Choosing a contract manufacturer for medical-device PCB assembly isn't a sourcing decision — it's a regulatory one. ISO 13485:2016 is the international quality-management standard for medical-device manufacturers, and FDA's Quality System Regulation (21 CFR Part 820) closely mirrors it. If the contract manufacturer (CM) printing and populating your boards isn't operating a compliant quality management system (QMS), every assembly carries audit and recall risk back to your company — the legal manufacturer of record. This 10-point checklist walks OEM engineering and quality teams through exactly what to verify before placing the first purchase order.

It's structured the way our own customer-quality team would vet a new partner — so you can use it as a literal screening script on your next supplier-qualification call.

What ISO 13485:2016 actually requires of a contract manufacturer

ISO 13485 is the quality-management system framework specific to organizations involved in any stage of a medical device's lifecycle — including contract assembly. It's a sibling of ISO 9001 with medical-device-specific clauses bolted on: design controls, risk management linkage to ISO 14971, sterile-product handling, post-market surveillance, and complaint files. A CM doesn't need to be a finished-device manufacturer to be ISO 13485 certified — assembly-only certification is common and valid — but the scope of their certification matters more than the certificate itself.

The 10-point vetting checklist

Run each of these questions on the qualification call. Document the answers. Anything vague is a flag; anything written down in their QMS that they can produce on request is gold.

1. Is the certification scope appropriate for your device's classification?

ISO 13485 certificates list a defined scope — the activities the QMS actually covers. A CM certified for "assembly of printed circuit boards for medical electronic devices" can solder your board. A CM whose scope reads "design and manufacture of dental impression trays" cannot — even if they hold a valid certificate. Ask for the certificate PDF, read the scope clause, and confirm it covers PCBA, cable assembly, and box build (whichever you need). Also confirm the certificate was issued by a notified body or accredited registrar (look for ANAB, UKAS, or equivalent accreditation), not a self-issued document.

2. Do they operate documented design control procedures?

If your CM participates in any design activity — even DFM (design for manufacturability) feedback that changes your BOM or stack-up — Clause 7.3 of ISO 13485 applies. They must have written design-control procedures, design-input/output records, design verification and validation evidence, and a design history file (DHF). For pure build-to-print PCBA, design controls live with the OEM; for any CM-side design contribution, controls follow. Ask: "If I send you a board file and you suggest a stack-up change, where does that change get recorded in your QMS?" Acceptable answer: a documented engineering change order (ECO) tied to a customer-approved change request.

3. Can they demonstrate device-history-record (DHR) traceability for a sample lot?

A DHR is the per-lot record proving each device was manufactured according to the device master record (DMR). For a CM assembling your board, the DHR should include: BOM with lot/date codes for every component, operator IDs on each routing step, inspection records (AOI, X-ray, ICT, FCT as applicable), rework logs, and final-release sign-off. Ask the CM to walk you through a specific historical lot (redacted is fine) and show you which records they could produce within 24 hours of an FDA 483 observation. If they can't demonstrate this from real records, the QMS exists on paper but isn't operational.

4. What's their CAPA cycle time, and can they show a closed CAPA?

Corrective and Preventive Action (CAPA, Clause 8.5.2 / 8.5.3) is where most medical-device QMS failures actually surface in FDA inspections. Ask: "What's the average time from CAPA initiation to closure in your shop, over the last 12 months?" Best-in-class is under 60 days for routine CAPAs. Anything north of 120 days suggests CAPAs are piling up unresolved — a major FDA inspection target. Then ask for one closed CAPA example (redacted): root-cause analysis, corrective action implemented, effectiveness verification. A CM that can produce this on the call is QMS-mature.

5. How do they qualify electronic-component suppliers, and what's their counterfeit-mitigation program?

Component-level counterfeiting is the most common CAPA trigger in medical-device PCBA, especially for legacy designs using EOL chips. Compliant CMs run an approved-vendor list (AVL) with documented qualification of every distributor, require AS6081 or equivalent counterfeit-mitigation procedures for high-risk part categories, and quarantine + test any sole-source or broker-purchased parts before they touch a board. Ask: "Show me an AVL line item with the qualification record behind it." Vague answers ("we only buy from authorized distributors") without a written program is a flag.

6. Are operators trained against documented work instructions, and how is that recorded?

Clause 6.2 requires competence-based training records for every operator who touches a medical-device assembly. The training matrix should map: operator → process step → work instruction → training date → trainer signature → competence verification (test, observation, or first-piece-pass record). Ask to see the matrix for the line that would build your board. Modern CMs maintain this digitally; a CM still running on paper isn't disqualified but should produce records on request without scrambling.

