Regulations (EU) 2017/745 and 2017/746
The notified body does not only assess you. It assesses whom you engaged.
In medical device law, control over suppliers is not a quality topic but a condition of market access. No evidenced supplier control, no conformity.
MDR and IVDR require a quality management system that explicitly covers the control of suppliers and subcontractors. Added to that are requirements on traceability across the supply chain, post-market surveillance and the reporting of serious incidents.
Switzerland adds a particularity: since mutual recognition lapsed, Swiss manufacturers count as third-country manufacturers in the EU market and need an authorised representative there, while national rules apply for the Swiss market. The supply chain documentation must satisfy both.
Who is affected
- Manufacturers of medical devices and in-vitro diagnostics.
- Contract manufacturers, sterilisation providers, test laboratories and software suppliers.
- Importers and distributors with their own verification and documentation duties.
- Authorised representatives answerable for completeness of the documentation.
What applies to the chain
- Supplier control
- Selection, evaluation and monitoring of suppliers as part of the quality management system.
- Traceability
- Be able to name economic operators along the chain for the prescribed periods.
- Changes
- Agreements obliging suppliers to notify changes.
- Surveillance
- Feed post-market findings back into supplier evaluation.
- Incidents
- Reporting routes that also capture events at suppliers.
How SCRM covers it
Supplier per product
Which provider supplies which component for which product, and since when.
Evidence with scope
Certificates with site and process, not just a number.
Change notifications
The commitment as a checked field with a named contact.
History for the file
Evaluations with date and person, as the technical documentation requires.
Frequently asked
How does this relate to ISO 13485?
The standard is the established route to implementing the requirements. The regulations govern legally; certification alone is not sufficient.
What applies to Swiss manufacturers?
For the EU market, third-country manufacturer requirements including an authorised representative. For the Swiss market, national rules. Both need the same supplier documentation.
Does software count as a supplied part?
Once it forms part of the product or affects its safety, yes – with the same control requirements as a physical component.
As of July 2026. Not legal advice.