The Specification Developer Dilemma: Outsource the Manufacturing, But Not the Liability

Written Oct 16, 2026 – 10 minute read

In the medical device industry, a Specification Developer routinely transfers product specifications to a contract manufacturer, who is responsible to set up production, manufacture, package and label the desired product, in order to sell and distribute the released product. However, the Specification Developer still retains all liability following the release of product to the market and so they are also responsible for all of contract manufacturer activities, ensuring that all Quality Management System Regulation (QMSR) and ISO regulations are met.

The goals for a Specification Developer are simple. Keep headcount lean – especially in the Quality Assurance (QA) and regulatory areas, hire a capable contract manufacturer, and hire sales and marketing professional in building sales channels and distribution networks. The dilemma is what the Specification Developer does not realize: under FDA law, the name of the company on the label is the Specification Developer (i.e. manufactured for), and FDA will expect that the Specification Developer meets all QMSR regulation in a 510(k) review, in a complaint file, in a recall and in a regulatory inspection.

Since the QMSR took effect on February 2, 2026, the regulation defines the responsibilities of a Specification Developer and what the Specification Developer needs to have in place so that the model works for them rather than against them.

What is a Specification Developer?

“Specification Developer” simply is engaged in Design and Development and develops comprehensive product specification to manufacture a device. It is also an establishment type in FDA’s registration and listing system, where the firm is responsible for self-declaring. FDA defines it as an establishment that develops specifications for a device distributed under its own name but performs no manufacturing. The definition also covers companies that arrange for a contract manufacturer to make devices labeled with another establishment’s name (FDA, Who Must Register, List and Pay the Fee). The sponsor does not “become” a specification developer by meeting minimum requirements and then registering. The moment the Sponsor writes the specifications and sells the device under their name they become a specification developer. From that moment the obligations attach, whether the quality system is ready or not.

Two neighboring roles are often confused with it:

Specification consultant only. A firm that writes specifications for someone else’s device, which is not distributed under the consultant’s name. FDA does not require it to register, list or pay the fee.
Contract manufacturer. A firm that builds a finished device to another establishment’s specifications. It registers and lists in its own right, but it is not the party answerable for the design and associated verification and validation.

The test is simple: whose name is on the label, and who controls the design? If the answer to both is your firm, then your firm is the Specification Developer.

The legal reality: Specification Developer is really the manufacturer and a Contract Manufacturer is an Extension of the Specification Developer

Under 21 CFR 820.3, a manufacturer is anyone who designs, manufactures, fabricates, assembles or processes a finished device. The same definition states that the term includes those who perform specification development. The 21 CFR 820 Quality Management Systems Regulation (QMSR) carried this definition forward unchanged in substance, and 820.1 Scope repeats it. (820.1 Scope)

In plain terms, FDA’s quality system law makes no distinction between the company that owns the factory and the company that owns the design. Both are manufacturers. The only relief is the one in 820.1: a manufacturer complies with the requirements that apply to the operations it actually performs.

That relief is narrower than it sounds. A specification developer performs the operations that carry the most regulatory weight. It owns design and development, the risk management file, labeling, supplier selection, complaint handling and the decision to release product into commerce under its name. Outsourcing the assembly line removes production controls from out of the specification developers’ hands. It does not remove the Sponsors duty to control them as a critical supplier.

What changed on February 2, 2026

Much of what has been written about specification developers cites the old Quality System Regulation, including 820.5 and the 820.30 design control section. Those sections no longer exist. On February 2, 2026, the QMSR replaced them by incorporating ISO 13485:2016 by reference, with a short list of FDA-specific additions such as 820.35 (control of records) and 820.45 (labeling and packaging controls).

For a specification developer, three consequences stand out.

The standard is now the rule. ISO 13485 clause 4.1.5 requires an organization that outsources a process to retain responsibility for its conformity and to control it in proportion to risk. Clause 7.4 requires supplier evaluation, selection and monitoring based on the supplier’s effect on the device. These are no longer “best practices” layered on FDA law; they are FDA law.

Risk management runs through everything. ISO 13485 requires a risk-based approach to controlling QMS processes, including outsourced ones. An undocumented rationale for how tightly controlled a supplier is now a gap.

Being ISO 13485 certified is not the same as complying. Some companies assumed a certificate would carry them through the transition. It will not. FDA does not issue or accept ISO 13485 certificates as proof of compliance, and the QMSR adds requirements the standard does not contain along with additional FDA rigor that comes with an inspection.

What the Specification Developer cannot outsource

Your firm as specification developer can outsource the work behind almost every obligation, but cannot outsource the obligation itself. A contract manufacturer can run incoming inspection, sterilization and final release. It cannot be the party FDA holds accountable for whether those activities were adequate.

