ISO 13485:2016

7.4 Purchasing

7.4.1 Purchasing process

The organization shall document procedures (see 4.2.4) to ensure that purchased product conforms to specified purchasing information.

The organization shall establish criteria for the evaluation and selection of suppliers. The criteria shall be:

a) based on the supplier’s ability to provide product that meets the organization’s requirements;

b) based on the performance of the supplier;

c) based on the effect of the purchased product on the quality of the medical device;

d) proportionate to the risk associated with the medical device.

The organization shall plan the monitoring and re-evaluation of suppliers. Supplier performance in meeting requirements for the purchased product shall be monitored. The results of the monitoring shall provide an input into the supplier re-evaluation process.

Non-fulfilment of purchasing requirements shall be addressed with the supplier proportionate to the risk associated with the purchased product and compliance with applicable regulatory requirements.

Records of the results of evaluation, selection, monitoring and re-evaluation of supplier capability or performance and any necessary actions arising from these activities shall be maintained (see 4.2.5).

7.4.2 Purchasing information

Purchasing information shall describe or reference the product to be purchased, including as appropriate:

a) product specifications;

b) requirements for product acceptance, procedures, processes and equipment;

c) requirements for qualification of supplier personnel;

d) quality management system requirements.

The organization shall ensure the adequacy of specified purchasing requirements prior to their communication to the supplier.

Purchasing information shall include, as applicable, a written agreement that the supplier notify the organization of changes in the purchased product prior to implementation of any changes that affect the ability of the purchased product to meet specified purchase requirements.

To the extent required for traceability given in 7.5.9, the organization shall maintain relevant purchasing information in the form of documents (see 4.2.4) and records (see 4.2.5).

7.4.3 Verification of purchased product

The organization shall establish and implement the inspection or other activities necessary for ensuring that purchased product meets specified purchasing requirements. The extent of verification activities shall be based on the supplier evaluation results and proportionate to the risks associated with the purchased product.

When the organization becomes aware of any changes to the purchased product, the organization shall determine whether these changes affect the product realization process or the medical device.

When the organization or its customer intends to perform verification at the supplier’s premises, the organization shall state the intended verification activities and method of product release in the purchasing information.

Records of the verification shall be maintained (see 4.2.5).