Medical Device Contract Manufacturing (2026): A Buyer's Evidence Checklist for Sterile Single-Use Devices

A medical device can look finished long before its evidence is finished. The pouch is sealed. The label is printed. The sample passes inspection. Yet the legal manufacturer is still unclear, the production bill of materials is not frozen, the sterilization load does not match the validation family, or the factory can change a critical material without asking the brand owner.

Those are not paperwork defects. They are product defects waiting for a trigger.

This guide is for device companies, private-label brands, importers and distributors selecting a medical device contract manufacturer—especially for sterile single-use devices and procedure kits. It is not a ranking of factories. It is a way to turn supplier qualification into an evidence-based release decision.

In this guide

• Why the supplier list is not the shortlist
• Name the regulatory roles before you audit the factory
• Read the certificate at device-and-site level
• Freeze the device before you validate the process
• Validate the invisible product
• Make the label, UDI and released configuration agree
• Use the quality agreement as a control system
• Prove repeatability before commercial scale
• A weighted supplier scorecard
• Copy-ready RFQ and purchase-order evidence schedule
• Where VEMERIX fits—and where due diligence still begins
• Frequently asked questions

Why the supplier list is not the shortlist

The phrase “FDA-registered contract manufacturer” sounds like a qualification. It is actually an establishment role.

FDA defines a contract manufacturer as an establishment that manufactures a finished device to another establishment's specifications. A contract sterilizer performs sterilization for another establishment's devices. These activities can require establishment registration and listing, but registration does not mean FDA has approved the facility, approved the device, or confirmed that the facility can make your configuration.⁵

We rebuilt the current FDA relationship tables—rather than relying on flattened search records—and deduplicated active establishments as of 27 July 2026. The result is a large discovery universe: 7,245 contract manufacturers, 572 contract sterilizers and 16,425 establishments carrying the manufacturer role. Of the contract manufacturers, 278 also carry the contract-sterilizer role and 3,869 also carry the manufacturer role.¹

China is the largest non-US base in the role file, with 950 active contract-manufacturer establishments. That is useful for discovery. It says nothing about whether one establishment's certified scope includes a laser fiber, an NPWT dressing, a circumcision device or a sterile injection needle.

The product-code distribution makes the specialization visible. The median active contract manufacturer lists two FDA product codes. The 75th percentile lists six; the 90th lists 15. Fully 2,472 establishments—34.1%—list exactly one code.¹

The pool shrinks again when the search is tied to a device family. The same FDA file contains only six contract manufacturers listing the circumcision-instrument code HFX, 36 across four NPWT codes, 76 for the general injection-needle code FMI, 90 for surgical lasers under GEX, and 462 across a broad 31-code wound-and-skin cluster. GEX is broader than endovenous laser ablation, and the wound cluster spans several classes and claims, so these are discovery counts rather than capability rankings.¹

This changes how a buyer should use public databases. Registration and product codes can answer, “Which establishments are worth contacting?” They cannot answer, “Which supplier is ready to receive this design, validate this process and release this sterile lot?” That second question requires evidence from the proposed site and program.

Name the regulatory roles before you audit the factory

An OEM/ODM conversation usually begins with design, price and minimum order quantity. A regulated program should begin with a role map.

Write down, for each target market, who will be the legal manufacturer, specification developer, labeler, contract manufacturer, sterilizer, importer and authorised representative. Use legal names and site addresses—not brand names. Then connect each role to a controlled document, a regulatory obligation and a decision right.

United States: activity and responsibility are related, but not identical

The QMSR applies to manufacturers of finished devices intended for commercial distribution. FDA's definition of a finished device includes a device or accessory that is suitable for use or capable of functioning, even if it is not yet packaged, labeled or sterilized.² That means a contract manufacturer's relevance depends on what it actually produces, not whether the brand owner performs the final commercial step.

QMSR took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. On the same date, FDA stopped using QSIT and began using the inspection approach in Compliance Program 7382.850.² The new program tells investigators to assess contractor controls and recognizes written allocation of responsibilities for contract sterilization.⁶

The practical rule is simple: outsource the operation, not the accountability. The finished-device manufacturer still needs evidence that outsourced processes are adequate and that the released device conforms.

