Supplier quality management software for medical devices

HAVGATE supplier management is the approved-supplier record for medical device teams: who you buy from, why they are approved, how critical they are, when they must be re-evaluated, and which CAPAs started from their product or service.

Purchasing is a quality process

ISO 13485:2016 clause 7.4 requires the organization to ensure that purchased product conforms to specified purchasing information. The type and extent of control applied to the supplier and the purchased product must be dependent upon the effect of the purchased product on subsequent product realization or the final product. Suppliers must be evaluated and selected based on their ability to supply product that meets requirements. Criteria for selection, evaluation and re-evaluation must be established, and records of the results and of any necessary actions must be maintained. Clause 4.1.5 adds that when you outsource a process, you remain responsible for conformity and you must control the outsourced process.

That is a wider duty than 'we have a vendor list'. A contract sterilizer, a contract manufacturer, a software supplier used in the QMS, a calibration laboratory and a component supplier are not the same risk. The control should match the effect. A catalog item with no effect on the device does not need the file you keep for the sterile barrier. HAVGATE's supplier records are there so the criteria, the decision and the re-evaluation date are not trapped in email. Criticality and status are visible. Change requests and performance notes stay with the supplier instead of in a side spreadsheet.

MDSAP purchasing and outsourcing

MDSAP treats purchasing as its own chapter in the audit approach and also asks, in management task 1.5, whether the extent of outsourcing is documented and controlled. Auditing organizations sample supplier controls because so much of a small device company is outsourced: design, manufacturing, sterilization, warehousing, complaint intake, even internal audit. The record they want is proportionate control plus retained responsibility. If your file says 'approved' and cannot show the criteria or the last evaluation, the task is not met. If your file shows a failed incoming inspection that never became a supplier action, the link to CAPA is the gap.

EU MDR Article 10 requires the QMS to cover product realization, which includes suppliers. Economic operators have their own duties, but the manufacturer's purchasing controls do not disappear because a distributor exists. QMSR points back at ISO 13485 clause 7.4 for US manufacturers. One supplier file, kept to 7.4, is the file you can show in all three conversations if it is complete.

Re-evaluation, changes and CAPA

Approval is not permanent. A supplier who changes a material, a site or a sub-tier can change your device. The record should show change notifications and your decision: accept, audit, or requalify. Performance can be as simple as a count of incoming nonconformances and late deliveries, reviewed on the re-evaluation date you set. HAVGATE's supplier pages describe risk scoring, re-evaluation reminders, controlled changes and CAPA records connected to the supplier. Use the reminder. A list that was approved in 2022 and never opened again is a finding even if every shipment was fine, because the standard asks for re-evaluation, not only for a good receiving history.

Supplier audits use the audit module. Plan them against the same criteria you use for internal audits when the supplier's QMS matters, or against a shorter purchasing checklist when you are verifying a specific control. Write the finding in the audit, then link the action to the supplier and to CAPA if your system is at fault as well as theirs. A supplier corrective action request that lives only in email will not show up in management review. A CAPA that never tells the supplier what to do will not change the next lot. Keep both sides, and say which organization owns which action.

A file that is enough, and not a novel

For a low-risk supplier, the file can be the criteria, a short evaluation, the scope of approval and a re-evaluation date. For a critical supplier, add the quality agreement topics you actually rely on: change notification, right to audit, traceability, nonconforming product, and who contacts the regulator if a field action is needed. Do not copy a 40-page agreement template you will not follow. MDSAP and notified bodies notice unused controls as quickly as they notice missing ones.

Software suppliers count when the software is part of the device or part of the QMS. HAVGATE, used as your eQMS, is itself a supplier. Your file for it should point at the security page, the validation package on Business and Enterprise, and the intended use you wrote down. That is the same 7.4 logic you apply to everyone else. There is no special exemption because the tool is the QMS.

Screenshots of the supplier registry are published on the QMS and supplier pages so you can see criticality and status before a trial. No customer story is attached, because none is claimed. If you are a contract manufacturer reading this as the supplier rather than the buyer, the segment page for contract manufacturers describes the same records from the other side of the agreement.