Regulatory ownership · outsourced production · supplier control
Legal manufacturer and OEM in medical devices
Outsource the factory, not the responsibility
A medical-device company may outsource design, assembly, testing or the entire production process. The company whose name appears as manufacturer still has to understand, control and defend the finished device.
Trace the responsibility ↓Product identity · conformity · lifecycle accountability
Specifications · records · changes · audit access
Processes · production evidence · traceability
The decisive point
The factory address does not determine who the manufacturer is
Under the MDR and IVDR, a company may have a device designed or manufactured by another organisation and still be the manufacturer when it markets the device under its own name or trade mark.
The name on the product carries more regulatory weight than ownership of the production line.
01
The terminology needs some care #
“Manufacturer” is an official regulatory term. The MDR defines a manufacturer as a person or company that manufactures a device, or has it designed or manufactured, and markets it under its own name or trade mark. The IVDR contains an equivalent definition.
“Legal Manufacturer” is not separately defined in either Regulation. The expression is used in practice to distinguish the company carrying the manufacturer’s regulatory obligations from the organisation performing physical production.
“Original Equipment Manufacturer” is also not an MDR or IVDR term. Depending on the arrangement, that organisation may be more accurately described as a contract manufacturer, manufacturing subcontractor, design supplier or critical supplier.
Legal Manufacturer means the company identified as manufacturer of the finished device. OEM means the external organisation that manufactures the device, its components or both under an agreement with that company.
An OEM that also places a device on the market under its own name may itself be a manufacturer for that product. Its regulatory position depends on what it does and under whose name the device is marketed, not simply on the title written in the commercial contract.
02
What the LM–OEM model actually is #
Under an LM–OEM arrangement, one company places the finished device on the market under its own name while another organisation performs some or all of the design and manufacturing activities.
The OEM may manufacture individual components, assemble the complete product, perform testing, package the device or undertake other agreed activities. The exact division of operational work can vary. The allocation of regulatory responsibility cannot.
Legal Manufacturer
- Defines the device and its intended purpose
- Controls conformity and product evidence
- Places the device on the market under its name
- Remains accountable throughout the lifecycle
OEM
- Performs defined manufacturing activities
- Works to approved specifications
- Generates controlled production evidence
- Reports deviations and proposed changes
03
The company named as manufacturer remains responsible #
Using an OEM does not transfer the manufacturer’s obligations under the MDR or IVDR. The Legal Manufacturer remains responsible for ensuring that the device is designed and manufactured in accordance with the applicable requirements.
Product definition
Intended purpose, claims, qualification, classification and regulatory strategy.
Conformity evidence
Technical documentation, GSPR evidence, risk management and clinical or performance evaluation.
Quality system
Management responsibility, supplier control, change control, production oversight and corrective action.
Market access
Conformity assessment, EU Declaration of Conformity, CE marking, UDI and applicable registrations.
Lifecycle control
Post-market surveillance, vigilance, trend reporting, PMCF or PMPF and field safety action.
Series conformity
Evidence that every released device continues to match the approved design and validated processes.
An OEM’s ISO 13485 certificate can support supplier qualification, but it does not prove that the finished device complies with the MDR or IVDR. For the wider distinction, see why ISO 13485 certification does not automatically establish MDR compliance.
04
What the OEM is expected to control #
The OEM’s duties arise primarily from its agreement with the Legal Manufacturer, the applicable quality arrangements and any other legislation governing its activities.
Depending on its role, the OEM may be expected to:
- Manufacture the product according to approved specifications
- Operate validated manufacturing and inspection processes
- Maintain production, testing and traceability records
- Control materials, components and sub-suppliers
- Report deviations, nonconformities and production failures
- Investigate manufacturing-related complaints
- Support corrective and preventive actions
- Preserve records for the agreed retention period
- Notify the Legal Manufacturer before making relevant changes
- Provide access for manufacturer and Notified Body audits
If the OEM also contributes to design or development, the agreement must address design inputs, outputs, reviews, verification, validation, configuration management and design changes.
Why companies use the model
Specialist capability without building every capability internally
A well-managed LM–OEM arrangement can give a medical-device company access to established processes, experienced personnel and scalable production. The benefit depends on the quality of the control system around that relationship.
Expertise
Access to specialised manufacturing methods, equipment and production knowledge.
Scale
Capacity can grow without an equivalent investment in owned infrastructure.
Focus
The Legal Manufacturer can concentrate on product strategy, evidence and market access.
Flexibility
A broader supply strategy becomes possible when transfers and changes are properly planned.