European Union: putting your name on the device can change the answer

EU MDR Article 10 places lifecycle responsibilities on the manufacturer, including the QMS, technical documentation, risk management and post-market surveillance. Annex IX requires the QMS description to cover controls over another party performing design, manufacture, final verification or testing; notified-body audits may extend to suppliers and subcontractors.⁷

Article 16 matters for private-label arrangements. If a distributor or importer makes a device available under its own name, registered trade name or trademark, it can assume manufacturer obligations unless an agreement keeps the original manufacturer identified on the label and responsible under the MDR.⁷ A brand change can therefore be a regulatory-role decision, not a graphic-design task.

Great Britain: virtual-manufacturer guidance makes the control gap explicit

MHRA says an organisation that fully sources an own-named device and places its name and address on the product becomes the virtual manufacturer and takes the legal responsibilities of the manufacturer. It must hold the relevant technical documentation and operate the applicable QMS; it cannot satisfy those duties by pointing to the OEM's files or QMS.⁸

MHRA also gives a practical contract list: link the exact device and part number, allocate post-market and vigilance activities, require change notification, preserve audit access and ensure unredacted information can reach the authority or conformity-assessment body when needed.⁸ Those controls belong in the qualification package before the first commercial purchase order.

Read the certificate at device-and-site level

“ISO 13485 certified” is not a binary fact about a brand. It is a bounded claim about a named organisation, one or more sites, a defined scope, a validity period and a certification status.

ISO describes ISO 13485:2016 as a medical-device-specific QMS standard. ISO also notes that certification is not required by the standard itself.⁹ Certification can be valuable independent evidence. Its usefulness still depends on what the certificate says.

The five-point certificate match

1. Entity. Does the certificate holder match the party signing the supply agreement? If the commercial brand and legal company differ, document the relationship.
2. Site. Is the proposed manufacturing, packaging or sterilization address inside the certificate? A certificate for headquarters does not automatically cover a satellite plant or subcontractor.
3. Scope. Does the wording include design, production, service or sales—and the relevant device family? These verbs are not interchangeable.
4. Dates. Is the certificate current? Ask for surveillance status, not only the original PDF.
5. Status. Can the certificate and certification body be verified? Investigate suspension, withdrawal or scope reduction.

Then move below the certificate. Request the controlled scope of the QMS, organisation chart, relevant procedures, internal-audit and management-review evidence, recent external-audit findings and closure, complaint/CAPA trending, critical-supplier list and device-specific validation index. The goal is not to collect every SOP. It is to confirm that the proposed program lives inside an operating system rather than beside it.

Supplier-control guidance from GHTF/IMDRF reinforces the point: a manufacturer should control products and services obtained from suppliers, including subcontracted activity further down the chain.¹⁰ Regulatory auditors may visit a supplier to test those controls, and a supplier-premises audit does not necessarily assess the supplier against every ISO 13485 requirement.¹¹ “Our notified body audited us” therefore does not answer what was audited, for which customer, under which scope or against which controls.

Ask for the subcontract map

For a sterile single-use product, the visible factory may not control every critical operation. Resin conversion, molding, needle manufacture, coating, printing, pouch supply, laboratory testing and sterilization may occur at different entities. Require a process map showing:

• each critical supplier and site;
• the operation performed;
• which party qualifies and monitors it;
• what evidence returns with each lot;
• who may approve a change; and
• whether the buyer, notified body or regulator can obtain access.

If the supplier will not identify a critical subcontractor under confidentiality, the buyer cannot verify the chain. That is a stop condition, not a negotiable documentation preference.

Freeze the device before you validate the process

A transfer project fails when two teams believe they are building the same device but are working from different definitions.

The brand owner thinks the approved sample defines the product. The factory thinks the latest drawing defines it. Purchasing substitutes a material that meets a generic description. Regulatory assumes the previously tested configuration is unchanged. Quality receives a test method whose fixture and conditioning are unspecified.

Every one of those parties can be acting reasonably while the device drifts.

Build a transfer baseline, not a file dump

The baseline should include:

• intended purpose, users, use environment, indications and claims;
• device family and variant rules;
• drawings, tolerances, materials and complete BOM;
• approved suppliers and material specifications;
• software/firmware where applicable;
• manufacturing flow, equipment, tooling and environmental requirements;
• risk controls that manufacturing must implement;
• inspection and test methods, fixtures, conditioning and acceptance criteria;
• packaging, label and IFU masters;
• sterilization family/load definition;
• storage, transport and shelf-life claims;
• golden units with the complete build and release record; and
• ownership and retention for each record.

