Sourcing Medical Devices from Poland

1. Vendor Selection Framework

Selecting a Polish medical device manufacturer for supply requires a structured qualification process addressing regulatory compliance, technical capability, quality system maturity, financial stability, and commercial alignment. The qualification process should be completed before placement of any commercial orders, as retrospective compliance remediation is substantially more costly and time-consuming than initial due diligence.

1.1 Initial Screening Criteria

The initial screening phase filters the broad universe of potential Polish suppliers to a qualified shortlist for detailed assessment. Screening criteria should be documented in your procurement quality procedure and applied consistently. Core regulatory criteria—verified at the initial contact stage before any commercial discussions—include current ISO 13485:2016 certification with scope statement covering the relevant device types and manufacturing activities (design, manufacture, sterilisation as applicable); CE Declaration of Conformity under EU MDR 2017/745 for the specific product(s) of interest, confirming device classification and applicable conformity assessment procedure; EUDAMED registration confirmation (search at eudamed.ec.europa.eu by manufacturer name or manufacturer SRN, the Single Registration Number assigned by EUDAMED); and Notified Body certificate number and body identity for Class IIa, IIb, and III devices (verifiable at NANDO database).

Technical capability screening evaluates whether the manufacturer's production processes, materials knowledge, testing infrastructure, and engineering capability are appropriate for your device specification. This assessment is conducted through questionnaire and review of documentation provided by the manufacturer, supplemented by on-site audit for shortlisted candidates. Key technical questions include production technology employed (CNC machining tolerances, cleanroom class and area, sterilisation method and validation status, electronics assembly IPC class); design and development capability (does the manufacturer have an in-house design function with documented design controls per ISO 13485 Section 7.3, or are they a pure contract manufacturer requiring customer-supplied designs?); sub-supplier management practices (what proportion of components are manufactured in-house vs. sourced from sub-suppliers, and are critical sub-suppliers on a qualified Approved Supplier List with periodic re-evaluation?); and post-market surveillance infrastructure (does the manufacturer operate a documented PMS system including complaint handling, vigilance reporting procedures, and periodic safety update capability meeting MDR Article 83-86 requirements?).

1.2 Technical Capability Assessment

The technical capability assessment, conducted via detailed questionnaire followed by on-site audit, evaluates the manufacturer's ability to consistently produce your specific device to the required specification, performance, and safety standards. The assessment scope should align with the device classification and the associated regulatory obligations. For Class I non-sterile, non-measuring devices (the most common hospital furniture and basic instrument category), the assessment focuses on dimensional and material conformance, quality control procedures, and packaging integrity. For Class IIa sterile single-use devices, the assessment expands to include sterilisation validation records (ISO 11135 for EtO, ISO 11137 for radiation), biocompatibility evaluation (ISO 10993 series), and shelf-life validation. For Class IIa/IIb active devices, the assessment additionally covers IEC 60601 test documentation, software development lifecycle records per IEC 62304, and usability engineering files per IEC 62366.

On-site facility audits for medical device suppliers should be conducted by personnel with specific ISO 13485 auditing competence (typically a lead auditor qualification from an IRCA-accredited or equivalent programme) and, for technically complex devices, supplemented by a subject matter expert in the relevant device technology. Polish manufacturers are generally experienced in hosting international buyer audits and will typically prepare audit schedules, document packs, and facility tours appropriate for EU buyer requirements. Audit duration ranges from one day for a focused review of a Class I supplier to three days for a comprehensive assessment of a Class IIb device manufacturer with multiple production lines, sterilisation, and software development activities.

2. EU MDR Compliance Verification

EU MDR 2017/745 verification for Polish medical device manufacturers requires a structured review of regulatory documentation that confirms the manufacturer's legal authority to place devices on the European market. This review forms part of the buyer's own regulatory obligations as an importer or distributor under MDR Articles 13 and 14, and must be completed and documented before first commercial shipment.

2.1 Declaration of Conformity Review

The Declaration of Conformity (DoC) is the manufacturer's legal statement that the device conforms to applicable EU MDR requirements, and the document from which all downstream regulatory activities (CE marking, Technical File compilation, EUDAMED registration) derive their authority. A compliant DoC under EU MDR 2017/745 must include the manufacturer's name, registered address, and SRN (Single Registration Number from EUDAMED); a statement that the Declaration is issued under sole responsibility of the manufacturer; device identification including name, model, catalogue number(s), and UDI-DI; device classification under EU MDR Annex VIII rules with stated rationale; reference to applicable conformity assessment procedure (Annex IX, X, or XI); a list of harmonised standards applied with citation to the Official Journal of the EU; for Class IIa/IIb/III devices, identification of the Notified Body (name and identification number) and the Notified Body certificate number; the name, function, and signature of the authorised signatory; and date of issue.

