In a nutshell, anyone who "makes" finished devices for U.S. distribution needs to be registered. FDA views "makes" to be a broad category and, as you acknowledged, includes finished device contract manufacturers and specification developers. So, both of those parties are required to FDA-register accordingly. In contrast, "component" manufacturers aren't generally required to register unless the component is being labeled/marketed for an end clinical use. So, you are again correct that component manufacturers are to instead be controlled by way of the manufacturer's purchasing controls.
A true specification developer is not simultaneously designated as contract manufacturer of its own same device.
But oftentimes the specification developer will make an arrangement or licensing agreement with a third party so that the specification developer's device can be labeled (under the control of the specification developer's design controls and DMR) and then marketed by the third party under the third party's own private branding. FDA calls such third party a "private label distributor" and defines this as a distributor that obtains a device from a manufacturer with the label already applied and that does not repackage or otherwise alter the device's package or label. In other words, if there is a private label distributor, the manufacturer makes (or arranges to have made on its behalf) the devices and labels them with the private label distributor's company name and the private label distributor's proprietary name for the device. The private label distributor's name must be qualified by language to the effect of "manufactured for" or "distributed by" per 21 CFR 801.1(c).
FDA handles private label distributors as "wholesale distributors" (see Part 807 definition). Wholesale distributors are generally exempt from FDA's registration and listing requirements unless they are a foreign entity, in which case registration and listing can still be required.
Now, here's a caveat: If the wholesale distributor / private label distributor is actually physically doing the labeling/relabeling of the specification developer's device to apply the private label distributor's branding (beyond just adding a "distributed by" sticker), then such an operation is viewed as a finished device manufacturing operation. In that situation, then I typically register the private label distributor as a contract manufacturer of the specification developer's device. And if such a third party is doing such relabeling independent of the specification developer, then that could constitute relabeling or even full-on manufacturing depending on the details of the scenario.
Regarding the EU MDR, be sure none of the parties meet its definition of "distributor" or "importer" before declaring that no EU MDR requirements apply. Also remember that the EU MDR requires the manufacturer (the one named on the label) to control its suppliers via proper supplier controls. Accordingly, that represents a burden/requirement that is indirectly placed on contract designers and manufacturers (i.e., the basic requirement to cooperate with the manufacturer and to adhere to corresponding supplier controls). Remember also that the Notified Body may want to audit the contract designer or manufacturer as part of assuring the labeled manufacturer's conformity. Accordingly, we need to be careful about sweeping generalizations regarding "no responsibilities" for EU MDR device designers/producers/assemblers/CMOs.
------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright 2023 by ComplianceAcuity, Inc. All rights reserved.
------------------------------
Original Message:
Sent: 08-Oct-2023 10:17
From: Anonymous Member
Subject: Private labeling vs contract manufacturing vs critical suppliers
This message was posted by a user wishing to remain anonymous
There's a device my company designed, that we used to assemble in-house, but we now have the assembly contracted out to another company. And we no longer sell it under our own name – we supply it to a big company that markets it under their brand name.
Under the EU MDR, the rules seem clear. The marketer will have all the responsibilities defined under the "manufacturer" role. As the designer and producer of the device, we have no responsibilities under the MDR, though we have responsibilities defined in our agreement with the marketer. Similarly, the actual assembler of the device has no responsibilities under the MDR, though they have responsibilities defined in their agreement with us.
It's less clear to me how the legal responsibilities are defined in the US. The company doing the assembly is registered as a "contract manufacturer", since they provide the finished device. The companies that manufacture some lower-level components are just "suppliers", and not FDA-registered.
Since we stopped doing the actual assembly for this device, that would seem to make us a "specification developer" instead of "manufacturer". Or are we also a "contract manufacturer", producing this device to the marketer's specifications? They don't really specify much except the branding. (Can there be nested levels of contract manufacturers?)
How should the marketing company be registered in US? Although they have the "manufacturer" role in EU, they don't meet the US definition of "manufacturer", since they don't physically make the device. Are they a "specification developer", since they specify the labels? Or are they only a "distributor"?