ISO 14971 applies risk management across the device lifecycle, including production and post-production information.¹² That gives the transfer team a useful discipline: every critical manufacturing control should trace to a requirement or risk, and every field signal should be able to travel back into the risk file.

Separate verification, validation and capability

These words are often collapsed into “tested.” Keep them separate.

• Verification asks whether an output meets a defined requirement.
• Validation asks whether a process or device consistently achieves its intended result under defined conditions.
• Capability asks whether routine output remains within limits with an adequate operating margin.

For measurable outputs, confirm that the method can distinguish conforming from nonconforming product. Include measurement-system analysis where appropriate. For special processes whose result cannot be fully verified by later inspection—sterilization, sealing, bonding, coating or some cleaning operations—require documented validation and defined revalidation triggers.

Do not accept a protocol written after the lots have already run, a report whose tested configuration cannot be reconstructed, or “three good lots” without an approved rationale for ranges, worst cases, sampling and acceptance criteria.

Validate the invisible product

For a sterile single-use device, the most important product attributes may be invisible at incoming inspection. A device can look perfect and still carry excessive bioburden, sit behind an inadequate seal, retain excessive EO residuals or lose sterile-barrier integrity before the labeled expiry.

FDA's sterilization inspection guide treats sterilization as a controlled, validated process. It tells investigators to review validation, routine monitoring, deviations, equipment control, software validation and personnel qualification. It also states that a finished-device manufacturer using a contract sterilizer retains responsibility for sterility and must be able to provide validation and processing documentation.⁴

1. Bioburden and cleanliness

ISO 11737-1 covers the enumeration and microbial characterisation of viable microorganisms on a health-care product, component, raw material or package.¹³ The buyer should see the method, recovery-efficiency work where applicable, sampling plan, baseline and trend—not only a laboratory result for one lot.

Connect the bioburden program to material, site, cleaning, environment, handling and hold-time controls. Define what change or excursion forces investigation or requalification.

2. Sterile-barrier system and sealing

ISO 11607-1 addresses materials and sterile-barrier/packaging systems intended to maintain sterility until use; ISO 11607-2 addresses validation of forming, sealing and assembly processes.¹⁴

Ask for package-system qualification and sealing-process validation tied to the exact pouch, device, sealer, tooling and operating window. Routine records should show critical parameters and acceptance results. If a pouch supplier, film, adhesive, sealer or pack-out changes, the change matrix should state what must be reassessed.

3. EO cycle and load

ISO 11135 covers development, validation and routine control of EO sterilization for medical devices.¹⁵ FDA estimates that more than 20 billion devices sold in the US each year are sterilized with EO, about half of devices requiring sterilization.³ The method is common because it can penetrate packaging and is compatible with many materials. Common does not mean generic.

Require the product-family or adoption rationale, load configuration, cycle parameters, performance qualification, biological/chemical indicator strategy, routine release criteria, deviation handling, requalification schedule and change triggers. Confirm which establishment approves release and which records the legal manufacturer receives.

For devices usually expected to meet a sterility assurance level of 10^-6, the 510(k) sterility information and recognized standards should align with the intended claim and device context.¹⁶

4. EO residuals

ISO 10993-7 sets allowable limits and compliance methods for EO and ethylene chlorohydrin residuals on patient-contacting EO-sterilized devices.¹⁷ The relevant evidence depends on device contact and exposure. Ask how the aeration process, material set, packaging and worst-case configuration connect to the residual evaluation.

5. Distribution and shelf life

Accelerated aging can support an expiry claim, but it is not the end of the shelf-life program. FDA's recognized-standard summary for ASTM F1980 says real-time studies are essential to confirm accelerated-aging results.¹⁸

The evidence package should connect aging to sterile-barrier integrity and device performance after conditioning and distribution challenge. Confirm that real-time pulls are scheduled and owned. A supplier that promises a three-year shelf life from an accelerated-aging report should also show the real-time confirmation plan and the action if a pull fails.

The recall record shows why the chain matters

Our analysis of 370 FDA recall records across a 31-code wound-and-skin cluster found 220 records—59.5%—in eight selected process, package, material, contamination, employee and environment root-cause categories. This is not an incidence rate and not a measure of any one supplier. It shows how frequently those selected control-related categories appear in this wound-and-skin recall record.¹⁹

The conclusion is not “all recalls are manufacturing failures.” The conclusion is narrower and more useful: the sample on the conference-room table does not exercise the controls that dominate the real field record.

