ISO 13485 for Medical Device Importers and Private Labels: Whose QMS Is It Anyway?

A hospital buyer calls you about a surgical glove with your brand on the box. One glove in a batch tore during use. The buyer wants your corrective action report, your risk file, and your certificate. You did not make the glove. A factory in Malaysia did. But your name is on the box, and the buyer is not asking the factory. They are asking you. That is the whole question of this guide, in one phone call.

The short answer: If you resell a device under the foreign maker's name, you usually do not need your own ISO 13485 certificate — the import licence, the label and your complaint and recall records carry you. If your brand is on the box, you are the manufacturer in law, and you need your own quality management system, even though you own no factory.

The name on the box decides

Think of the name on the box the way you think of the name on a property deed. The deed does not care who built the house, who painted it, or who holds the keys. It names the person who answers for it. A medical device works the same way. The name printed on the label decides who the regulator, the hospital and the patient hold responsible — whatever the factory arrangement behind it.

India's own rule says this plainly. The Medical Devices Rules, 2017 define a manufacturer as a person who manufactures a device, and add an Explanation: the person who has marketed or promoted any medical device, or used any other similar expression printed, written, embossed or put in any manner on the medical device, shall be construed as the manufacturer. Put your brand on the device and the Rules call you the manufacturer. Full stop.

The same logic runs through the rest of the world. Under the EU Medical Device Regulation, whoever places a device on the market under their own name or trademark takes on the manufacturer's obligations, technical documentation included. The factory's certificate does not follow the brand. And ISO 13485:2016 says the same thing in its own language: processes the standard requires, but which you do not perform yourself, are still your responsibility, and your quality system must account for them by monitoring, maintaining and controlling them.

Three roles, three answers

Most importers and own-brand sellers fall into one of three roles. The role decides the certificate.

1. The importer-reseller. You import a device made abroad and sell it under the foreign maker's name and brand. The maker's name stays on the label. You are an importer and distributor. Your certificate is usually not required — the maker's ISO 13485 certificate and the CDSCO import licence do the heavy lifting.

2. The private-label manufacturer. You buy a finished device from a factory and sell it under your own brand. Your name is on the label. The factory may be ISO 13485 certified, but that certificate is in the factory's name, for the factory's scope. It does not certify your brand. You are the legal manufacturer, and you need your own quality management system and your own certificate.

3. The contract manufacturer. You make devices for someone else's brand. Your name never reaches the box. Your customer holds the certificate for the product; you hold a certificate for your manufacturing processes, and your customer's auditor will want to see it. You are not the manufacturer in law, but you are the first place an auditor looks when something goes wrong at the factory.

Notice what this means in practice. Two companies can sell the identical glove from the identical factory, and one needs ISO 13485 while the other does not. The difference is not the product. It is the name on the box.

What India asks an importer for

Before the certificate question comes the licence question, and in India the two are separate. The licence is mandatory. The certificate is voluntary. The licence comes from CDSCO under the Medical Devices Rules, 2017, and the route for an importer runs through three facts that catch first-timers out.

First, a foreign manufacturer cannot apply to CDSCO directly. The application must come from an Indian entity — either the manufacturer's own Indian subsidiary or an Indian Authorised Agent appointed through a power of attorney. The agent must itself hold a licence to sell or distribute devices: a manufacturing licence, a wholesale licence in Forms 20B and 21B, or a registration certificate in Form MD-42.

Second, the application is Form MD-14, and the licence CDSCO grants is Form MD-15. One MD-15 covers one overseas manufacturing site. Two factories means two applications. CDSCO has up to nine months to decide, under Rule 36. Once granted, the licence stays valid in perpetuity as long as the retention fee is paid every five years — miss it and the late fee runs at 2% a month for up to 90 days.

Third, the government fee is charged per site and per device, in US dollars, under the Second Schedule:

Class A — $1,000 per site, plus $50 per distinct device. Class B — $2,000 per site, plus $1,000 per device. Class C and D — $3,000 per site, plus $1,500 per device. Low-risk Class A devices that are non-sterile and do not measure anything take a lighter route: registration on the CDSCO portal, not a full licence.

Then comes the label. Rule 44 of the Rules requires the label to carry the import licence number, the name and address of the importer, the address of the actual manufacturing premises, and the date of manufacture. Where those details are not already printed, they go on by stickering. A sticker is not a workaround. It is the method the Rules themselves name.

What ISO 13485 asks of a company with no factory

A private-label company owns no production line, no cleanroom, no steriliser. So what does its quality system actually contain? More than most founders expect, and less than a factory's.

