6 min read
In this guide
ISO 13485 asks device manufacturers to get a written agreement that suppliers report changes before they make them. Most kit owners read that as protection. It is narrower than it looks. The trigger is a change that affects the part’s ability to meet your purchasing requirements. If your specification never names the resin, the label adhesive or the molding site, a supplier can change all three and owe you nothing.
What the requirement actually says
Since February 2, 2026, FDA’s Quality Management System Regulation has incorporated ISO 13485:2016 by reference. The standard’s purchasing clause is now the US rule for device manufacturers, not only a certification requirement. Our QMSR guide for at-home test kit companies covers the wider change.
Clause 7.4.2 says purchasing information shall include, as applicable, a written agreement that the supplier notify the organization of changes before they are implemented, when those changes affect the purchased product’s ability to meet specified purchasing requirements.
Read the second half again. The supplier measures a change against your stated requirements, not against your intent. A tube drawing that lists outer dimensions, thread and fill line gives the supplier a short list of things it cannot change quietly. Everything else is the supplier’s to manage.
The standard does not set a notice period or a format. Neither does the GHTF guidance on supplier controls (SG3/N17). It says the manufacturer and supplier should agree on a process for evaluating changes and capture it in their agreement. The window, the content and the definition of a change are yours to write.
A change notification clause protects exactly what the specification writes down. A thin spec buys a quiet supplier, not a stable part.
The changes that break collection kits
Most components in an at-home testing kit are commodity parts: tubes, caps, swabs, labels, bags, absorbent pads and cartons. Commodity suppliers change inputs often to manage cost and supply. The changes that matter are rarely the ones on the drawing.
| Supplier change | What it can break in a kit | What to ask for |
|---|---|---|
| Resin grade or colorant in a tube or cap | Extractables, analyte binding, fill line visibility | Material declarations for both grades and any comparability data the supplier holds |
| Cap liner or seal material | Leaks under the 95 kPa internal pressure that IATA Packing Instruction 650 requires the primary receptacle or secondary packaging to withstand in air transport | Leak test results on the tube and cap together, not the cap alone |
| Label facestock or adhesive | Adhesion after freezer storage or condensation, barcode readability | Adhesion data at your storage condition, or samples you can test |
| Swab fiber, tip shape or shaft | Collected volume and elution into the medium | Side-by-side samples and the first affected lot |
| Molding or converting site move | Dimensional drift, new tooling, cavity-to-cavity variation | First articles from the new site and cavity data |
| Sterilization site or method | Residuals and any sterility statement on your label | Updated certificate and a validation summary |
| Carton board grade or mill | Fit in the assembled kit, crush strength, printed color | Samples and a fit check with your actual contents |
Every row can change how a kit performs after it ships, and every row can pass incoming inspection against a dimensional drawing. An AQL sampling plan checks parts against the attributes you specified. It cannot catch a change to an attribute you never wrote down.
Write the spec so the change is visible
The fix sits upstream of the notice. Put the attributes that drive performance into the purchase specification, so a change to any of them falls inside the notification clause.
- Material identity. Resin grade, colorant, liner material, adhesive family. Name it, or require notice before it changes.
- Where it is made. The manufacturing site and, for critical parts, the source of the input that matters.
- How it is made. Sterilization method and site, and any process step you built a validation around.
- How it arrives. Units per bag, lot size and lot labeling, so a change shows up in your receiving records.
- Notice terms. How far ahead, in writing, to whom, with what evidence, and how the first changed lot is marked.
GHTF N17 also notes that changes made by second and third tier suppliers can matter, so control may need to reach past the supplier you buy from. The practical version is a flow-down clause. Your supplier agrees to require notice from its own suppliers for the inputs you named. Start from a complete kit BOM; it tells you which parts deserve that depth.
What to do when a notice arrives
- Find every kit that uses the part. The BOM is the map. A part used in four programs is four assessments.
- Check the notice is complete. Ask for the before and after state, the reason, the effective date and the first affected lot. A vague notice is an open question, not an answer.
- Decide the evidence. Some changes need a paper review. Others need a fit check, a leak test, label adhesion at your storage condition or a stability pull. Match the effort to the risk to the test result.
- Separate the lots. Do not mix old and new lots in a build until the change is accepted. If the review will outlast your stock, consider a last-time buy of the current part.
- Tell the owner of the test. GHTF N17 is plain that a manufacturer cannot delegate its responsibility for the device to a supplier. The test owner decides whether the change touches its design outputs, labeling or validation.
If the part sits inside a validated process, the agreement should already say when revalidation happens. A validation built on one material may not hold for the next, which is why process development comes before validation.
Who owns which notice
A collection kit program usually has three layers: the component maker, the kit manufacturer that buys and assembles, and the company that owns the test. Each layer’s purchasing controls cover the layer below it. The gaps sit at the handoffs.
Settle it in the quality agreement. Name who receives component change notices, who assesses them, and how fast the test owner hears about anything that touches performance or labeling. Where the answer turns on who is the legal manufacturer, confirm it with your own regulatory counsel. For what to look for on the supplier side, see our supplier audit criteria sheet and what audit support from a kit manufacturer should include.
If the change you are weighing is a whole new manufacturer rather than a new component, see Switching Kit Manufacturers: The Validation Does Not Move With You.
A supplier that never sends a change notice is either very stable or bound by a very short spec. Read your purchase specifications and find out which one you have.
Sources: FDA CDRH, Navigating the Quality Management System Regulation; GHTF SG3/N17:2008, Guidance on the Control of Products and Services Obtained from Suppliers, sections 3.1.5 and 3.4; ISO 13485:2016, clause 7.4; IATA Dangerous Goods Regulations, Packing Instruction 650.
