Manufacturing transfer under MDR is not a logistics exercise. It is a regulated design-to-production handoff governed by EN ISO 13485:2016+A11:2021 clauses 7.3.8 and 7.5, requiring formal process validation at the production site and, depending on scope, notification to the notified body. Skipping any of these steps is the most common reason first-commercial-batch launches slip by six months.

By Tibor Zechmeister and Felix Lenhard.

TL;DR

  • Design transfer under EN ISO 13485 clause 7.3.8 is the activity that ensures design outputs have been verified as suitable for manufacturing before becoming final production specifications.
  • Process validation under clause 7.5.6 is required whenever the resulting output cannot be, or is not, verified by subsequent monitoring and measurement. And must be performed at the actual production site, on the actual production equipment.
  • MDR Article 10(9) and Annex IX require the QMS to cover production and process controls, which the notified body will examine during certification and surveillance audits.
  • A change of manufacturing site, a new critical process, or a significant process change typically triggers a notification obligation to the notified body under the manufacturer's QMS change-control procedures and the certificate scope.
  • The three most common transfer failures: treating validation as a paperwork exercise, transferring to a CMO without a clean Device Master Record, and assuming prototype suppliers will "just scale up".

Why this matters

Manufacturing transfer is where MedTech startups discover the difference between a working prototype and a commercial product. Up to that point, a small team has been hand-building units, tolerating quirks, and iterating weekly. Then a pilot production run is scheduled, the new contract manufacturer walks through the drawings, and twenty-seven questions appear that nobody has ever asked before. Why is this fillet radius specified with that tolerance? Is this cure time a supplier recommendation or a validated parameter? What do you actually measure on the incoming raw material? Who signs off on the first article?

Tibor has watched this conversation a lot. It is not a quality problem. It is a transfer problem. The prototype team knew all of this implicitly, and none of it was written down in a form that survives the walk from bench to production line. The transfer failure is almost always a documentation failure upstream of the CMO.

This post is about doing it properly. Small team, real constraints, MDR requirements respected.

What MDR actually says

MDR Article 10(9) requires manufacturers to implement a quality management system that covers, among other aspects, product realisation, including planning, design, development, production and service provision. Supplier and sub-contractor control, resource management, and verification and validation are explicitly included.

MDR Annex IX. The QMS and technical documentation conformity assessment route. Places the notified body in a position to assess the manufacturer's production arrangements, including process validation and production controls. When the QMS scope changes, or when a new manufacturing site is added, the certificate scope must reflect it. This is how manufacturing changes trigger notified body engagement: through the certificate, not through a specific MDR article that says "inform the NB if you move production."

EN ISO 13485:2016+A11:2021 clause 7.3.8 (Design and development transfer) requires the organisation to document procedures for transfer of design and development outputs to manufacturing. These procedures shall ensure that design and development outputs have been verified as suitable for manufacturing before becoming final production specifications, and that production capability can meet product requirements. Records of the results and conclusions of the transfer shall be maintained.

EN ISO 13485:2016+A11:2021 clause 7.5.6 (Validation of processes for production and service provision) requires validation of any processes for production and service provision where the resulting output cannot be, or is not, verified by subsequent monitoring or measurement. Validation must demonstrate the ability of these processes to consistently achieve planned results. The organisation shall document procedures including defined criteria for review and approval of the processes, equipment qualification and qualification of personnel, use of specific methods, procedures and acceptance criteria, statistical techniques with rationale for sample sizes, records, revalidation, and approval of process changes.

Clause 7.5.1 (Control of production and service provision) requires production to be planned, carried out, monitored and controlled to ensure that the product conforms to specification. Through documented procedures, suitable infrastructure, implementation of monitoring and measurement, cleanliness as applicable, and installation and servicing as applicable.

The structure is clear: design transfer prepares the handoff, process validation proves the production process works at the new site, and production controls keep it working.

A worked example

A five-person surgical instrument startup has been hand-assembling Class IIa devices in a shared workshop for a pilot clinical series. Their notified body Annex IX certificate lists their own address as the manufacturing site. They now need to scale to 500 units per month and are moving production to a contract manufacturer in Slovenia.

Here is what actually has to happen, in sequence:

Step 1. Close the Device Master Record. Every drawing with every tolerance, every material specification with the supplier and grade, every assembly procedure, every inspection plan, every packaging and labelling specification, every sterilisation process parameter. If the prototype team cannot write this down, they cannot transfer.

Step 2. Formal design transfer record. A meeting, an agenda, a checklist mapping design outputs to production inputs, a signed transfer document per clause 7.3.8. The checklist identifies which specifications are verified, which are still under investigation, and which are being transferred as-is with documented risk.

Step 3. Process validation planning. For each production process, decide whether the output can be fully verified by inspection (then verification suffices) or whether validation is required under clause 7.5.6. For this startup, cleaning, passivation, and final packaging cannot be fully inspected post-process. Those need validation. Drilling a hole to a drawn tolerance can be inspected. That does not need process validation, only verification.

Step 4. IQ, OQ, PQ at the CMO site. Installation Qualification (equipment installed correctly), Operational Qualification (equipment operates within specified parameters across the operating range), Performance Qualification (process consistently produces conforming product under normal operating conditions, using production-scale batches and production personnel). Three sequential activities, documented, approved, archived. This is the part startups try to shortcut and regret.

