ISO 13485 7.4.1 Purchasing Process

Does the interpretation of 7.4.1 mean when evaluating suppliers you only evaluate the supplier themselves or do you evaluate the supplier and the product being purchased? If you want to purchase another product from the same supplier do you need to evaluate the supplier and the new product being purchased or can you just document the supplier is an approved supplier? Product I'm referring to is considered critical to the manufacturing process.

 

Given the diversity of suppliers and purchased product (which can include 'service'), it's a little difficult to answer. The goal, of course, is to ensure that the purchased product meets spec. One approach for that would be to qualify the supplier to ensure that suppler can consistently deliver product (or service) that meets your specifications. If you engage a contract manufacturer, for example, you evaluate them to determine if they have the capability to meet your requirements. You may also put controls in place to ensure their outputs, in fact, do meet your specification (if they provide something absolutely critical to patient safety, maybe you do 100% inspection).

Two examples:

1) You purchase contract manufacturing services to do injection molding on one of your parts. You're going to qualify the supplier to confirm they have the ability to do injection molding. You probably do some kind of first article inspection and then ensure they have process controls in place to consistently meet part spec. If you design another part that will also be injection molded, you probably don't need to re-qualify the supplier (unless the process is substantially different or rate is substantially higher or...). If, though, you need a part that is 3-D printed or milled, you would need to re-qualify that supplier to confirm they have that capability.

2) You purchase software development services for an application that runs on a Windows computer. You certainly want to ensure that software service provider is capable of developing for that environment and you will certainly evaluate (test) the software once it's delivered (or have them test and provide the results). If you then decide you need software developed for an embedded platform (e.g., ARM), you're going to re-evaluate that supplier to see if they can also develop for that environment as well.

So I think the answer is "it depends." Both the supplier and the product factor in to the controls to be established for 7.4.1.