Clause 4.1.5 is the hinge. When you outsource any process that affects whether the product meets its requirements, you must monitor and control that process, and you keep responsibility for it. The controls must match the risk and the supplier's ability to meet the requirements, and the controls must include written quality agreements. That one clause is the reason a private-label QMS exists at all: you cannot hand the factory the work and hand away the responsibility with it.

Clause 7.4 then gives you the purchasing controls: evaluate and select suppliers against criteria you have written down (7.4.1), tell the supplier exactly what you are buying — specifications, acceptance criteria, the standards the product must meet (7.4.2) — and verify what arrives against what you specified (7.4.3). For a private-label company, this is the core of the system. Your receiving inspection is the factory's production control, seen from your side.

Traceability follows at clause 7.5.9. You must be able to trace a device, or a batch of devices, back through your records to the factory lot, the shipment and the customer who received it. When a hospital reports a torn glove, the first question is always which batch, and the second is who else got it. If you cannot answer both from your records, the recall cannot start.

The device file sits at clause 4.2.3: one file per device or device family, holding the design history, the risk management file, the labelling and the instructions for use. As the private-label manufacturer you own this file, even though the factory made the device. If the factory will not share the design and risk documents, you have a problem no certificate can paper over — which is why the quality agreement matters so much.

Finally, the feedback loop: complaints under clause 8.2.2, post-market feedback under 8.2.1, and corrective and preventive action under 8.5.2 and 8.5.3. The hospital's phone call at the top of this guide lands here. Someone in your company must log it, investigate it, decide whether it is reportable, and close it with a fix that actually works. A reseller who forwards complaints to the factory and forgets them has no system. A private-label manufacturer who does the same has a system on paper and a finding at the audit.

The quality agreement — the document that does the real work

If your whole manufacturing operation sits in someone else's factory, the quality agreement is the single most important document you will ever sign. Auditors read it before they read anything else, because it is the only place where the split of duties is written down. A purchase order is not a quality agreement. A distribution agreement is not a quality agreement. The agreement must say, in plain terms:

Who owns the design, and who holds the design history file. Who owns the risk management file, and who updates it when a new hazard appears. Who controls changes — and the rule that no change to materials, process, supplier or labelling happens without your written approval. Who investigates complaints, who decides whether an incident is reportable, and who files the report. Who keeps which records, for how long, and who can see them. And who lets whose auditor into whose factory, because the certification body auditing you will almost certainly want to audit the factory too.

Write it before the first order, not after the first complaint. Renegotiating a quality agreement with a factory that already has your money is a different conversation, and it rarely goes your way.

The audit reality — will they visit the factory?

Yes, often. A certification body auditing a virtual manufacturer — a company whose name is on the product but whose factory is someone else's — regularly audits the contract manufacturer as part of your audit. The auditor needs evidence that you control the outsourced processes, and the strongest evidence sits on the factory floor: the process validation records, the calibration stickers, the way non-conforming product is actually segregated.

Your scope of certification should say this honestly. Practitioners phrase it as "Design and Outsourced Manufacturing of…" followed by the device family. A scope that hides the outsourcing invites the auditor to find it anyway, and an auditor who finds a hidden factory is an auditor who stops trusting the rest of your system.

One more thing the audit tests: whether your system has been running. A quality manual written last week and a complaint log with one entry will not pass, however well written. Auditors expect to see the system operating — records accumulating, a management review that actually happened, an internal audit that found something. Plan on months, not days, before the certification audit. The design file, the quality agreement and a few months of running records are what take the time.

The reseller who stays a reseller

If your brand never touches the box, you still have duties — they are just different ones. Verify the foreign maker's mark and declaration of conformity. Make sure a unique device identifier has been assigned. Keep complaint and recall records of your own, because the hospital will call you first and the regulator will ask you what you did with the call. Put your name and address on the device or its packaging, as the label rules require. And keep the import licence current — the five-year retention fee is the easiest deadline in this whole field to miss, and the cheapest to pay on time.

What you do not need is your own ISO 13485 certificate. Say so plainly when a buyer asks, and show them the maker's certificate, the import licence and your complaint procedure instead. A buyer who understands the chain will accept that. A buyer who insists on a certificate in your name for a product you do not make is asking for the wrong document — and it is worth explaining why, calmly, once.

Three traps that catch importers

The rebrand. A distributor starts by reselling under the maker's brand, then adds their own label to "strengthen the brand" — and becomes the legal manufacturer overnight, without a quality system, a device file or a quality agreement. The label change is the legal event. Treat it like one.

