Device supplier quality under QMSR: clause 7.4, PPAP and the package that disagrees with itself
Purchasing controls have sat near the top of FDA's device inspection observations for years. Since February 2, 2026 the requirement lives in ISO 13485 clause 7.4, incorporated by reference into 21 CFR Part 820. The clause number changed. The weak point did not: supplier files that look complete and do not hold together.
What clause 7.4 asks for
| Clause | Requirement | Record an investigator will ask for |
|---|---|---|
| 7.4.1 Purchasing process | Criteria to evaluate and select suppliers, proportionate to risk. Planned monitoring and re-evaluation. | Supplier evaluations, the approved supplier list, re-evaluation records |
| 7.4.2 Purchasing information | Specifications and requirements communicated to the supplier, including a written agreement to notify you of changes before they are made. | Purchase specifications, quality agreements, change notifications |
| 7.4.3 Verification of purchased product | Verification scaled to supplier evaluation results and risk. Assessment of any change you become aware of. | Incoming inspection records, first article results, change assessments |
| 4.1.5 Outsourced processes | Control of outsourced processes proportionate to risk, with written quality agreements. | Quality agreements, process validation held by the supplier |
CLAUSE REFERENCES ARE TO ISO 13485:2016 AS INCORPORATED BY 21 CFR PART 820.
Since the QMSR took effect, supplier audit reports are among the records FDA has said it intends to review.
Where PPAP fits
FDA does not require a Production Part Approval Process. Many device manufacturers require it of their suppliers anyway, because its elements produce the evidence clause 7.4 asks for: design records, process flow, PFMEA, control plan, measurement system analysis, dimensional results, material and performance results, initial process studies and a signed part submission warrant.
That makes the supplier quality manual a requirement set in its own right. Where your manual sets a capability index or a change-approval rule, the supplier's own procedure does not override it.
Where a package contradicts itself
- Control plan against PFMEA. A special characteristic appears in one and is missing from the other, or a process step has no failure modes.
- Results against the drawing. Dimensional results reported against a superseded revision.
- Capability against the customer requirement. A process study accepted at the supplier's own threshold when the customer's is stricter.
- Change declarations against change records. A warrant stating no changes, with an engineering change notice elsewhere in the package.
- Measurement against the gauge. A characteristic measured on equipment with no measurement system study on file.
Each document is signed. A checklist review confirms that all of them are present. The contradictions only show when the package is read as one record.
What to have ready
- A current approved supplier list with the basis for each approval.
- Quality agreements with change notification, signed and in date.
- Supplier audit reports with findings closed or tracked. These are now within reach of an FDA request.
- Evidence that incoming verification matches the risk you assigned.
- A change assessment for every supplier change you were told about.
Where Clinplex fits
Clinplex reads a supplier submission package and your device procedures against 21 CFR 820, ISO 13485 and your own customer requirements, read-only, and shows where the documents contradict each other. The disposition of a submission stays with your supplier quality team, in your QMS.
For what else changed in device inspections this year, see QMSR inspections: what FDA reads now.
Sources
- FDA, Quality Management System Regulation. Final rule effective February 2, 2026. fda.gov
- 21 CFR Part 820. ecfr.gov
- ISO 13485:2016. Medical devices, quality management systems, requirements for regulatory purposes. Clauses 4.1.5 and 7.4.
- FDA, Inspection Observations. Annual device data sets. fda.gov
- AIAG, Production Part Approval Process (PPAP), 4th edition.
Frequently asked questions
Does FDA require PPAP for medical devices?
No. PPAP is an industry method that many device manufacturers impose on suppliers. FDA requires the purchasing controls in ISO 13485 clause 7.4 as incorporated by QMSR.
What replaced 21 CFR 820.50?
QMSR removed the old purchasing controls section and incorporates ISO 13485:2016, where clause 7.4 covers purchasing and clause 4.1.5 covers outsourced processes.
Can FDA ask for supplier audit reports now?
Yes. FDA has stated that under the QMSR it intends to review supplier audit reports, along with internal audit and management review records, which were exempt under the former 820.180(c).
Whose acceptance criteria apply, the supplier's or ours?
Yours, where your purchasing requirements state them. That is why they belong in the purchasing information and the quality agreement.
Read the package before you sign it.
Send three records. We return the gaps with the clause attached in 48 business hours, under a mutual NDA.
Run an Inspection Stress Test