OEM Quality Agreement & Quality Manual: What to Demand Before Mass Production

Q: How should the quality agreement address adverse event reporting obligations?

Require the ODM to notify the brand owner within 24 hours of any event that could require a field safety corrective action or recall. The brand owner retains recall decision authority. The ODM must provide traceability data, production records, and root cause analysis. For cross-border relationships, specify which party reports to which regulatory authority and within what timeframe.

Q: What AQL sampling standard should be used for medical wearable outgoing inspection?

ANSI/ASQ Z1.4 at General Inspection Level II is the industry baseline. Typical AQL limits: 0.65 for critical defects, 1.5 for major defects, and 4.0 for minor defects. Specific AQL levels should be agreed in the quality agreement and may be tightened based on risk classification and intended use.

Most brand owners sign a purchase order and a non-disclosure agreement, then wait for the first shipment. When the devices arrive with inconsistent surface finish, a connector that fails on 3% of units, and a firmware version that does not match the approved build, the conversation turns to the contract — and the contract says nothing about quality.

A quality agreement is not a purchase order attachment. It is the document that defines what “acceptable” means before you have to argue about it over a shipment of 5,000 units sitting in a warehouse. This article covers what a medical wearable OEM quality agreement must contain, how it differs from a quality manual and a commercial contract, the twelve ISO 13485-aligned clauses that belong in every agreement, and the traps that brand owners fall into when they treat quality as a post-contract activity.

Quality Agreement vs Quality Manual vs Purchase Contract: Three Documents, Three Purposes

One of the most common mistakes in OEM sourcing is conflating three documents that serve different functions:

Document	Purpose	Who Owns It	Legal Weight
Quality Agreement	Defines quality responsibilities, standards, acceptance criteria, and escalation paths between the brand owner and the ODM	Jointly signed	Contractually binding when referenced in the supply agreement
Quality Manual	Describes the ODM’s internal quality management system, processes, and organizational structure	ODM	Not directly binding on the brand owner; serves as evidence of QMS capability
Purchase Contract	Defines commercial terms: price, quantity, delivery, payment, warranties, liability, governing law	Jointly signed	Contractually binding

The quality agreement bridges the gap between the ODM’s internal quality system and the brand owner’s expectations. It translates “we are ISO 13485 certified” into specific, measurable obligations that both parties can be held to.

Critical rule: The quality agreement must be referenced in the purchase contract with a clause stating that breach of the quality agreement constitutes breach of the supply agreement. Without this cross-reference, the quality agreement is a statement of intent, not an enforceable obligation.

ISO 13485 Perspective: The 12 Clauses Every Quality Agreement Must Cover

ISO 13485:2016 does not explicitly require a quality agreement — but it requires control over outsourced processes (Clause 4.1.5), and a quality agreement is the standard mechanism for demonstrating that control. The following twelve clauses map to the ISO 13485 requirements that apply to the ODM-brand owner relationship.

1. Scope and Applicable Products

Define exactly which products, SKUs, and revisions are covered. A vague “all products manufactured by Supplier for Buyer” creates ambiguity when a new product line is added. List the specific product codes, including variant identifiers, and state the process for adding new products to the agreement.

2. Quality Management System Requirements

State the minimum QMS standard the ODM must maintain: ISO 13485:2016 certification, with scope covering the relevant product categories. Require the ODM to notify the brand owner within 5 business days of any certification suspension, major nonconformity finding, or regulatory inspection result that could affect product quality. Do not accept “we are working toward certification” — require the certificate to be in place before the first production build.

3. Document and Record Control

Specify which documents are controlled by whom, retention periods for quality records (minimum: device lifetime plus 2 years, or per applicable regulation), and the format in which records will be provided to the brand owner upon request. Include a clause requiring the ODM to maintain a document change history that the brand owner can audit.

4. Change Control — ECN/ECO Procedure

This is the single most litigated clause in quality agreements. Define:

What constitutes a change: Any modification to the BOM, component source, manufacturing process, test method, software/firmware, or packaging.
Notification requirement: ODM must notify the brand owner in writing before implementing any change, with a minimum notice period (typically 30-60 days for non-critical changes).
Approval authority: The brand owner must approve in writing before the change is implemented. No verbal approvals. No “we already ran the batch.”
Validation requirement: For changes that could affect safety or performance, the ODM must provide validation data demonstrating that the change does not degrade product quality.
Regulatory impact: If the change could affect a regulatory filing, the brand owner has the right to delay implementation until the regulatory submission is updated.

