How to Verify a Medical Device Supplier Before Purchasing

Verification boundary

1. Supplier Verification Is Not the Same as Supplier Evaluation

Verification asks whether a claim can be connected to a reliable source: Is this the legal company? What role does it perform? Does this public record belong to the relevant manufacturer and device? Does the quoted catalog number match the label and packaging?

Evaluation asks whether the verified supplier is the best operational choice: How should price, delivery, service, capacity and performance be scored? Keep those decisions separate. A supplier should not receive commercial points for evidence that is false, mismatched or incomplete, and a valid public record does not prove competitive pricing, available inventory or acceptable service.

Before searching

2. Freeze the Exact Product and Quotation

“Medical consumables,” “sterile syringe” or “31G pen needle” is not a verifiable purchase object. Ask the supplier to issue a quotation or pro-forma invoice that fixes the identity of the seller and the offered product before reviewing its claims.

For a more detailed product-specific example, see how a buyer should verify an insulin syringe supplier and exact SKU. The same discipline applies to other finished medical devices, but the classification, records and controlled specifications will differ.

Entity resolution

3. Identify Every Legal and Commercial Entity

The name on a sales website may be a trade name, marketplace account, distributor, exporter or marketing company rather than the legal manufacturer. Build an entity map before performing an FDA medical device registration search.

• Commercial seller named on the quote and contract
• Invoice issuer and the proposed payment beneficiary
• Legal manufacturer and physical manufacturing site
• Labeler or private-label entity shown on the device label
• Repackager, relabeler or specification developer, if applicable
• Initial importer for a foreign-manufactured device, if applicable
• U.S. agent for a foreign establishment, noting that this is a distinct role
• Warehouse or third-party logistics provider holding the inventory

Ask for a written explanation whenever names or addresses differ. A difference can be legitimate—for example, a distributor selling a device made and labeled by another company—but it must be explainable and consistent across labels, records and transaction documents.

Use the right expectation

4. Determine Whether the Seller Is a Manufacturer, Distributor or Importer

FDA’s registration rules depend on activities, not on whether a company calls itself a “medical device supplier.” FDA’s current table states that a domestic distributor that does not import devices, and a wholesale distributor that is not a manufacturer or importer, do not register or list. An initial importer registers but does not list devices; it identifies the manufacturers it imports from. Manufacturers, relabelers and repackagers generally have different obligations.

Official source: FDA: Who Must Register, List and Pay the Fee. Role-specific exceptions and the exact activities performed must still be assessed; this table is not a substitute for 21 CFR Part 807 analysis.

Commercial identity

5. Verify Business and Payment Identity

Regulatory records do not prove that the person sending the invoice is authorized to collect payment or supply the goods. Apply the buyer’s normal vendor-onboarding and fraud controls in addition to product verification.

The specific business-registration, licensing and sanctions checks required depend on the buyer’s jurisdiction, product and transaction. A clean FDA database result does not replace those controls.

Official database check

6. Search FDA Establishment Registration and Device Listing Correctly

1. Search the entity expected to register. Use the legal manufacturer, manufacturing site, relabeler, repackager or initial importer—not automatically the commercial distributor name.
2. Try controlled name variants. Search the full legal name, former name, address, owner/operator number or registration number supplied by the company.
3. Review the establishment activity. A record for an importer or contract sterilizer is not evidence that the same company manufactured the device.
4. Open the device listing. Compare device name, product code, proprietary name and the establishment’s activity with the product offered.
5. Save the date and result. FDA states that public Registration & Listing updates are generally completed weekly, so treat the result as time-specific evidence.

Use the official FDA Establishment Registration & Device Listing database and review FDA’s explanation of “FDA registered” and “FDA certified” claims.

Product-specific requirement

7. Determine the Device Classification and Premarket Pathway

Do not ask for a 510(k) until you know whether the exact device type requires one. Use the generic device name, regulation number and product code to identify its classification and applicable controls. Depending on the device, the relevant premarket position may involve 510(k), De Novo, PMA, another pathway or an exemption from premarket notification.

Many Class I devices and some Class II devices are exempt from 510(k), but exemptions can have limitations. Premarket-notification exemption does not automatically remove registration, listing, labeling, quality-system, reporting or other applicable requirements. Confirm the current product classification entry and the relevant regulation rather than relying on a supplier’s general statement that “Class I means no FDA requirements.”

Clearance or approval mapping

8. Verify the Applicable 510(k), De Novo or PMA Record

If the supplier claims a 510(k) clearance, request the K number and search the official database. Compare the applicant, decision date, device name, product code, regulation number, intended use and public summary with the quoted product. Apply the same principle to a De Novo request number or PMA number when that is the relevant pathway.