The tender. A hospital tender asks for "ISO 13485 certificate of the bidder". Your supplier holds one; you do not. The tender does not care whose factory made the device. If you bid own-brand, build the system before the tender, not after you win it.

The borrowed certificate. A supplier shows you their certificate and says it covers your brand too. It does not. A certificate names a legal entity, an address and a scope. Read all three. If your company name is not on it, it is not your certificate, and presenting it as yours is the fastest way to lose a buyer's trust.

What it costs, and how long it takes

Our ISO 13485 consultancy runs at ₹14,999 for the Standard package (up to 25 employees) and ₹29,999 for Growth (26–100 employees). That is the consultancy fee only. Certification-body audit fees are charged by the body at actuals, and no body publishes a fixed tariff, so any consultant who quotes you a single all-in number is guessing. The import licence fees above are separate government fees, in US dollars, paid to CDSCO through the portal.

On timing, a private-label QMS is usually the faster build in the ISO 13485 family, because there is no factory to validate and no process validation to run. What takes the time is the design file, the quality agreement, and the months of running records an auditor wants to see. Do not let anyone promise you a certificate in a fortnight. The system has to exist before it can be audited.

One more date matters for anyone selling into the United States. The FDA's Quality Management System Regulation, which incorporates ISO 13485:2016 by reference into 21 CFR Part 820, took effect on 2 February 2026. The same documents that satisfy your ISO 13485 audit now serve the US market too — one more reason to build the file properly the first time.

Five mistakes importers keep making

1. Treating the supplier's certificate as your own. It names their entity, their address, their scope. It says nothing about your brand.

2. Signing a purchase order instead of a quality agreement. Price, quantity and delivery are not quality controls. The agreement that governs change control, complaints and audit access is a separate document, and it must exist before the first shipment.

3. Letting the factory change something without telling you. A different raw material, a new sterilisation vendor, a tweaked mould — any of these can change the device. Your agreement must require written approval before the change, and your receiving inspection must be able to catch it if the approval never comes.

4. Forgetting the retention fee. The MD-15 licence lasts in perpetuity while the five-year retention fee is paid. It is the smallest bill in the whole import operation and the one most often missed.

5. Keeping no complaint records of your own. Forwarding a complaint to the factory is not handling it. You need the log, the investigation, the decision and the closure — in your own files, in your own name.

Do I need ISO 13485 if I only import and resell medical devices?
Usually not, if you sell under the foreign maker's name and brand. You need the CDSCO import licence (Form MD-15), the label with your name and address as importer, and your own complaint and recall records. If your brand goes on the box, you become the manufacturer in law and you need your own quality management system.

What is a private label manufacturer under ISO 13485?
A company that sells a medical device under its own name without making it. The factory's certificate does not cover your brand. Under clause 4.1.5 of ISO 13485:2016, you stay responsible for the outsourced processes and must control them through written quality agreements, supplier evaluation and verification of what arrives.

How do I get a CDSCO import licence for medical devices?
Appoint an Indian Authorised Agent through a power of attorney — a foreign manufacturer cannot apply directly. The agent files Form MD-14 on the CDSCO portal; CDSCO grants the licence in Form MD-15, one per overseas manufacturing site, and has up to nine months to decide. Government fees are $1,000 per site plus $50 per device for Class A, $2,000 plus $1,000 for Class B, and $3,000 plus $1,500 for Class C and D.

Will the ISO auditor visit my supplier's factory?
Often, yes. A certification body auditing a company whose manufacturing is outsourced regularly audits the contract manufacturer too, because the evidence that you control the outsourced processes sits on the factory floor. Your scope of certification should state the outsourcing honestly — "Design and Outsourced Manufacturing of…" — rather than hide it.

Does ISO 13485 replace my CDSCO licence?
No. The licence under the Medical Devices Rules, 2017 is mandatory — without it, you cannot legally import or sell the device in India. ISO 13485 certification is voluntary. The Fifth Schedule quality system mirrors much of ISO 13485, so a licensed manufacturer has already built a good part of the system — but the certificate is a separate, audited proof for buyers, tenders and export markets.

The name on the box is the whole test. If it is yours, build the system that earns it — the device file, the quality agreement, the complaint log that actually closes. If it is the maker's, keep the licence current, keep the label honest, and keep your own records anyway. Either way, the buyer on the phone deserves an answer from the company whose name they read. If you want help working out which side of that line your business sits on, start with our ISO 13485 certification page, read our documents checklist for what an auditor will ask for, see how the CDSCO licence and the certificate fit together, and check any certificate you already hold with our guide to checking an ISO certificate. And if you want the full year’s compliance cost alongside it, the compliance fee calculator totals it up.