Many suppliers and subcontractors in the medical-device supply chain are certified to ISO 9001 rather than ISO 13485. The publication of ISO 9001:2026 therefore raises an important question for medical-device manufacturers: What changes can manufacturers expect from their ISO 9001-certified suppliers, and should these changes affect supplier management?
ISO 13485 requires the manufacturer to establish criteria for supplier selection, evaluation and re-evaluation. The type and extent of control must reflect the effect of the purchased product or service on the quality of the medical device. The central question being: Can this supplier consistently provide products or services that conform to the manufacturer’s requirements?
An ISO 9001 certificate can support this evaluation because it provides independent evidence that the supplier operates a quality management system. Nevertheless, the certificate alone does not demonstrate that the supplier:
• Understands the manufacturer’s specific technical and quality requirements
• Can consistently meet the agreed specifications
• Controls critical processes and subcontractors adequately
• Will notify the manufacturer of relevant changes
• Meets applicable medical-device regulatory requirements
• Has sufficient capacity, competence and continuity arrangements
The manufacturer must therefore combine certification information with other evidence, such as certificates of analysis, quality agreements, receiving inspection, audits, change notifications and performance data.
ISO 9001:2026 retains the established process-based quality-management framework. The main changes are expected to refine how suppliers address several management-system subjects rather than fundamentally change operational controls. Medical-device manufacturers may see greater attention to:
Supplier leadership is expected to promote a culture in which quality concerns are reported, information remains accurate and commercial pressures do not override established controls. This may provide useful additional insight into how a supplier responds to deviations, complaints, adverse trends and customer concerns.
ISO 9001 primarily addresses organizational, process and supply-chain risks that could affect a supplier’s ability to consistently deliver conforming products or services. These may include dependence on:
• Dependence on a single material source
• Limited production or testing capacity
• Dependence on specialist personnel
• Obsolescence of equipment or components
• Critical subcontracted processes
• Disruptions affecting production or delivery
Foremost, an ISO 13485-certified medical-device manufacturer must consider risks from a product-perspective: could they ultimately affect the device’s quality, safety, performance or regulatory compliance? For example, a supplier capacity problem may become relevant if it leads to material substitutions, reduced process controls or delivery interruptions.
Then again, the manufacturer also has a clear business interest in maintaining continuity of supply and operations. Supplier opportunities, such as automation, alternative sourcing or new production methods, may improve quality or continuity but can also introduce changes requiring evaluation. These conditions are not necessarily supplier nonconformities, but they should inform the manufacturer’s supplier controls and, where relevant, product risk management.
ISO 9001:2026 is expected to give more attention to planning QMS changes. Suppliers may therefore apply more structured internal evaluation before introducing changes. However, effective internal change management does not automatically mean that the medical-device manufacturer will receive advance notification. Notification and approval obligations must still be defined in purchasing information or a quality agreement.
Suppliers may place greater emphasis on retaining essential process knowledge and considering external issues, including climate-related issues. For the manufacturer, these subjects are relevant only where they can affect product or service conformity, availability or continuity of supply.
A ISO13485 certified manufacturer should not need to redesign its supplier-management process. A focused review should be sufficient.
Supplier Audits.
To perform effective supplier audits, audit teams should have an appropriate understanding of ISO 9001 and, in particular, the changes introduced in ISO 9001:2026. This will help them recognize relevant changes in suppliers’ quality systems and assess how these may affect the manufacturer’s supplier controls.
Review Supplier Classification.
For any ISO 9001 certified suppliers, determine the suppliers plans and timelines to transition to the new version of ISO 9001.
Update Supplier Qualification Questions.
Where relevant to supplier risk, add questions covering:
• Actions to promote and improve quality culture and escalation of quality concerns
• Significant risks that could affect consistent supply
• Critical external providers and dependencies
• Management and communication of changes
• Retention of critical organizational knowledge
• Climate-related issues that could affect conformity or continuity
These questions should supplement, rather than replace, evaluation of technical capability and historical performance.
Review Change-Notification Requirements.
Confirm that quality agreements or purchasing specifications clearly identify:
• Which changes require notification
• Whether prior approval is required
• Required notification periods
• Information that must accompany the notification
• Responsibilities for assessing the effect on the medical device
The manufacturer should not rely solely on the supplier’s ISO 9001 change-management process.
Continue Monitoring Actual Performance.
Supplier certification should be evaluated together with evidence such as:
• Product or service conformity
• Delivery performance
• Complaints and deviations
• Corrective-action effectiveness
• Responsiveness to quality issues
• Change-notification performance
• Audit results
The supplier’s demonstrated performance remains more informative than certification status alone.
ISO 9001:2026 may strengthen several aspects of the management systems used by suppliers in the medical-device supply chain. In particular, manufacturers may obtain better information about supplier risks, changes, dependencies, organizational knowledge and quality culture.
However, the fundamental principle remains unchanged:
The medical-device manufacturer must determine whether each supplier can consistently meet its requirements and must apply controls proportionate to the risk of the supplied product or service.
ISO 9001:2026 certification can support that determination, but it cannot replace the manufacturer’s ISO 13485 supplier-management responsibilities.
Qserve can help you translate ISO 9001:2026 developments in your supply chain into effective ISO 13485 supplier controls through supplier qualification, audits, quality agreements, procedures and auditor training. Contact us to discuss the possibilities.