ISO 13485 PCB Sourcing: Verify Scope and Responsibilities

ISO 13485 PCB sourcing should begin with a match between the supplier’s documented quality management system, the actual manufacturing location, and the work being purchased. A certificate can support supplier qualification, but its existence does not establish that every site, subcontractor, process, or delivered board is covered. Obtain the complete certificate and applicable site annexes, verify the issuer and current status, and compare the stated activities with the proposed fabrication and assembly route.

For an original equipment manufacturer (OEM), the second decision is who owns each requirement and acceptance record. Define the supplier’s deliverables and the device manufacturer’s retained decisions before releasing the order. This guide provides a procurement review framework, with public-source checks dated October 23, 2026. It does not verify a particular company’s certification, perform a complete ISO audit, or decide which regulatory requirements apply to a finished medical device.

Read the certificate as a defined QMS scope

Use ISO 13485 as a quality management system (QMS) reference, then inspect the scope of the particular certificate. The standard’s title is not a list of operations that every certificate holder performs.

ISO’s public ISO 13485:2016 record identifies the medical-device QMS standard and states that the 2016 edition was reviewed and confirmed in 2025. This public record establishes the standard’s identity; it does not certify a PCB supplier or establish the applicability of every clause to your project.

Ask for the issued document rather than relying on a logo in a presentation. Keep the certificate number, issuing body, organization name, covered locations, stated activities, relevant annexes, and dates in the supplier file. An attractive scan and a familiar standard number are insufficient to close the review.

Also define the purchase itself. A bare printed board, a populated assembly, component procurement, programming, and finished-device manufacturing are different deliverables. State which ones the supplier will perform, which will be subcontracted, and which remain with the OEM. That description gives the certificate review an engineering target.

Verify issuer, status, legal entity, and site

Verify the certificate through an authoritative route and preserve what was checked. A database search that returns no usable result leaves a verification question; it is not, by itself, a finding that the certificate is invalid.

ISO’s certification verification guidance distinguishes certification from accreditation and identifies IAF CertSearch or direct contact with the relevant certification or accreditation body as verification routes. ISO develops standards but does not issue the certificates. ISO also notes that accreditation is not compulsory; assess any accreditation requirement against the contract and applicable purchasing requirements.

Record the verification date, source, result, and reviewer. Preserve the distinction between an issuer-confirmed status and a supplier’s explanation. If a portal is unavailable, document that access problem and use another authoritative route; do not replace missing evidence with an assumed pass or fail.

Match the certified scope to the work being purchased

Compare the proposed manufacturing chain with the certificate boundary operation by operation. A covered assembly activity does not automatically establish coverage of design, bare-board fabrication, sterilization, or another specialist service.

Request a route summary showing the party and location responsible for each purchased activity. For a hypothetical example, the quotation may come from a sales office while bare boards are fabricated elsewhere and assembly occurs at a third location. The review must reconcile those actual parties with the evidence; a shared brand or corporate owner is not a substitute for that reconciliation.

List gaps explicitly: an address absent from the annex, an activity described ambiguously, or an outsourced step without agreed controls. Assign a reviewer and the evidence needed to resolve each question. A scope clarification, supplier-development action, or different sourcing route may be appropriate; procurement should not make that decision by silently broadening the certificate wording.

If supplier eligibility is still being assessed, send the required scope and supplier questions with the proposed activities, locations, quantities, and mandatory qualification requirements. The inquiry can establish whether the requested work can be considered and what evidence is needed. It does not establish that OrinewPCB holds a particular medical certification or that a project is approved.

Assign supplier and device-manufacturer responsibilities

Translate the qualification decision into agreed tasks, records, and approval owners. A certificate cannot specify the test coverage, substitution permissions, or release decisions for an individual board revision.

The GHTF supplier-control guidance, dated December 11, 2008, cautions against relying solely on certification when evaluating supplier capability. It discusses agreed responsibilities, deliverables, and control of subcontracted work. This is historical, non-binding educational guidance, not a current regulatory audit checklist; apply the project’s current requirements through the responsible quality team.

Use a quality agreement, purchasing specification, or another controlled document suited to the project. Identify how questions are escalated and how approved answers enter the manufacturing revision. Avoid a responsibility marked merely “shared” when neither party is named to close it.

The unit-history and lot-boundary records example shows why a serial number alone cannot establish component genealogy. For a medical project, define the required links between material, build, firmware, test, repair, and shipment records according to the product requirements. Do not assume that an ordinary work-order record provides unit-level evidence.

Keep product approval and lot acceptance separate

Evaluate QMS certification, delivered-board acceptance, and finished-device requirements as separate evidence questions. A positive answer to one does not close the others.

FDA’s QMSR questions and answers, updated February 2, 2026, state that the Quality Management System Regulation is effective from that date. FDA explains that it neither requires nor issues ISO 13485 certificates of conformance, and that such a certificate does not exempt a manufacturer from FDA inspection. These statements do not determine the regulatory obligations of a particular PCB supplier or device.

For the purchased board, agree the applicable drawing revision, inspection criteria, electrical or functional tests, sampling basis where used, reporting format, and acceptance authority. Identify what a test actually exercises. A functional pass can support the agreed board-level acceptance without demonstrating every requirement of the finished device.

The patient-monitor channel verification example distinguishes internal test paths from external signal-path coverage. Apply the same discipline to the handoff: name the delivered record, its limitations, and the remaining evaluation owner. Device-level safety and performance decisions require their own applicable evidence.

Close the qualification gaps before the assembly order

Release the order after the required supplier evidence, purchased scope, and acceptance responsibilities are aligned. Keep a dated qualification decision with the manufacturing package rather than approving from a certificate image alone.

Give the qualification packet its own revision and link it to the approved supplier entry. Retain the evidence used for the decision, unresolved restrictions, and the person authorized to lift them. This lets a repeat-order reviewer distinguish a missing document from a deliberate limit on the work accepted.

Define review triggers for later changes, such as a new manufacturing location, subcontractor, process, certificate status, or activity scope. Also consider whether a changed BOM, firmware, or test method affects the agreed evidence. Assign a person to evaluate applicability instead of automatically carrying an earlier approval into a changed build.

The ordinary turnkey PCB assembly scope connects fabrication, component sourcing, assembly, and testing. A general service description does not establish ISO 13485 certification or eligibility for a medical project; verify any mandatory qualification separately before proceeding.

The purchasing decision should connect a verified supplier boundary to a specific, controlled build. Once mandatory qualification, recipient eligibility, and data-release requirements are resolved, provide the approved manufacturing package and quality requirements with cleared Gerber or ODB++ data, BOM, placement files, drawings, quantities, substitution rules, traceability, test, and delivery requirements. Those inputs allow the fabrication, sourcing, assembly, and requested verification scope to be assessed together.