Step 5. First-article inspection and pilot batch. Full dimensional and functional inspection of the first units produced at the new site against the Device Master Record. Then a pilot production batch under routine conditions to confirm the PQ results hold.

Step 6. Notified body notification. A change of manufacturing site is a QMS change that affects the certificate scope. The startup's change-control procedure should trigger a notification to the notified body under their certificate conditions. The notified body decides whether the change is reviewed through a surveillance audit, a special audit, or a certificate update. The manufacturer does not make that decision. The notified body does.

Step 7. Technical documentation update. Update the technical documentation under MDR Annex II to reflect the new manufacturing site, the validated processes, and the updated Device Master Record.

Step 8. Post-transfer monitoring. First three to six months at the new site get heightened monitoring. Tighter sampling, faster review of non-conformances, weekly quality review. This is not a regulatory requirement, it is a survival requirement. Problems at new sites appear at volume, not in the pilot batch.

Typical duration for this entire sequence: four to nine months for a Class IIa surgical instrument with an experienced CMO. Startups who budget four weeks are budgeting for the version that does not include validation.

The Subtract to Ship playbook

1. Start transfer preparation during design verification, not after. The Device Master Record is built by the prototype team as they finalise the design. Every drawing that leaves engineering without proper tolerances, every material spec that says "equivalent to", every "we just know" assembly step is a transfer debt that compounds.

2. Write the process validation plan before picking the CMO. You need to know what must be validated before you can evaluate whether a CMO can perform the validation. A CMO that lights up when you hand them a validation plan is a CMO who can execute. A CMO who asks "what's that?" is a CMO you are about to educate at your expense.

3. Do not accept verbal process knowledge. If a prototype team member knows that the curing step really needs 47 minutes rather than the drawn 45 minutes, that knowledge has to land on paper before transfer. Every piece of tribal knowledge that fails to land becomes a production deviation at the new site.

4. Treat IQ/OQ/PQ as sequential, not parallel. Installation before operational before performance. Each stage gates the next. Parallelising them to save time is how you validate a process that was never correctly installed.

5. Notify the notified body through the proper channel and timing. Your QMS change-control procedure should define when and how you notify. Typical timing: as soon as the change is formally decided and before commercial production at the new site. Tibor has seen certificates suspended because a manufacturer started commercial production at a new site without telling the notified body.

6. Keep the old site running until the new site is proven. A hard cutover is a gamble. A parallel run, even if expensive, protects you from a PQ failure that only becomes visible after commercial shipments start.

7. Plan for revalidation triggers. Clause 7.5.6 requires revalidation when process changes occur. Define in your procedures what counts as a revalidation trigger: material change, equipment change, supplier change, process parameter change, prolonged shutdown. Document it, follow it.

8. Do not let the CMO own your Device Master Record. Supplier lock-in through documentation is a real risk. The manufacturer. You. Holds the master copy. The CMO works from a controlled copy. If you ever need to transfer away from the CMO, you own the design record and your freedom to move.

Reality Check

  1. Is our Device Master Record complete enough that a competent contract manufacturer could build the device from it without asking us questions?
  2. Have we identified which of our processes require validation under clause 7.5.6, with a written rationale?
  3. Do we have a formal design transfer procedure and records per clause 7.3.8, not just a handoff email thread?
  4. Have we planned IQ, OQ, and PQ as sequential activities at the new site, with defined acceptance criteria?
  5. Does our change-control procedure trigger a notified body notification for a site change, process change, or equipment change?
  6. Are our validation protocols being written by people who understand both the process and the statistical basis for sample sizes?
  7. Do we have a post-transfer monitoring plan with heightened sampling for the first production batches?
  8. If the CMO disappeared tomorrow, could we re-transfer to a second manufacturer from our own controlled documentation?

Frequently Asked Questions

Is every production process subject to validation? No. Clause 7.5.6 requires validation only when the output cannot be, or is not, fully verified by subsequent monitoring and measurement. Processes whose output can be 100 percent inspected. For example, a dimensional feature verified on every part. May not require validation, though they still require production controls under clause 7.5.1.

Do we need to repeat validation if we move a validated process to a new machine? Generally yes. The validation is specific to the equipment, environment and personnel. A like-for-like equipment change can sometimes be handled with a shortened revalidation, but the justification must be documented and approved under your change-control procedure.

When exactly do we need to notify the notified body? The trigger is a change that affects the scope of your QMS certificate or that your own change-control procedure flags as significant. A new manufacturing site almost always qualifies. The precise timing and format are set by your notified body's change-notification procedure. Read it and follow it to the letter.

Can we start commercial production before process validation is complete? No. Production without completed validation of processes that require validation is a finding waiting to happen, and a patient safety risk if the process is genuinely not capable. Pilot batches under validation protocols are acceptable. Commercial shipments are not.

What if our CMO already has validated processes for similar products? Their validation is evidence of capability, not a substitute for validation of your product on their line. You still need PQ runs using your materials, your specifications, and your acceptance criteria. You can often shorten IQ and OQ based on their existing qualifications.

How does design transfer differ from process validation? Design transfer is the handoff of design outputs to production as final specifications. A clause 7.3.8 activity focused on completeness and producibility. Process validation is proving that the production process consistently makes conforming product. A clause 7.5.6 activity focused on process capability. Both are required; they are different activities.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Article 10(9); Annex IX.
  2. EN ISO 13485:2016+A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes. Clauses 7.3.8, 7.5.1, 7.5.6.