Make the label, UDI and released configuration agree

A contract manufacturer can build the physical device correctly and still release the wrong market identity.

The approved configuration, regulatory file, label/IFU, UDI data and production record should reconcile. FDA's UDI system requires the labeler—typically the manufacturer, though sometimes another defined party—to place the UDI on labels/packages and submit device information to GUDID, subject to exceptions and alternatives. The fixed device identifier identifies the labeler and specific version or model; production identifiers can include lot, serial number, manufacture date and expiry.²⁰

Before artwork approval, resolve:

• legal-manufacturer and labeler identity;
• brand/private-label relationship;
• model and catalogue hierarchy;
• DI ownership and change rules;
• lot/batch and expiry format;
• intended purpose and claims;
• symbols, language and IFU version;
• sterilization method and sterile claim;
• importer/authorised-representative information; and
• which revision is permitted in each market.

Create a release reconciliation record: one line for the manufactured configuration, one for the registration/technical-file coverage, one for label/UDI, and one for the batch record. If any line describes a different device, stop release.

Use the quality agreement as a control system

A supply agreement buys units. A quality agreement controls the decisions that can change those units.

The quality agreement should not repeat that both parties care about quality. It should name the trigger, decision owner, notice deadline, required evidence, approval class, escalation path and retained record for each control.

Change control: ban silent equivalence

The agreement should cover changes to materials, specifications, approved sources, sites, subcontractors, processes, equipment, tooling, software, test methods, sampling, environment, packaging, labeling, sterilization, logistics and regulatory status.

Classify changes. Some require notice; others require prior written approval; some require regulatory assessment before implementation. Define emergency change handling without creating a back door for silent substitution.

“Equivalent material” is not a decision rule. The supplier should identify the exact change, affected requirements and risks, validation/verification needed, regulatory impact, implementation lot and traceability plan.

Complaints and vigilance: start the clock at awareness

FDA's manufacturer-reporting guidance explains the reporting and recordkeeping duties for device-related deaths, serious injuries and certain malfunctions.²¹ A legal manufacturer cannot meet those duties if the contract manufacturer holds a complaint, failure analysis or nonconformance while the parties debate whose customer it is.

Set an initial-notice deadline short enough to support the strictest target market. Define the minimum information for the first notice, sample preservation, investigation ownership, regulatory-reportability support and final report. Require trend data, not only individual case closure.

Corrections and recalls: know who can find the lot

FDA says manufacturers and importers must report certain corrections or removals involving a risk to health within 10 working days, and medical-device recalls are usually voluntary manufacturer actions under 21 CFR 7.²² The agreement should specify who decides, who reports, who contacts customers, who controls returned product and how effectiveness is checked.

Test traceability before a crisis. Give the supplier a lot and ask it to identify incoming materials, equipment, operators, test results, sterilization load and ship-to customers. Then reverse the test from a critical incoming lot to every finished lot and customer affected.

Prove repeatability before commercial scale

A preproduction sample is often built by the best technician, with hand-selected components and unusual attention. Commercial evidence must show that the normal system can repeat it.

Run pilot lots using the intended production site, equipment, tooling, work instructions, environment, trained operators, approved materials, inspection methods, packaging and release route. The number and design of lots should follow risk and validation rationale rather than a ritual number.

The pilot release packet should let an independent reviewer reconstruct what was built and why it was accepted. At minimum it should contain:

• approved configuration and revisions;
• incoming material/component lot evidence;
• equipment, tooling, calibration and maintenance status;
• operator qualification;
• process parameters and environment records;
• inspection/test raw data and results;
• package and sterilization linkage where applicable;
• deviations, investigations and dispositions;
• yield, scrap and rework summary;
• traceability record; and
• signed release decision.

Do not let capacity remain a spreadsheet promise. Ask which validated equipment constrains output, what current committed load exists, which materials have long lead times, what a line interruption looks like and how quickly records/tooling can transfer if the relationship ends.

A weighted supplier scorecard

Once the stop gates pass, score the remaining evidence. A practical weighting for sterile single-use devices is:

• role and regulatory fit: 15%
• entity, site and QMS scope: 15%
• device-family and transfer competence: 15%
• process and measurement validation: 15%
• sterility, package and shelf life: 15%
• change, complaint and recall controls: 10%
• scale, continuity and release: 10%
• commercial fit: 5%

Score each domain from zero to five and multiply by its weight. A reasonable award rule is all mandatory gates passed and at least 80/100 overall. Adjust weights for the device risk and business model, but do not allow price or total score to compensate for unresolved legal role, scope or special-process evidence.