5. Nonconforming Product and CAPA

Define the process for identifying, segregating, documenting, and dispositioning nonconforming product. Require the ODM to maintain a CAPA (Corrective and Preventive Action) system, and to share CAPA reports related to the brand owner’s products within an agreed timeframe. Include the right to review CAPA records during audits.

6. Traceability

Require batch/lot traceability from component receipt through to finished product shipment. Specify the traceability granularity: at minimum, the ability to trace any finished device back to the production batch, date, shift, and key component lots. For medical devices, this is not optional — it is a regulatory requirement for recall management.

7. Incoming Quality Control (IQC) and Outgoing Quality Control (OQC)

Define the sampling plan and acceptance criteria for both IQC and OQC. Reference the applicable AQL (Acceptable Quality Limit) standard — typically AQL 0.65 for critical defects, 1.5 for major, and 4.0 for minor — and specify the inspection level (Level II is standard). Require the ODM to provide IQC and OQC reports with each shipment.

8. Process Validation and Production Controls

Identify which processes require validation (sterilization, sealing, soldering, firmware flashing, calibration) and require documented validation protocols and reports. For validated processes, require the ODM to maintain process control parameters within validated ranges, and to re-validate after any significant change to equipment, materials, or environment.

9. Equipment Calibration and Maintenance

Require all inspection, measurement, and test equipment used for the brand owner’s products to be calibrated to traceable standards, with calibration records maintained and available for audit. Include environmental monitoring equipment (temperature, humidity) if relevant to the production environment.

10. Purchasing and Supplier Control

Require the ODM to maintain an approved supplier list for components used in the brand owner’s products, with supplier qualification records. State whether the brand owner has the right to approve or reject sub-tier suppliers. For critical components (sensors, batteries, MCUs), require the ODM to obtain brand owner approval before changing suppliers.

11. Audit Rights

Grant the brand owner the right to conduct announced and unannounced audits of the ODM’s facilities, including production areas, testing laboratories, and document archives. Define the frequency (typically annual for announced audits), notice period, and scope. Include the right to audit sub-tier suppliers if quality issues arise.

The “fly-in audit” clause: For brand owners located overseas, specify that the ODM will provide reasonable access within 48 hours of arrival, including during production runs. This prevents the “we are closed for maintenance this week” response that coincidentally aligns with your visit.

12. Adverse Event Reporting and Recall

Define responsibilities for adverse event reporting, field safety corrective actions, and recalls. The ODM must notify the brand owner within 24 hours of becoming aware of any event that could require a field action. The brand owner retains the decision authority on whether to initiate a recall. The ODM must provide all necessary traceability data, production records, and root cause analysis to support the recall decision.

For cross-border relationships, specify which party is responsible for reporting to which regulatory authority, and within what timeframe. The EU MDR and FDA 21 CFR Part 806 have different reporting timelines and triggers — a generic “comply with all applicable regulations” clause is not sufficient.

Common Traps: What Suppliers Hope You Will Not Notice

Trap 1: “Commercially Reasonable Efforts”

This phrase appears in change control clauses, CAPA timelines, and audit provisions. It is legally indeterminate. Replace it with specific timeframes: “within 30 calendar days,” “within 5 business days,” “no later than 48 hours after discovery.”

Trap 2: The Missing Sub-Tier Clause

The ODM agrees to quality standards for its own facility — but the critical component (sensor, battery, display) comes from a sub-tier supplier that the quality agreement does not cover. If the agreement does not extend quality obligations to sub-tier suppliers, the ODM can truthfully say “our facility meets all requirements” while a sub-tier supplier ships unqualified components.

Trap 3: Audit Scope Limited to “Reasonable Business Hours”

This is standard language, but it becomes a problem when the only production run for your product happens on the night shift. Specify that audits may include any shift during which the brand owner’s products are manufactured or tested.

