How to Become a Supplier to Medical Device Companies

To become a supplier to a medical device company, you need a place on that company's approved supplier list. To get there, you pass the OEM's own qualification. That usually means a document review, a risk rating of what you supply, an audit, samples or a trial build, and validation for anything that changes how the device performs. Purchasing sends the paperwork, but quality and engineering decide whether you get that far.

So the path has two halves. The first is fit: the certifications, traceability and change discipline that match the device and the part you make. The second is access and timing. You have to reach the supplier quality engineer, the commodity manager and the program lead in the months when the OEM is actually willing to add or replace a supplier. Many suppliers polish the first half and leave the second to trade shows. Both halves matter most in the US, which the International Trade Administration ranks as the world's largest market for medical devices.

Choosing which OEMs to chase is a decision of its own. I make it the same way in every B2B market: I start with the customers you already work with, and only then hunt for OEMs that look like them. The full order is in choosing a market before writing any copy.

Do you need FDA registration, or OEM approval?

Most suppliers need OEM approval. FDA registration is a separate thing, and mixing the two up wastes the first call.

FDA establishment registration and device listing apply to manufacturers and initial importers of devices. Under 21 CFR Part 807, an owner or operator has to register within 30 days of starting that operation. Filing goes through FDA's electronic system unless FDA grants a waiver.

FDA's registration and listing page says registration is only complete once three things have happened: the annual user fee is paid, the information is submitted, and FDA has sent its confirmation email.

The quality rule draws the line more sharply. 21 CFR Part 820 excludes makers of components and parts from its provisions. The same part names contract sterilization and specification development among the operations it does cover. It also says that failing to comply renders the device adulterated.

Now read that from the buyer's chair. If you machine a part, mold a housing or supply a resin, FDA may never look at you directly. The OEM still answers for everything you ship. So it qualifies you under its own system, and it does that carefully, because a weak supplier turns into its compliance problem.

Work out which group you belong to before your first conversation.

• Component or material supplier. You sell into the OEM's supplier controls.
• Contract manufacturer of finished devices or contract sterilizer. You carry FDA obligations of your own as well, and you should say so up front.

This is not legal advice. Confirm your own status with a regulatory specialist.

Who approves new suppliers at a medical device company?

Several people approve a new supplier, and each one guards a different risk. Purchasing can rarely say yes on its own.

1. Supplier quality engineer. Runs the questionnaire, the document review, the audit and the quality agreement. Can stop you at any step.
2. Sourcing or commodity manager. Owns the commercial side: price, terms, capacity, lead time, and the request to add you to the approved list.
3. R&D program lead or design engineer. Owns technical fit. On a new product, this is the person who writes your part or process into the specification, and that is when switching costs are lowest.
4. VP of operations or manufacturing. Owns line risk. Decides whether a second source or a capacity change is worth disturbing a validated line.
5. Quality or regulatory director. Signs off on higher-risk suppliers and anything that touches a regulatory filing.

In bigger OEMs these roles repeat per site or per commodity. "Who approves" really means "who approves this kind of part at this plant."

Before I build a target list for a client, I go back through their past deals and find out who actually signed off on each one. I put that real niche title on the list, never a generic one. I strip bare generic titles like Manager, Assistant and Associate out on purpose. A commodity manager stays on the list; a plain "Manager" goes.

Which door you knock on first depends on what you sell:

Reach at least two roles in every account and write a separate message for each. One goes to the person who wants your capability. The other goes to the person who must approve it.

What does the medical device supplier qualification process look like?

The order varies among OEMs, but most qualifications follow the same arc.

1. Introduction and fit check. A first conversation about the part, the program, and whether your scope matches the device.
2. Documentation review. Certificates, the scope of your quality system, a supplier questionnaire, and how you control your own sub-tier suppliers.
3. Risk rating. The OEM decides how critical your part or service is to device safety and performance. That rating sets how deep every later step goes.
4. Audit. A desk review for low-risk items. An on-site visit for critical ones.
5. Samples or a trial build. First article inspection, a pilot lot, or a run on the OEM's line.
6. Validation. Process or product validation wherever your part changes how the device behaves.
7. Quality agreement and the approved list. Responsibilities go in writing, you go on the list, and monitoring starts with the first production order.

Depth follows risk. A supplier of a simple non-sterile accessory may get a light version of steps 3 to 6. A supplier of an implant component or a sterile barrier will see every step at full depth.

Keep two packs, one for before the first meeting and one for after it.

• Before the meeting: your certification and its scope, the device types you serve, your core process capabilities and your capacity.
• After the meeting: the full questionnaire, process documentation, audit access and a draft quality agreement.

What changed with QMSR in 2026?

FDA's quality rule for devices now runs on ISO 13485. The final rule published on February 2, 2024 does the following:

• It incorporates the 2016 edition of ISO 13485 by reference.
• It renames the framework the Quality Management System Regulation (QMSR).
• It sets February 2, 2026 as its effective date.