Record the evidence behind every score. “Good communication” is not a four. “Change procedure reviewed; 10 sampled changes matched classification and approval rules; two late notices were closed by CAPA” is a defensible four.

Copy-ready RFQ and purchase-order evidence schedule

The following schedule is a procurement starting point, not legal advice. Adapt it with regulatory and legal counsel to the device, market and contracting structure.

Before technical quotation

Require:

1. legal entity, ownership and all proposed site addresses;
2. current ISO 13485 certificate and scope, plus verification route;
3. establishment registrations/roles relevant to target markets;
4. critical subcontractor map, including packaging, testing and sterilization;
5. device-family experience stated by product type and process—not confidential customer name;
6. regulatory-role proposal for each target market;
7. preliminary process flow and special-process list; and
8. confirmation of document, tooling and data ownership assumptions.

Stop before quotation if the party cannot identify who makes, labels, sterilizes or legally places the device on the market.

Before sample authorization

Require:

1. approved intended-use/claims baseline;
2. drawing, specification and BOM revision list;
3. approved material/source list;
4. sample-build traveler or equivalent record;
5. inspection/test plan and method references;
6. sample deviation disclosure;
7. label/packaging concept with legal roles marked; and
8. regulatory and biological-risk questions requiring closure.

Do not call a sample “approved” unless its exact configuration and build record are known.

Before validation

Require:

1. signed transfer baseline;
2. risk-to-control traceability for manufacturing and special processes;
3. validation master plan with protocols, responsibilities and acceptance criteria;
4. equipment/tooling qualification status;
5. measurement method suitability and MSA plan where applicable;
6. worst-case/product-family rationales;
7. package, sterilization, residual, distribution and aging strategy;
8. change/revalidation trigger matrix; and
9. approved quality agreement.

Validation acceptance clause: No report is accepted if the tested configuration, raw data, deviations, equipment, operators, environment, methods or acceptance criteria cannot be reconstructed.

Before commercial purchase order

Require:

1. approved validation reports and open-item register;
2. target-market registration/technical-file coverage assessment;
3. approved label, IFU and UDI/identifier ownership;
4. signed golden configuration;
5. approved pilot lots and complete release packets;
6. routine lot-release checklist and certificate format;
7. complaint, vigilance, recall and traceability contacts with deadlines;
8. capacity and critical-material continuity plan;
9. record-retention and audit/regulator-access terms; and
10. exit-transfer and tooling/data ownership terms.

Suggested purchase-order acceptance language

Product is accepted only when the delivered lot conforms to the approved device, material, process, packaging, sterilization, labeling and test revisions identified in the purchase order and quality agreement; the complete release packet is supplied or available as agreed; all deviations and changes are disclosed and approved under the agreed classification; and lot traceability reconciles incoming materials, manufacturing records, sterilization/load records where applicable, finished identifiers and shipment records. Delivery, payment or inspection of appearance alone does not waive these requirements.

For sterile product, add:

The supplier shall not change the device family, load configuration, sterilization site, validated cycle, packaging material/system, sealing process, aeration, residual evaluation, shelf-life basis or associated critical supplier without the notice, assessment and approval required by the quality agreement. Routine release shall use the approved criteria, and deviations shall be disclosed before shipment.

Where VEMERIX fits—and where due diligence still begins

VEMERIX is the international brand of Weihai Medison Medical Equipment Co., Ltd. Its live site invites OEM/ODM proposals for private-label supply, custom kit assembly and registration-document support. It describes a 2,000 m² Weihai plant with Class-100K manufacturing, EO sterilization and an in-house QA centre.²³

Those facts make VEMERIX relevant to this buyer workflow. They do not exempt it from the workflow.

The current Weihai Medison ISO 13485 certificate—No. 10425YQ00012R0S, issued 29 September 2025 and valid through 28 September 2028—names the Qujiahe Industrial Park site. Its scope covers design and development and production of named devices including automatic circumcision rings, disposable circumcision staplers/sets, a medical vacuum negative-pressure machine, disposable medical laser fibers, scar gel, disposable sterile circumcision devices and a syringe-assisted propulsion device.²⁴

The same certificate states sales of disposable sterile injection needles. It does not state production of those needles.²⁴ A buyer interested in that product should therefore identify the actual manufacturing site and entity, verify the subcontract chain and apply the same scope, validation and change controls to it.