Obligation	Where it comes from	What it means for a specification developer
Design and development	QMSR via ISO 13485 clause 7.3	Your firms owns the design inputs, verification, validation, transfer and design changes, even if an engineering firm did the work
Risk management	ISO 13485 and ISO 14971	The risk file is your firms and must reflect field data, not just the original design
Outsourced process and supplier control	ISO 13485 clauses 4.1.5 and 7.4	Must evaluate, qualify, monitor and re-evaluate the contract manufacturer and critical suppliers
Quality agreement	ISO 13485 clause 4.1.5	A written agreement must define who does what; a purchase order is not one
Complaint handling	ISO 13485 clause 8.2.2	Complaints come to your firm, and you decide whether they are reportable
Medical device reporting	21 CFR 803	Your firm files MDRs; the definition of manufacturer there includes those who initiate specifications
Corrections and removals	21 CFR 806	Recall decisions and reports are your firm’s responsibility
UDI and GUDID	21 CFR 830	As the labeler, your firm holds the device identifiers and GUDID records
Labeling and packaging controls	21 CFR 820.45	Approve labeling and ensure it is inspected before release
Management review and internal audit	ISO 13485 clauses 5.6 and 8.2.4	Leadership must review QMS performance, including supplier performance

The recurring failure is the quality agreement. Many virtual companies run on a supply agreement written by business development and a quality manual copied from a template. Neither says who approves a process change at the contract manufacturer, who investigates a nonconformance, or how fast complaint information moves between the two companies. When FDA asks, “Who decided?”, the answer has to be on paper.

Registration, listing and fees

A Specification Developer must register its establishment, list its devices and pay the annual establishment registration fee under 21 CFR 807.20(a)(1) (FDA). Registration happens in FDA’s Unified Registration and Listing System (FURLS), and annual renewal runs from October 1 to December 31.

One point is routinely misstated: the registration fee does not depend on device class or company size. For fiscal year 2027 (October 1, 2026 to September 30, 2027), it is a flat $13,785 per establishment (FDA, MDUFA fees). That is up from $11,423 in FY 2026, a 20.6% increase.

Two more facts trip up first-time registrants. First, registration is not clearance or approval, and FDA does not issue registration certificates. Any marketing that implies otherwise is a misbranding problem waiting to happen. Second, registration and listing do not substitute for the premarket submission. A Class II device still needs a 510(k) or De Novo unless it is exempt.

Inspections: what FDA looks at when the Firm is Virtual

A registered specification developer is an inspectable establishment, and a company with no production floor gives the investigator fewer places to look and more reason to look hard at each. The inspection goes straight to design files, risk management, supplier controls, complaints, Medical Device Reporting (MDR) decisions and management oversight.

The rules for that inspection changed with the QMSR. FDA retired the Quality System Inspection Technique (QSIT) and issued Compliance Program 7382.850, Inspection of Medical Device Manufacturers, on January 30, 2026 (King & Spalding). Investigators now use risk management documentation to decide where to look. Under the old QSR, 820.180(c) shielded management review records, internal audit reports and supplier audit reports from routine FDA review. That protection is gone. FDA now considers those records within an investigator’s authority to request, and FDA has indicated that records created before February 2, 2026 remain in scope.

Supplier audit reports are the main evidence that the Sponsor controls their contract manufacturer. Management reviews are the main evidence that leadership is engaged. A supplier audit that found nothing, with a management review meeting notes that do not have any substantial action items and discussion points will raise more questions than it answers.

When the model works and when it fails

The specification developer model works when the company treats supplier control as its core competency, not as overhead. It fails when the company treats the contract manufacturer’s quality system as a substitute for its own.

The model tends to work well for companies that have all the following:

A contract manufacturer with real medical device experience, its own FDA registration and a clean inspection history
A quality agreement that assigns change control, nonconformance, CAPA, complaint and release responsibilities line by line
At least one Quality Assurance person inside the company with the authority and competence to review and reject a supplier’s work
Ownership of the design history file, risk file and medical device file, not just access to them

It tends to fail in predictable ways. The contract manufacturer changes a material or a process without notice, and nobody at the specification developer evaluates whether a new 510(k) is needed. Complaints arrive through a distributor and sit for weeks before anyone assesses MDR reportability. The design file lives on the engineering firm’s server, and the relationship ends badly.

Before choosing the model, answer these questions in writing:

Who in our company signs off on design changes, and do they understand the device?
What does our quality agreement say happens when the contract manufacturer wants to change a supplier, material or process?
Do we own, physically and contractually, the design history file and technical documentation?
How quickly does complaint information reach us, and who decides reportability?
When did we last audit our contract manufacturer, and would we be comfortable handing that report to an FDA investigator today?
If our contract manufacturer disappeared tomorrow, could we transfer production to a second source using only the documents we hold?

If any answer is “we would ask the contract manufacturer,” your firm is not ready.

The bottom line

A specification developer can still build a substantial medical device business without owning a factory. They cannot build one without owning the quality system that controls the factory hired. The specification developer model trades capital expense for supplier risk, and under the QMSR, FDA can now read exactly how well that risk is managed.

Accurate Consultants helps specification developers and companies considering the model set it up correctly from the start. That includes QMSR-aligned quality systems built on ISO 13485:2016, quality agreements with contract manufacturers, supplier audits, registration and listing, 510(k) and IND/PMA submissions, and inspection readiness. Please reach out to us at [email protected] for a free consultation and proposal.

Sources

Tags: 510(k), contract, design, developer, fda, listing, manufacturing, outsource, registration, review, roles, specification, strategy

Accurate Consultants Inc.