Your Supplier Changed a Component: How to Tell If It’s a Regulatory Event

A supplier notifies you that a material is being replaced, an adhesive has been reformulated or a new mold is going into production. Frequently the notice describes the replacement as equivalent or “like-for-like,” and it lands with sourcing or engineering rather than regulatory.

That routing is understandable, but the physical nature of a change tells you very little about its regulatory weight. A tolerance shift of a few thousandths of an inch can matter more than a wholesale material swap, depending entirely on what the component does inside the finished device.

So the more useful question is not how significant the supplier says the change is. It is what the component affects in your finished device.

Answering that question sorts every decision point in a change notice into one of two outcomes. Either you can close it out with a documented assessment and updates to the affected records, or the change reaches into the evidence supporting your device and calls for additional testing, regulatory action, or both. Both outcomes are common, and neither is predictable from the notice itself. What follows is how to tell them apart.

First, define what actually changed

“New material” or “alternate supplier” is not a definition. You need to know what is different from the component you originally evaluated, which could mean formulation, dimensions, tolerances, coating, adhesive, tooling, manufacturing process or manufacturing site.

Push the supplier for specifics and ask what they did to assess any impact of the change on the component. If a new mold is going into production, did they run dimensional validation to confirm every specification still falls within tolerance? If a resin changed, do they have comparative data on the properties your device actually depends on? A notice that says “equivalent” without showing the work behind it is a starting point for a conversation, not a conclusion. The supplier’s answers provide a starting point for your own comprehensive change notification.

Then follow the difference into your device. Does the component directly or indirectly contact the patient? Does it contribute to how the device performs or its safety profile? Is it tied to a critical dimension or a risk control? A component that mates with other parts is worth particular attention: if a dimension or material shifted, do those parts still fit, seat and seal the way your verification testing demonstrated they would?

These questions are not rhetorical. They are the basis for a documented assessment of the change, and they will determine whether you can close the change notice with a simple record update or whether it triggers additional testing or regulatory action.

Supplier data is useful evidence and worth collecting. It just cannot substitute for your own assessment of what the change means downstream.

Four questions to work through

Once the change is defined and you know what it touches, four questions determine how far the assessment needs to go. They build on each other, so the order matters.

1. Does it affect biocompatibility?

If the change could affect biological safety, go back to the existing biocompatibility assessment. Look at what changed in the material or process, how the component contacts the patient and whether the change introduces anything the original evaluation did not cover. The risk-based framework in ISO 10993-1 is the right structure for working through it.

A material change does not automatically mean repeating your full biocompatibility testing. In some cases, existing biocompatibility data from the supplier can be used to generate a sufficient documented rationale. In others, additional evaluation or testing is warranted. What you are answering is whether the evidence you already hold combined with vendor-supplied information still supports the biological safety of the device with the changed component.

2. Does it affect device performance?

A component does not have to raise a biocompatibility concern to change how the device behaves. A different material, dimension, adhesive or process can affect strength, flow, connection integrity, durability or any number of characteristics your device depends on.

This is where “like-for-like” tends to mislead. A supplier can demonstrate that the replacement meets its component specification and still tells you nothing about whether the finished device performs the same way with that component installed.

Go back to the device requirements associated with the component and identify which ones could reasonably be affected, along with the testing that originally demonstrated those requirements were met. From there, the response might be a documented engineering assessment, targeted verification or additional validation. You are not looking for a reason to repeat testing. You are identifying what needs to be reconfirmed and what evidence would reconfirm it.

3. Does it affect your regulatory submission?

This is usually the question teams want answered first, and it is the hardest one to answer well out of sequence. Once you know what changed, what it affects and whether your existing evidence still applies, you have a real basis for judging the regulatory consequence. Without that, you are guessing.

For a marketed device, the assessment runs against the applicable requirements and the device’s existing clearance or approval. Depending on the device, the market and the nature of the change, you may be able to document the assessment internally, or additional regulatory action may be required. Either way, submission strategy is the output of the regulatory aspect of the change assessment, not its starting point.

4. What needs to be verified and updated?

If the assessment identifies a potential impact, decide what evidence would resolve it. Testing should answer a specific question the change created. “The component changed, so we need to test it” is not a rationale. “This characteristic may be affected, this requirement still needs to be met, this evidence demonstrates that it is” gives you a defensible basis for the scope you chose, and it protects you against both under-testing and testing you did not need.

Consider all device characteristics and manufacturing processes. A change in manufacturing location or a supplier may result in higher bioburden and therefore may impact the sterilization validation for a sterile product. Introduction of a mold release agent in the process may require a downstream cleaning step prior to assembly into your finished device.

Then close the loop in the documentation. Depending on the change, that means updating specifications, drawings, risk documentation, supplier records, design documentation or verification and validation records. Someone reviewing the change two years from now should be able to see what changed, how you assessed it, what supported your conclusion and what you updated as a result.

Don’t wait for a change notice to think about change control

No assessment process, however rigorous, solves the problem of a change you were never told about.

Supplier notification practices vary widely. Some suppliers have mature change control and will flag anything that touches your component. Others treat a change as internal as long as the component still meets their own specification. A supplier quality agreement is where you close that gap, by establishing in advance which categories of material, process, design, tooling or manufacturing changes require notice, and how much notice you get. That is what buys your team the chance to assess impact before the changed component is already in the device.

The supplier quality agreement must be explicit in describing the nature of changes which require notification. A comprehensive listing may require more work for your supplier but ensures you receive notification for any change that could impact the safety and performance of your finished device. Change categories should include changes to material, dimension, adhesives, color additives, component and raw material suppliers, manufacturing processes, process parameters, manufacturing locations or manufacturing equipment.

Where do I start?

If a change notice is already in front of you and you are not sure how far the assessment needs to go, start with where the device sits in its lifecycle.

Still in development. Bring the change into your existing design control and risk management process. Identify whether it affects requirements, planned testing, specifications or other design documentation.

Design substantially complete or submission underway. Look at what has already been completed with the original component. Has biocompatibility testing been performed? Verification or validation? Has information about the component already made its way into submission documentation? That tells you what needs revisiting formally through the design control process.

Cleared, approved or in distribution. Evaluate the change against the device as it is currently cleared or approved and against the requirements for each market where it is sold. Determine whether your existing evidence still supports the device, whether regulatory action may be required and which records need updating.

The principle holds at every stage. Don’t start by asking how significant the supplier says the change is. Start by asking what the component touches.

The takeaway

Plenty of supplier changes require no new testing and no new submission. What gets teams into trouble is dismissing a change because it looked minor on the notice, without the rigorous assessment to back that up.

Define what changed. Follow it into the finished device. Determine whether it affects biocompatibility, performance or the evidence you already have. Then decide what verification, validation, regulatory action or documentation the change actually calls for. The objective is not to turn every supplier notice into a comprehensive design and regulatory project. It is to know which ones aren’t, and to be able to show why.