Buyers should verify DoC content against the current MDCG 2021-8 guidance on Declaration of Conformity format, cross-check the stated Notified Body certificate number against the NANDO database (confirming the NB is currently designated and the certificate has not been withdrawn or restricted), and confirm the device UDI-DI listed on the DoC is registered in EUDAMED. For Class I devices without Notified Body involvement, the DoC alone (with Technical File maintained by manufacturer) constitutes the compliance demonstration, making careful verification of the DoC content and underlying Technical File availability particularly important for buyers placing Class I devices on the EU market.

2.2 EUDAMED Verification Procedure

EUDAMED (the European Database on Medical Devices) is progressively becoming the central regulatory transparency tool for the EU medical device ecosystem. Current EUDAMED functionality (as of early 2026) includes manufacturer registration (Actor Registration module—mandatory for all EU manufacturers under MDR Article 30), UDI and device registration (UDI/Device Registration module), and Certificate module showing Notified Body certificates. Buyers should verify: (1) manufacturer EUDAMED registration—search by name or SRN at eudamed.ec.europa.eu, confirm the manufacturer's registered address and scope match the documents provided; (2) device registration—search by UDI-DI to confirm registration of the specific device(s) being procured; (3) certificate status—for Class IIa/IIb/III devices, verify Notified Body certificate is active, not suspended or withdrawn, and covers the device type being purchased.

3. Quality Agreement Framework and Contract Structures

A Quality Agreement (QAA)—also known as a Quality Technical Agreement, Supply Quality Agreement, or Quality Assurance Agreement depending on industry convention—is a binding bilateral document that defines the quality management responsibilities of both the buying organisation and the Polish manufacturer throughout the supply relationship. Under ISO 13485:2016 Section 7.4.3, documented agreements addressing quality requirements are required when outsourcing activities that affect product conformity. EU MDR Article 10(9) further requires that manufacturers using contracted services ensure their ISO 13485 QMS extends to or covers those contracted activities.

3.1 Quality Agreement Structure

A comprehensive QAA with a Polish medical device manufacturer should address the following twelve core areas, each of which should be specifically documented rather than addressed by general reference to standards or regulations. Scope and product definition establishes which specific devices (by name, model, catalogue number, and device classification) are covered by the agreement, which regulatory territories are included, and which manufacturing activities at the Polish manufacturer are addressed. Quality system responsibilities allocates specific ISO 13485 activities between manufacturer and buyer, identifying which party holds the Technical File, which party owns and updates the Risk Management File, which party is responsible for post-market surveillance data collection and PSUR preparation, and which party manages vigilance reporting to URPL (or the relevant competent authority). Document control defines procedures for Technical File updates, label and IFU changes, and product specification modifications—including mandatory notification timelines (typically 30 days prior notice for significant changes, 14 days for labelling changes), documentation format requirements, and version control responsibilities. Change control establishes the specific changes that require mandatory prior notification (materials, sub-suppliers, manufacturing process steps, sterilisation provider, software, production site) versus notification after implementation (non-significant administrative changes), and defines the buyer's approval rights before changes can be implemented.

3.2 Contract Structure and Commercial Terms

Medical device supply contracts with Polish manufacturers should include provisions beyond standard commercial supply agreements to address the regulatory obligations specific to this sector. The Master Supply Agreement (MSA) or Frame Supply Contract should incorporate by reference the Quality Agreement, confirm that ISO 13485:2016 and EU MDR 2017/745 compliance obligations are legally binding terms of supply, and include specific remedy provisions for regulatory non-compliance events including certificate lapse, EUDAMED deregistration, or Notified Body certificate withdrawal. Payment terms for established supply programmes typically follow 30-60 day net payment from delivery and CoC receipt, with milestone payment structures for tooling, validation batches, and OEM setup projects (typically 30-40% on contract signature, 30-40% on validation completion, 20-30% on first commercial shipment). Warranty provisions should cover minimum shelf-life guarantees (particularly for sterile single-use devices and IVD reagents where shelf life is a regulatory parameter), non-conformance disposition procedures specifying return logistics and credit procedures, and intellectual property warranties confirming no third-party IP infringement in the device design or materials used.