Commercial sellers, private-label companies and the 510(k) applicant may have different names for legitimate reasons. The supplier should provide a documented mapping from the quoted device to the applicable record; the buyer should not infer coverage solely from a similar photograph or generic device description.

Core evidence test

9. Match the Quoted SKU Across Four Evidence Sources

A public record may describe a device family rather than every commercial package REF. The supplier must still explain how the exact quoted SKU fits that product family, current listing and current U.S. labeling. Compare the following sources side by side.

Buyers who need help assembling this evidence chain can request medical device documentation support for the selected SKU. Tonmit’s published compliance-support scope explains the boundaries between supplier support and the buyer’s own legal, regulatory and quality responsibilities.

Identifier check

10. Verify UDI and GUDID Information Where Applicable

When the device is subject to UDI requirements, scan or transcribe the Device Identifier from the actual label and search AccessGUDID. Compare the labeler, brand, version or model, catalog number, device description, package quantity and higher-level package identifiers where available.

The UDI system separates the Device Identifier, which identifies the labeler and specific version or model, from Production Identifier data that may include lot, serial number, expiration or manufacturing date when such information appears on the label. GUDID contains device-identification information submitted by the labeler; it is not a substitute for registration, listing, premarket review, labeling or supplier qualification.

A missing record is not automatically proof of noncompliance. Confirm whether the device and packaging level are subject to the requirement, the applicable compliance date, any exception or alternative, and whether the identifier was transcribed correctly. Use AccessGUDID together with FDA’s UDI Basics.

Quality evidence

11. Validate ISO 13485 and Other Quality-System Evidence

If an ISO 13485 certificate is offered, verify the legal entity, site address, certificate number, certification body, standard edition, scope, issue and expiration dates, and current status with the issuing certification body or an appropriate accreditation-backed database. The scope must be relevant to the supplied product and activity.

FDA’s Quality Management System Regulation became effective February 2, 2026 and incorporates ISO 13485:2016 by reference with additional FDA requirements. FDA also states that it will not require or issue ISO 13485 certificates and that such a certificate does not exempt a manufacturer from FDA inspection. Therefore, do not describe an ISO 13485 certificate as “FDA certification.”

• Confirm the certificate covers the relevant site—not only a headquarters address
• Read the scope; do not assume it covers every device in the seller’s catalog
• Check whether the certificate is current, suspended, withdrawn or superseded
• Ask how specifications, release, nonconformance, complaints and changes are controlled
• Request product-specific evidence at a level appropriate to the device and transaction

Official source: FDA QMSR Frequently Asked Questions.

Context, not a binary verdict

12. Check Recalls, Warning Letters, Import Alerts and Inspection Information

Search the legal manufacturer, known former names, device name, brand, product code and premarket number across the relevant FDA sources. Review the product scope, date, status, reason, affected lots and the company’s documented response. A previous recall does not automatically require rejection; a search with no result does not prove the absence of all quality or compliance risk.

Supply-chain authority

13. Verify Product Source and Distribution Authority

A distributor can be legitimate without being named in a 510(k), but the buyer still needs a defensible chain of supply. Ask the seller to identify the manufacturer, upstream distributor or importer, and explain how it obtained the product. For higher-risk or strategic purchases, confirm the relationship through the manufacturer or another independently known channel where practicable.

An “authorization letter” should be checked for the issuing legal entity, named recipient, territory, product scope, expiration, signatory and any conditions. It is commercial evidence—not an FDA authorization. If the supplier cannot disclose a necessary upstream relationship for legitimate confidentiality reasons, establish an alternative verification method rather than accepting an unsupported assertion.

Private-label products require a separate responsibility map

Private label can change labeling, UDI/GUDID, listing, complaint exchange, adverse-event and recall responsibilities. Do not assume the original manufacturer’s documents automatically cover every private-label version. Before approving artwork, review private-label medical supply responsibilities and use a controlled process to coordinate packaging and labeling.

Product and lot evidence

14. Verify Sterility, Shelf Life and Lot Traceability

Apply these checks only where relevant to the exact device and label. If a device is represented as sterile, confirm the label statement, sterilization method, packaging configuration, shelf-life claim and appropriate supporting evidence. A generic sterilization certificate from an unrelated run or product is not sufficient lot evidence.

Turn claims into order data

15. Test U.S. Inventory and Fulfillment Claims

A U.S. address does not prove that the exact REF is available. Request a dated, order-specific statement showing the SKU, available-to-promise quantity, lot, expiration, inventory status, warehouse processing window, order cutoff and anticipated carrier service. Clarify whether stock is owned, reserved, allocated, shared or expected but not yet received.