7. What inspection records are produced per lot, and against what acceptance standard?

Medical-grade PCBA almost always specifies IPC-A-610 Class 3 as the workmanship acceptance standard. Some Class II/III devices require Class 3/A (the additional automotive-and-medical addendum). Verify: (a) the CM is staffed with IPC-A-610 Class 3 CITs (certified IPC trainers), (b) AOI + X-ray (for BGAs and fine-pitch QFNs) are part of routine inspection, (c) inspection records reference specific IPC paragraphs when defects are scored, and (d) ICT or flying-probe coverage of your design has been calculated and documented before first article runs.

8. Have they been audited by a notified body or registrar in the last 12 months, and were there any major nonconformities?

ISO 13485 certification requires surveillance audits at least annually. Ask for the most recent audit summary (nonconformity count, classification, status). A CM with zero findings is either pristine or hiding something — small findings closed within the audit cycle are healthy. Major nonconformities that remain open more than 90 days past target close are a red flag. Also ask: "Are you on FDA's inspection classification database with any current OAI / VAI classification?" An OAI ("official action indicated") classification effectively disqualifies them for new medical work.

9. Do they understand UDI labeling requirements for your target markets?

The FDA's Unique Device Identification (UDI) requirement, EU MDR Article 27, and equivalent regimes in Japan/UK/Australia all put labeling and traceability obligations downstream of the CM. The CM doesn't typically assign the UDI (the OEM does, as legal manufacturer), but they must be capable of laser-marking, label-printing, or affixing the UDI carrier per your spec — and recording the link from UDI to DHR. Ask: "Can you laser-mark a 2D Data Matrix to my UDI string, validate the read with a fixed barcode reader at end-of-line, and record the pass/fail in the DHR?" If they look confused, they aren't ready for your device.

10. Can they support an FDA inspection if your facility is audited?

If FDA inspects you under the QSR, they may follow the supply chain back to critical suppliers — including your PCBA CM. Ask: "If FDA shows up at our door tomorrow and wants the assembly records for lot XYZ, what's your response-time commitment and who is the QA point of contact?" Best-in-class CMs commit to producing redacted DHRs within 8 business hours and assigning a named QA lead to the inspection. A CM that has never supported an OEM through an FDA inspection isn't disqualified but you'll want to do a tabletop drill before going to market.

Common red flags during the qualification call

From running this checklist with dozens of medical-device OEMs over the years, a handful of phrases consistently signal QMS issues:

  • "We're ISO 13485 compliant" (without "certified"). Compliance is a self-claim; certification is third-party verified. Demand the certificate.
  • "Yes, we follow Class 3 standards" but no CITs on staff. IPC-A-610 Class 3 requires trained inspectors. No CITs means no defensible inspection.
  • Vague CAPA cycle-time answers. If they can't quote a number, they aren't tracking it. If they aren't tracking it, FDA will.
  • Single-source critical components without documented backup. Supply-chain risk = CAPA risk. The AVL should show alternates for any part that would halt production.
  • No willingness to share redacted records. Customer-quality teams routinely share redacted DHRs, audit summaries, and CAPAs under NDA. A CM that refuses entirely is hiding QMS gaps.

How i-TECH e-Services approaches medical-device PCB assembly

i-TECH e-Services operates an AS9100D and ISO 13485 certified facility in Norcross, Georgia. The combined posture matters more than either certification alone: AS9100D enforces aerospace-grade traceability and design-control rigor across every board we build, which raises the floor on medical assemblies above what an ISO-13485-only shop typically delivers. Practical implications for medical-device OEMs:

  • One QMS, two certifications. The same DHR, CAPA, and supplier-qualification processes apply to medical work as to AS9100D defense work. There's no "medical line" with a weaker QMS.
  • IPC-A-610 Class 3 capability with CITs on staff and AOI + X-ray inspection on every Class II/III lot. See our quality and testing overview for the inspection stack.
  • Component traceability to the date-code level on every line item, with counterfeit-mitigation procedures aligned to AS6081 for at-risk part categories.
  • FDA-inspection support with a named QA lead and an 8-business-hour redacted-DHR response commitment.
  • U.S.-based operations for OEMs subject to reshoring pressure or worried about EU MDR / FDA inspection access to offshore facilities.

If you're vetting medical PCBA partners, our team is happy to walk through the 10 questions above on your specific device class and ship you redacted sample records under NDA. Start with our medical-device capabilities overview, or request a quote with your project details.

Bottom line

A medical-device contract manufacturer that survives the 10 questions above will protect your regulatory standing far more than one chosen on lead time or unit price alone. Walking the QMS in person is the gold standard — but for first-pass screening, this checklist will surface mismatches in 30 minutes that would otherwise show up at the worst possible time: during an FDA inspection, a recall, or a notified-body audit. Save the script. Reuse it on every supplier qualification.