4. Quality Assurance and Incoming Inspection Protocols

Incoming inspection procedures for medical devices from Polish manufacturers form an integral part of the buyer's own ISO 13485:2016-compliant quality management system, satisfying the requirements of Section 7.4.3 (verification of purchased product) and Section 8.2.6 (monitoring and measurement of product). The inspection intensity should be calibrated to the device classification, the supplier's established quality performance, and the risk consequences of a non-conforming device reaching end use. A tiered incoming inspection programme based on supplier qualification status represents the standard industry approach.

Tier 1 inspection (full incoming inspection, applied to new suppliers or suppliers with open CAPAs) involves systematic sampling per ANSI/ASQ Z1.4 or equivalent, dimensional verification of key characteristics, visual inspection against written acceptance criteria, label and IFU compliance check, Certificate of Conformance (CoC) review against batch manufacturing records summary, and sterility certificate review for sterile devices. Tier 2 inspection (reduced inspection, applied to established suppliers with consistent quality performance over 12+ months) involves CoC review, label compliance check, sampling of key characteristics at reduced AQL levels, and visual inspection of representative sample. Tier 3 verification (documentation check only, applied to exemplary suppliers under programme exemption with annual requalification) involves CoC review, label compliance verification, and shipper integrity check, with periodic full inspections triggered by product family or calendar period.

5. Intellectual Property Protection

Intellectual property protection for medical device development programmes with Polish manufacturers operates within the EU's harmonised IP legal framework, providing strong and enforceable protection for product designs, manufacturing processes, technical data, clinical evidence, and software developed in the course of supply relationships. The Polish legal framework governing IP in commercial relationships includes the Industrial Property Law (Prawo własności przemysłowej, Dz.U. 2001 nr 49 poz. 508, as amended), the Copyright and Related Rights Act (Ustawa o prawie autorskim, 1994), and the Act on Combating Unfair Competition (Ustawa o zwalczaniu nieuczciwej konkurencji, 1993)—all substantially harmonised with EU directives and providing remedies enforceable through Polish courts and EU IP offices.

Confidentiality Agreements (NDAs) should be executed before any disclosure of proprietary technical information, competitive intelligence, or clinical data to the Polish manufacturer or its employees. For medical device development programmes, NDAs should be bilateral (protecting manufacturer confidential information as well, to ensure genuine commitment from the partner), include all manufacturer employees involved in the programme by reference to their employment NDA obligations, specify a post-project confidentiality period of at least five years (appropriate given medical device development and product lifecycle timescales), and include specific provisions for the return or destruction of physical and electronic information at programme conclusion. IP Assignment Agreements in OEM development contracts should explicitly confirm that all work product created during the programme—including product designs, engineering drawings, manufacturing process development, software source code, test protocols, and validation data—constitutes work-for-hire assigned to the commissioning party upon payment of the associated development fee. Residual rights clauses (which some manufacturers seek to retain general manufacturing knowledge and process improvements) should be reviewed carefully to ensure they do not inadvertently grant rights in project-specific IP.

6. Ongoing Supplier Governance Framework

Effective governance of established Polish medical device supply relationships requires structured processes for communication, performance monitoring, continuous improvement, and escalation that integrate the regulatory obligations of the Quality Agreement with the commercial management of the supply programme. A tiered governance structure appropriate for medical device supply encompasses three levels of engagement: operational (monthly), tactical (quarterly), and strategic (annual).

Operational governance at monthly level covers quality performance metrics review (complaint rates, CoC rejection rates, delivery on-time performance, open CAPA status), new non-conformance notifications, production planning and forecast alignment, and any immediate compliance or regulatory issues. Tactical quarterly reviews address Quality Agreement performance against agreed KPIs, supplier development activities (process improvement projects, certification upgrades, capacity investments), contract performance versus commercial targets, and regulatory updates relevant to the devices supplied. Annual strategic reviews coincide with the annual supplier audit, address supplier certification renewals and requalification, review the supply agreement and pricing for the coming period, assess the strategic development of the supply relationship (new products, expanded scope, partnership deepening), and benchmark the supplier's performance against market alternatives.