Medical CE & FDA Regulatory FAQ: Compliance Standards for Supplier Qualification Records in Due Diligence

Overview

During B2B due diligence for aesthetic laser devices, clinics and dermatology practices must verify that a supplier can produce complete, current, and verifiable qualification records before any purchase order is signed. This FAQ answers the most common procurement questions about how supplier qualification records are shared, what documents are included, and how compliance is maintained across pre-sales and post-sales stages. The guidance below reflects standard practice for Medical CE, FDA, and ISO 13485 documentation packages.

Frequently Asked Questions

Q1: What documents are included in a standard supplier qualification record package?

A standard supplier qualification package includes the Medical CE certificate, FDA clearance or registration documentation, ISO 13485 certification, and the authorized representative letter. It should also contain the device technical file summary, risk management report reference, and the most recent factory audit or inspection report. Clinics should request this package as a single indexed PDF bundle with document numbers and expiry dates clearly visible.

Q2: How are supplier qualification records shared during pre-sales due diligence?

Supplier qualification records are shared through a secure, access-controlled data room or encrypted document transfer, not as loose email attachments. Reputable suppliers provide a document index, version numbers, and issue dates so buyers can confirm each record is current. For high-value orders, a live screen-share walkthrough of the compliance file is common practice before contract signing.

Q3: How can a clinic verify that a Medical CE certificate is genuine and still valid?

A Medical CE certificate is verified by checking the notified body number and certificate number directly on the EU NANDO database and confirming the certificate scope covers the exact device model. The certificate must list the manufacturer’s legal name, address, and device classification, and it should not be expired or superseded. Clinics should also cross-check the Declaration of Conformity against the certificate to ensure model numbers match.

Q4: What FDA documentation should a supplier provide for a device sold outside the United States?

Suppliers should provide the FDA 510(k) clearance number or establishment registration details, plus the device listing confirmation, even for international buyers. This confirms the device has undergone US regulatory review and gives clinics a second independent compliance reference point. Buyers should verify the 510(k) number on the FDA database rather than relying solely on a supplier-issued PDF.

Q5: How are ISO 13485 certificates and factory audit reports handled in due diligence?

ISO 13485 certificates are shared with the certification body name, certificate number, scope statement, and validity dates, and buyers should verify them on the certifying body’s public register. Factory audit reports are typically provided as a redacted summary covering production line controls, incoming component inspection, and calibration records. Full unredacted audits are usually released only under a signed NDA during advanced due diligence.

Q6: What post-sales qualification records should be available after delivery?

After delivery, suppliers should provide the device-specific Declaration of Conformity, calibration certificate, factory test report, and warranty registration confirmation tied to the serial number. Clinics should also receive the maintenance log template and the authorized service partner list for their region. These records support regulatory inspections and insurance audits throughout the device lifecycle.

Q7: How long should supplier qualification records be retained by the clinic?

Supplier qualification records should be retained for the full service life of the device plus the legally required post-market period, typically a minimum of five years after decommissioning. Records should be stored with the device serial number as the primary index so they can be retrieved during a regulatory inspection. Clinics should also retain proof that each record was verified against the issuing authority’s public database.

Q8: What should a clinic do if a supplier cannot provide complete qualification records?

A clinic should treat missing qualification records as a due diligence red flag and pause procurement until the gaps are resolved in writing. Buyers can request a compliance gap statement, a remediation timeline, and third-party verification from the notified body or FDA database before proceeding. If the supplier cannot close the gaps, the clinic should disqualify the supplier and document the decision in its procurement file.