification

Your QA/RA consultant should be intimately involved in CMO selection and qualification. This is not a procurement exercise — it is a quality system decision with direct regulatory implications.

Specifically, the consultant should:

• Verify certifications independently. Not just reviewing the certificate the CMO provides — verifying it with the certification body and checking the accreditation status of that body.
• Assess the CMO’s quality system maturity. Review their audit history, CAPA trends, and FDA inspection history. 483 observations and warning letters are public records searchable on FDA’s website. A CMO with a clean inspection history is a fundamentally different partner than one with recent 483s.
• Conduct or participate in the on-site assessment. Evaluate the facility, interview quality staff, review representative batch records, examine document control, verify calibration status of critical equipment, and assess change control and deviation management processes.
• Evaluate the quality agreement. The quality agreement defines responsibilities for each party across the full range of quality system activities. Your consultant should draft or review this agreement to ensure it protects your regulatory obligations.

Founders who select a CMO without quality and regulatory input are making one of the most consequential commercialization decisions based on commercial criteria alone. The manufacturing partner you select becomes an extension of your quality system. Their failures become your failures. Their FDA observations become your problems.

vii. Cost and capacity come last

This is counterintuitive for founders accustomed to leading negotiations with cost. In CMO selection, cost and production capacity are the last items you evaluate — not the first.

A $0.50/unit cost advantage is meaningless if the CMO’s quality system produces nonconforming product that triggers a field corrective action, or if their lack of FDA registration makes your entire production legally unmarketable.

viii. Involve the CMO in design — early

Once you have selected and qualified your CMO, do not wait until the design is frozen. Bring the CMO into design phase meetings early — ideally before design verification — so they can provide feedback on four critical areas:

Manufacturability. Can this design be assembled reliably at production scale? Are tolerances achievable? Are assembly steps sequenced logically? The CMO’s manufacturing engineers see things design engineers do not — because they have built thousands of devices and know where assemblies fail in production.

Testability. Can in-process and final acceptance tests be performed efficiently on the production line? Test requirements that work for 10 prototypes may be impractical for 10,000 production units.

Sourceability. Can every component in the BOM be sourced reliably at production volumes? This is where the CMO’s procurement experience is invaluable — and where some of the most expensive mistakes happen.

Cost implications. Design choices that seem trivial in the prototype phase can have dramatic cost implications at scale. The CMO can identify these issues before they become production problems.

ix. The component problem

Sourceability deserves its own section because it is the area where I have seen the most damaging and preventable failures.

Every battery in your device needs to come from a qualified supplier with documented certification to applicable safety standards, full lot traceability, and a quality agreement. The CMO’s procurement team can identify certified battery suppliers with production-scale availability. The random Amazon listing cannot.

A qualified CMO with experience in your device category will flag these risks during design review. They know which components have reliable supply chains and which are single-source, end-of-life, or otherwise risky. This is where their experience earns its value — not in assembly labor, but in preventing the production-stopping surprises that founders never see coming.

The general principle: every component in your BOM should be evaluated for regulatory compliance (certifications, safety standards), supply chain reliability (multiple sources, production longevity, lead times), and quality (incoming inspection specifications, lot traceability, failure history). Your CMO’s procurement and quality teams should be partners in this evaluation, not recipients of a finalized BOM they had no input into.

x. Common questions

When should we start looking for a CMO?

Start as soon as you have made the strategic decision to outsource manufacturing. CMO qualification takes 2–4 months. Involving the CMO in design reviews requires them to be qualified before verification testing begins. Working backward, that typically means starting the search 6–9 months before you need production units.

Can we use a CMO that is ISO 13485 certified but not FDA registered?

No — if you intend to market in the United States. FDA registration is a legal requirement for any establishment manufacturing medical devices for the US market. ISO 13485 certification and FDA registration serve different purposes and are not interchangeable. You need both.

What if our device is simple enough to assemble in-house?

Even “simple” assemblies trigger the full scope of manufacturing QMS requirements, FDA establishment registration, and potential FDA inspection. The question is not assembly complexity — it is whether your organization is prepared for the full manufacturing quality system infrastructure. For most startups, the answer is no.

How do we handle a CMO transition if our current manufacturer is not working out?

CMO transitions are expensive and time-consuming — typically 6–12 months, including qualifying the new CMO, transferring documentation, performing process validation, updating FDA registration, and potentially updating your 510(k). This is why getting the selection right the first time matters so much.

Should we visit the CMO facility in person?

Yes — always. You learn things walking the production floor that no document or video call can convey: how clean the facility actually is, how organized the warehouse is, how staff interact with quality procedures, whether calibration stickers are current. Send your QA/RA consultant. If the CMO is overseas, the trip is still worth the investment.

What should the quality agreement cover?

At minimum: responsibilities for incoming inspection, process validation, in-process and final release testing, nonconforming material disposition, complaint investigation, CAPA, change control (design, process, and supplier changes), regulatory reporting (MDR, recalls), annual product reviews, record retention, right of audit, and notification requirements for any event that could affect product quality or regulatory status. Your QA/RA consultant should draft or review this agreement.

Closing

Your contract manufacturer is not a vendor. They are an extension of your quality system, a co-owner of your product quality, and — in the eyes of FDA — a facility whose compliance directly affects your regulatory standing.

Start with the non-negotiables: FDA registration and ISO 13485 certification with real history. Evaluate fit based on device-type experience, quality team depth, and willingness to be assessed. Bring your QA/RA consultant into the process from the beginning. Let cost be the last conversation, not the first. And involve your CMO in design early enough that their manufacturing experience can prevent the problems that most founders never see coming.