Outsourcing can accelerate production. Weak supplier control can stop it completely.
06
The quality agreement is more than a purchasing contract #
A purchase order may define price, delivery dates and quantities. It is not enough to control outsourced medical-device manufacturing.
The Legal Manufacturer and OEM should have a detailed quality or technical agreement covering the activities that can affect device conformity.
Activities, sites, products, processes and sub-suppliers covered by the relationship.
Specifications, acceptance criteria, validation, deviations and nonconforming product.
Records, complaints, investigations, CAPA, changes and regulatory requests.
Manufacturer audits, Notified Body access, authority access and document availability.
Tooling, record retention, transfer support, termination and business continuity.
Confidentiality and intellectual-property safeguards without creating compliance blind spots.
Ambiguous responsibility is itself a regulatory risk. If the agreement does not make clear who performs an activity, that activity may be delayed, duplicated or missed entirely.
07
The Legal Manufacturer needs access to the evidence #
The Legal Manufacturer cannot maintain an empty technical file while the OEM keeps all meaningful evidence behind a claim of confidentiality.
Article 10 of the MDR and IVDR requires the manufacturer to draw up and keep the technical documentation up to date. It must be able to provide the documentation needed to demonstrate conformity.
Intellectual property can be protected through confidentiality provisions and controlled-access arrangements. Commercial confidentiality must not create a gap in the evidence needed for compliance.
08
The Notified Body may need access to the OEM #
The manufacturer’s quality management system must cover the selection and control of suppliers and subcontractors. Where appropriate, a Notified Body may audit an organisation involved in important design or manufacturing activities.
Under the conformity assessment provisions of the MDR and IVDR, supplier or subcontractor sites may be included in surveillance and unannounced audits.
The agreement with the OEM should provide the necessary access. A manufacturer should not discover during certification that its most important supplier refuses to admit the Notified Body. See how supplier oversight fits into a Notified Body audit.
09
Changing the OEM is not a simple supplier swap #
The model can provide supply-chain flexibility, but moving production requires much more than sending the same drawing to a different factory.
A change of OEM may affect:
Before transferring production, the Legal Manufacturer should assess the regulatory and technical impact, qualify the new supplier, validate affected processes and update the relevant documentation.
Depending on the device, conformity assessment route and certification agreement, the change may also need to be reported to or approved by the Notified Body before implementation.
10
Where LM–OEM arrangements usually fail #
Problems often begin when commercial convenience is mistaken for regulatory simplicity.
- 01
The certificate illusion
The OEM’s QMS certificate is treated as proof that the finished device is compliant.
- 02
The inaccessible file
Essential evidence remains under the OEM’s control without guaranteed manufacturer access.
- 03
The vague agreement
Responsibilities, records, changes and audit rights are not defined with sufficient precision.
- 04
The silent change
Materials, processes, software or sub-suppliers change before regulatory impact is assessed.
- 05
The invisible supplier
The Legal Manufacturer overlooks critical organisations further down the supply chain.
- 06
The transfer without a bridge
Records, tooling, validation knowledge and continuity obligations are not secured before termination.
These weaknesses may remain invisible during routine production. They usually become visible during an audit, a serious complaint, a supplier transfer or an investigation by a competent authority.
11
How to select an OEM that can support compliance #
Price and production capacity matter, but they do not tell you whether the organisation can repeatedly build the device, preserve the evidence and support the product when something changes.
Experience with the device technology, process capability and validation practices.
Quality-system maturity, traceability, data integrity and change discipline.
Audit readiness, record access and visibility of critical sub-suppliers.
Complaint investigation, CAPA support and handling of regulatory requests.
Capacity, disruption planning and support for product or process transfers.
A working culture that treats documentation and notification as part of manufacturing.
The best OEM is not simply the company that can manufacture the device. It is the company that can manufacture it repeatedly, document what it has done and support the evidence needed to defend the product.
The bottom line
Work may be delegated. Control must remain visible.
The LM–OEM model is not a regulatory shortcut. It is a structured division of work in which production may be outsourced while accountability remains with the Legal Manufacturer.
When the relationship is properly designed, the manufacturer gains specialist capability and flexibility while the OEM receives clear specifications, responsibilities and controls.
When it is poorly designed, the manufacturer may carry responsibility for processes it cannot see, records it cannot obtain and changes it did not approve.
You may outsource the factory. You may not outsource control of the device.
Supplier and manufacturing control
Need to turn an outsourced production model into a defensible regulatory system?
Discuss your manufacturing model ↗From the knowledge centre