FDA says the old Quality System Regulation was, taken as a whole, substantially similar to ISO 13485. The rule also adds a few requirements and clarifications of its own.

What this means for a supplier:

1. A shared base. FDA's rule now rests on ISO 13485, which the rule notes many regulators around the world already use for their own device quality requirements. A quality system mapped to it needs less translation during an audit.
2. More focus on risk. Expect questions about how a failure of your part would affect the device, and what you do to prevent it.
3. Change discipline sells. A quality engineer wants to know how you warn a customer before you change a material, a sub-supplier or a process. Expect that question early.

The third point is where many capable suppliers lose. Their pitch leads with price and capacity, and neither answers the change-control question a quality engineer asks first.

Why are supplier changes so slow in medical devices?

The OEM is protecting a product that has already been validated, and the current supplier is part of that validated state. Swapping it out can set off a long chain of work:

• change control
• a fresh risk assessment
• new test data and revalidation
• document updates
• sign-offs from quality, engineering and regulatory

Each of those steps has an owner with other work on their desk.

So a better supplier can still lose to the one already in place. The incumbent sits inside the approved process. Replacing them costs the OEM time and internal effort before it saves anything. A lower price rarely clears that bar. A clear reduction in supply risk sometimes does.

This stretches the sales cycle in two places. The first meeting comes slowly. The gap between a good meeting and a signed supply agreement is longer still.

So judge the first quarter on qualified conversations and qualification requests. Judge revenue on a much longer clock.

When do medical device OEMs open the door to new suppliers?

The approved list loosens at predictable moments. These are the windows when you want to be in front of the buyer.

1. New product programs. Before design freeze, the part is not locked to anyone. The program lead is choosing, and a supplier written into the specification now can keep that part for the life of the product.
2. Second sourcing. A single-source part is a risk most operations leaders want to fix. Adding a qualified second source is often easier to approve than replacing the first.
3. Capacity gaps. Growth, a new line or a new site can outrun what the incumbent can deliver.
4. Incumbent quality problems. Repeated nonconformances or slow corrective actions suddenly make the cost of switching look smaller.
5. Reshoring and supply resilience. On September 26, 2025, the Commerce Department published a request for comments on a Section 232 national security investigation. Its scope includes protective gear, medical consumables and medical equipment such as devices. One of its questions is whether domestic capacity can be increased. The notice changes no contract by itself, but it puts domestic and diversified supply on the agenda of US operations teams.

You will rarely know which OEM hits which trigger this quarter. So stay in front of the whole countable market instead of betting on a few accounts you hope are ready.

What proof should you put in the first message?

Lead with proof that lowers the buyer's risk, in the first lines. The reader is quietly asking one question: could this supplier pass our qualification without making me look bad?

Candidates for the opening lines:

1. Your certification and its scope, ISO 13485 if you hold it
2. The device types or clinical areas you already supply
3. One specific process capability, with a number attached
4. A clean customer audit or a long record with an existing OEM, described without breaking confidentiality
5. Free capacity and lead time
6. How you handle change notification

Pick the few that matter most to this buyer, not all six. When I write a first message for a client, I always put their past work and its result straight into it, because a buyer who sees work like their own has a reason to answer.

Then ask for the meeting, and only the meeting. In my first messages I sell the call, never the services. A first message that tries to sell the whole capability set gets skimmed and archived.

A fictional first message from a contract machining shop:

Hi Dana, we machine titanium bone screws and plates for three orthopedic OEMs. We are ISO 13485 certified, with lot traceability back to the mill certificate. Our Swiss-type lines have open capacity from Q1. If you are looking at a second source for any fixation components, would a 20-minute call with our quality lead make sense?

Notice what it leaves out: company history, the equipment list and price.

Keep every line about their risk. "We are passionate about quality" gives a quality engineer nothing to check. "Traceability back to the mill certificate" is something they can verify in an audit.

How should outbound work for a medical device supplier?

This market is countable. You can find out how many OEMs make the kind of device you serve in the countries you can ship to. That changes how outbound should run.

Start with the list, not the copy. Part 807 also says FDA makes registration and listing data available for public inspection and posts it on its website. That gives you a public record of which establishments make which devices. Add OEMs that look like your current customers. Then fill each account with the real titles from the approval chain above.

Segment before you buy intent data. Buying signals will not tell you that a design team is choosing a supplier for a part nobody has announced. Device type, plant location, company size and the right two titles per account will get you further. The case for fixing the list before rewriting the email is in your list, not your email.

Go deep in a small market. Reach more than one person per account and run longer sequences. One or two messages rarely reach a busy quality engineer, so plan a sequence of several touches across LinkedIn and email. Here is how to build a follow-up sequence across LinkedIn and email.

Test small, then scale. Run a small batch of accounts first. If it starts no conversations, a bigger batch will not either.

Start this week: list your current OEM customers, write down who signed off at each, and pull 50 lookalike OEMs from FDA's registration data with two titles per account.

Already supplying a few OEMs? I can show you how I would pull lookalikes from FDA registration data for your next batch. Book a call when you have a minute.