Trap 4: Data Ownership and Access

Quality agreements often focus on physical product and miss data. Specify that all production data, test data, inspection records, and CAPA reports related to the brand owner’s products are the property of the brand owner, and must be provided in a usable electronic format upon request and at contract termination.

Trap 5: The Verbal Waiver

Include a clause stating that no waiver of any provision of the quality agreement is valid unless in writing and signed by both parties. This prevents the “your project manager approved it on the phone” defense when a batch ships with an unapproved change.

How to Use the Quality Agreement in Practice

Before signing

Request the ODM’s quality manual and current ISO 13485 certificate. Verify the scope includes your product category.
Conduct an on-site quality audit before signing the agreement. A certificate is not a substitute for seeing the production floor.
Review the ODM’s CAPA log for the past 12 months. Look for patterns: recurring issues, long closure times, CAPAs closed without root cause identified.
Walk the production line for a product similar to yours. Watch the operators. Ask about their training. A well-trained operator can explain why they are doing what they are doing; a poorly trained one cannot.

During production

Require IQC and OQC reports with every shipment. Do not accept a summary — require the raw data.
Conduct at least one unannounced audit per year. If the ODM’s quality deteriorates when they know you are coming, you need to see what happens when they do not.
Track CAPA closure times. A CAPA that stays open for six months is not a CAPA — it is a known problem that nobody is fixing.
Sample-test incoming shipments independently. The ODM’s OQC report is necessary but not sufficient.

When things go wrong

Do not accept a “root cause: operator error” CAPA without asking why the operator was able to make the error. Operator error is a symptom of a process design problem.
If a quality issue affects a shipped batch, invoke the traceability clause immediately. The clock on a recall decision starts when you become aware of the issue, not when the ODM provides the data.
If the ODM is unresponsive to quality concerns, escalate through the commercial agreement’s dispute resolution mechanism. The quality agreement gives you the evidence; the supply agreement gives you the leverage.

Frequently Asked Questions

What is the difference between a quality agreement and a quality manual?

A quality agreement is a bilateral contract between the brand owner and the ODM that defines quality responsibilities, standards, acceptance criteria, and escalation paths. A quality manual is the ODM’s internal document describing its quality management system. The quality agreement bridges the gap between the ODM’s internal QMS and the brand owner’s specific expectations, translating “ISO 13485 certified” into measurable obligations.

Does ISO 13485 require a quality agreement with OEM suppliers?

ISO 13485:2016 Clause 4.1.5 requires organizations to maintain responsibility for outsourced processes and to document the controls applied. While the standard does not mandate a formal quality agreement by name, a written quality agreement is the standard industry mechanism for demonstrating control over outsourced processes. Regulatory auditors and notified bodies will expect to see a documented agreement for any outsourced process that could affect product quality or safety.

What should a change control clause in an OEM quality agreement include?

A change control clause should define what constitutes a change (BOM, component source, process, test method, firmware, packaging), require written notification to the brand owner before implementation with a minimum 30-60 day notice period, require written brand owner approval before any change is implemented, require validation data for changes that could affect safety or performance, and address the regulatory impact of changes — including the brand owner’s right to delay implementation until regulatory submissions are updated.

How should the quality agreement address adverse event reporting obligations?

The quality agreement should require the ODM to notify the brand owner within 24 hours of becoming aware of any event that could require a field safety corrective action or recall. The brand owner retains decision authority on whether to initiate a recall. The ODM must provide all traceability data, production records, and root cause analysis to support the decision. For cross-border relationships, specify which party reports to which regulatory authority and within what timeframe.

What AQL sampling standard should be used for medical wearable outgoing inspection?

For medical wearable devices, the standard ANSI/ASQ Z1.4 (equivalent to ISO 2859-1) at General Inspection Level II is the industry baseline. Typical AQL limits are: 0.65 for critical defects (safety or regulatory impact), 1.5 for major defects (functional failure or significant cosmetic issue), and 4.0 for minor defects (slight cosmetic imperfection). The specific AQL levels should be agreed upon in the quality agreement and may be tightened based on risk classification and intended use of the device.

Negotiating a quality agreement with an OEM partner? Our quality team can provide a comprehensive quality manual and discuss the specific clauses relevant to your product category and target markets. Contact us to start the conversation.