Medical Device Contract Manufacturers: What ISO 13485 Changes

A medical device contract manufacturer builds your device inside a quality system designed for regulators: ISO 13485, and in the United States FDA's Quality Management System Regulation. The build steps look familiar. What changes is the paperwork around them: quality agreements, validated processes, traceability and change control. This note sits under electronics contract manufacturers and next to hardware certifications.

The rules a medical device contract manufacturer works under

The QMSR is the 2026 change most U.S. founders need to know. According to FDA's QMSR materials, it took effect on 2 February 2026, incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference, and FDA moved device inspections to a new compliance program at the same time. FDA also says it will not issue or require ISO 13485 certificates, and a certificate does not exempt a manufacturer from inspection. Aligning with ISO 13485 shrinks the gap between U.S. and international systems; it does not remove FDA.

What ISO 13485 changes about outsourcing

A general electronics contract manufacturer builds to your drawing and its own ISO 9001 system. Under ISO 13485, outsourced work stays inside your quality system. In practice that means:

• A written quality agreement. It sets who does what: who approves changes, who handles complaints and nonconformances, what records are kept and for how long, and the right to audit.
• Supplier evaluation. You qualify the manufacturer before using it and monitor it after, with records.
• Process validation. Processes whose output cannot be fully checked afterward, such as some soldering, coating, sealing and sterilization steps, are validated, typically through installation, operational and performance qualification.
• Change control. The manufacturer cannot swap a part, a supplier or a process step without your approval. That includes "equivalent" passives.
• Traceability. Lot and serial records tie each shipped device to its parts, process data and test results.
• Records. A device history for each build, kept for the retention period your system sets.

Each of those is labor on the manufacturer's side, and it shows up as program management, documentation and validation lines on the quote.

Medical PCB assembly in practice

The board itself goes down the same line: stencil, pick-and-place, reflow, AOI and X-ray, as in our PCB assembly guide. The differences are around it:

Budget time as well as money. Validation runs and documentation commonly add weeks before the first production lot. Ask candidate manufacturers for a sample quality agreement and their validation approach in the first meeting, not after a quote.

Design choices made early lower that cost. A BOM with two qualified sources on critical parts means an end-of-life notice is a planned change, not a scramble. Test points for every net that matters make in-process testing and later revalidation cheaper. And a design that avoids processes that are hard to validate, such as hand soldering where a machine step would do, keeps the validation plan short.

Choosing a medical device contract manufacturer

Starting with a general electronics assembler for early prototypes is common; moving to a medical-grade manufacturer before design verification builds keeps validated processes and the final production line close together. The prototype to production note covers that handoff.

Medical device startups in the index

The index lists 18 health and medical hardware companies as of REV 26.09, from wearables to imaging. Hyperfine makes Swoop, which the index records as the first FDA-cleared portable MRI. Eko Health sells digital stethoscopes alongside an FDA-cleared AI platform. Butterfly Network puts an ultrasound transducer array on a chip. For surgical and rehabilitation machines, see medical robotics companies, and browse the health category for the full list.

Frequently asked questions

What is a medical device contract manufacturer?

+

A medical device contract manufacturer builds devices or subassemblies for the company that designs and sells them, under a quality management system set up for medical work. The legal manufacturer, usually the startup whose name is on the label, stays responsible to regulators for the device. The contract manufacturer is a controlled supplier inside that manufacturer's quality system, bound by a written quality agreement.

What is the FDA QMSR?

+

The Quality Management System Regulation is FDA's amended device manufacturing rule in 21 CFR Part 820. It took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, replacing much of the older Quality System Regulation text. FDA has said it will not issue or require ISO 13485 certificates, and a certificate does not exempt a manufacturer from FDA inspection.

Does my PCB assembler need ISO 13485 certification?

+

It depends on your device, your markets and how your own quality system controls suppliers. ISO 13485 lets the legal manufacturer control outsourced processes through supplier evaluation and quality agreements, and many medical device makers prefer suppliers that hold their own certification. Your regulatory lead and your notified body or FDA strategy set the actual requirement, so treat this as a question for them.

What IPC class is used for medical PCB assembly?

+

IPC Class 3 covers products that must work on demand, where downtime is not tolerated, and names life support among its examples. Many non-critical medical and wellness devices are built to Class 2. The class is chosen from the device's risk analysis and its customer or regulatory requirements, then written on the assembly drawing so the assembler inspects to it.

HardwareMap catalogues the medical hardware startups that turn these quality systems into shipped devices. Building one? Submit it and get a part number.