This is the right way to use a certificate: precisely.

For any VEMERIX program, the buyer should request the device-specific package: proposed role map, exact SKU-to-scope mapping, controlled specification/BOM, relevant NMPA documents, process-validation index, sterile-barrier and EO records where applicable, label/UDI proposal, quality agreement, pilot release record and critical-subcontractor map. VEMERIX's product portfolio spans surgical devices, a Medison-made disposable 1470 nm laser fiber paired with a partner-supplied laser source, NPWT, wound/skin products and aesthetic delivery devices; target-market claims and certificates must be checked SKU by SKU.²⁵

That boundary is not a weakness. It is what a credible contract-manufacturing conversation looks like.

Frequently asked questions

Is an ISO 13485 certificate enough to qualify a medical device contract manufacturer?

No. It is useful QMS evidence when the legal entity, site, scope, dates and status match the proposed program. Qualification still needs device-specific transfer, process, test, packaging/sterilization, release, change and post-market evidence. ISO itself notes that certification is not a requirement of ISO 13485.⁹

Does FDA registration mean the factory or device is FDA approved?

No. Registration and listing identify establishments, activities and listed devices. FDA explicitly defines establishment roles such as contract manufacturer and contract sterilizer; those records are not a facility approval or a substitute for the applicable device marketing pathway.⁵

Who is responsible when sterilization is outsourced?

The written agreement should allocate operations and records, but FDA's inspection guidance says the finished-device manufacturer retains responsibility for the sterility of its finished devices and must have validation/processing documentation available. The contract sterilizer remains responsible for controls within its operations.⁴

What is the difference between an OEM, ODM and legal manufacturer?

OEM and ODM are commercial descriptions. Legal manufacturer is a regulatory role shaped by the device label, specifications, market and governing rules. A private-label brand can become the legal/virtual manufacturer when it places its name on the product, depending on jurisdiction and agreement.⁷⁸

What should a quality agreement cover?

At minimum: controlled specifications; supplier/subcontractor controls; validation and release; deviations/nonconformances; change classification, notice and approval; complaints/vigilance; traceability; corrections/recalls; audit/regulator access; record retention; continuity; and exit transfer. Each clause needs a trigger, owner, deadline, required evidence and escalation route.

Can accelerated aging alone support the labeled shelf life?

It can support an initial expiry rationale when appropriately designed, but FDA's recognized ASTM F1980 summary says real-time aging studies are essential to confirm accelerated-aging results.¹⁸ The program should also test package integrity and device performance after the relevant conditioning and distribution challenge.

How many pilot lots are required?

There is no responsible universal number. The rationale should follow device and process risk, number of lines/tools/cavities/sites, variability, worst cases and applicable validation requirements. The important point is that pilots use the intended commercial system and produce reconstructable release records.

What is the biggest red flag in a private-label medical device deal?

An unresolved role map. If neither party can state who owns the intended purpose, technical documentation, label/UDI, registration, change decision and post-market reporting in each target market, technical work is being built on an unstable legal foundation.

How should price enter the award decision?

After the stop gates pass. Compare landed cost, payment terms, minimum order quantity, tooling, validation, testing, sterilization, packaging, freight, inventory and failure/continuity exposure. A low unit price cannot compensate for a device that cannot be released or a change that cannot be controlled.

Conclusion

The best medical device contract manufacturer is not the factory with the longest capability list. It is the one whose exact role, site, scope, configuration, processes, sterile system, market identity and release records can be tested—and whose agreement prevents those facts from changing silently.

Four rules make that principle operational:

1. Use public registrations for discovery, not qualification. A role and product-code listing can identify candidates; only site- and device-specific evidence can support an award.
2. Set regulatory and quality stop gates before scoring price. Legal role, QMS scope and special-process evidence cannot be offset by a high commercial score.
3. Freeze the device and its market identity before validation. The validated configuration must reconcile with the BOM, label, UDI, packaging, sterilization family and released lot.
4. Make the agreement control real events. Changes, complaints, traceability, recalls, continuity and exit transfer need triggers, owners, deadlines and records—not broad promises.

If you are evaluating a sterile single-use or minimally invasive device program, VEMERIX can provide its product, registration and quality-document package for an evidence-level review. Ask for the exact SKU and target market; the useful conversation begins there.