• Verify the exact manufacturer REF and package level held in stock
• State minimum remaining shelf life in the PO or supply agreement
• Separate warehouse handling time from carrier transit time
• Confirm backorder, allocation and partial-shipment rules
• Ask for upstream replenishment lead time and shortage-notification timing
• Use the first order to compare promised and actual processing milestones

Buyers can review Tonmit’s U.S.-warehouse fulfillment process and wholesale medical supply programs. Inventory, lot, expiration and final delivery timing remain SKU- and order-specific and should be reconfirmed in the quotation.

Before funds are released

16. Complete Payment and Purchase-Order Controls

Contract language must be adapted by qualified counsel and the buyer’s quality or regulatory functions. This table identifies purchasing controls; it does not prescribe universal legal terms.

Verify the real transaction

17. Inspect a Sample and a Controlled First Order

A sample helps confirm physical design, labeling, packaging and usability within the buyer’s authorized review process. It does not prove ongoing production consistency, commercial inventory, regulatory status or the identity of every future lot. Keep an approved sample or controlled visual record and then validate a small first commercial order.

First-receipt acceptance checks

• Seller, purchase order and packing slip are consistent
• Manufacturer REF and supplier SKU match the approved product
• Device, label, packaging and package count match the approved revision
• UDI, lot and expiration are present and readable where required
• Remaining shelf life meets the written requirement
• Packaging is intact, with no unexplained relabeling or over-stickering
• Agreed CoC or lot documents identify the received product or lot
• Actual processing, transit and communication match the quotation
• Received lot can be linked to the PO and inventory location

Document the outcome

18. Classify the Result: Verified, Conditional, Hold or Reject

The following four-status model is an internal purchasing framework, not an FDA classification. Define the organization’s approval authority and escalation rules before using it.

Approval should be limited to the named seller, responsible manufacturer, approved SKUs, label and pack revisions, warehouse route where relevant, destination market and agreed commercial controls. It is not approval of an unlimited catalog.

Escalation triggers

19. Medical Device Supplier Verification Red Flags

A red flag is a prompt to pause and investigate, not always proof of fraud or noncompliance. The severity, explanation, independent evidence and buyer’s risk tolerance determine the disposition.

Procurement tool

20. Copyable Pre-Purchase Verification Checklist

Copy this list into the buyer’s sourcing file and add product-specific, state, contractual and organizational requirements.

1. Record the seller’s full legal name, address and authorized contact.
2. Confirm the quote, contract, invoice and proposed payment beneficiary.
3. Freeze the legal manufacturer, brand, REF, supplier SKU, specification and pack.
4. Identify the manufacturer, labeler, importer, relabeler and distributor roles as applicable.
5. Search the entity expected to appear in FDA Registration & Listing.
6. Verify establishment activity, address and device listing; save the date and result.
7. Determine product code, device class, regulation and premarket pathway.
8. Verify the K, DEN or PMA number when applicable.
9. Document why an exemption applies when no premarket submission is required.
10. Match quote, label, controlled documents and official records.
11. Search the UDI-DI in AccessGUDID where applicable.
12. Validate the ISO 13485 certificate site, scope, issuer and current status if supplied.
13. Search relevant recalls, Warning Letters, Import Alerts and public inspection data.
14. Verify product source and any distribution-authorization evidence.
15. Confirm sterile status, shelf life, lot-release evidence and traceability as applicable.
16. Confirm exact-SKU inventory, lot, expiration and fulfillment terms.
17. Write no-substitution, shelf-life, acceptance, return and change controls into the PO.
18. Inspect and retain an approved sample or controlled comparison record.
19. Complete a controlled first-order receipt and reconcile every critical field.
20. Record Verified, Conditional, Hold or Reject status with scope, owner and date.
21. Set re-verification triggers for renewal, change, complaint, recall or performance failure.

Final decision rule

21. Verify the Transaction, Not Just the Company

A legitimate company can quote the wrong product, and a real product record can be attached to the wrong seller, label or SKU. That is why the strongest medical device supplier due-diligence process does not stop after finding a company name in a database.

The buyer should be able to show one continuous evidence chain: the seller’s legal and payment identity, each party’s regulatory role, the applicable official records, the exact quoted configuration, the current label and documents, the source and inventory, the purchase-order controls, and the received lot.

Any unresolved mismatch should be treated according to its significance: correct it, place the order on hold, limit approval or reject the transaction. Verification is not a promise that no future problem can occur; it is a documented method for reducing avoidable identity, product and fulfillment errors before the buyer increases exposure.