CNC Machining for Medical Devices: Supplier Qualification Guide 2026

Author: Eric Lin, Senior Process Engineer, Yicen Precision

Eric Lin has 11 years of CNC process engineering experience with direct work on medical device component qualification, biocompatible material supply chains, and ISO 13485-aligned manufacturing process documentation.

For medical device quality engineers qualifying a new CNC machining supplier in 2026, the single most dangerous shortcut is approving a supplier based on their ISO 13485 certificate alone without verifying that the certificate scope actually covers CNC machining operations. ISO 13485 certificates can be scoped to design only, final assembly only, or distribution only — none of which requires validated machining processes. A supplier holding an ISO 13485 certificate for ‘medical device assembly’ that is machining your Class II catheter guide body components has a certificate that does not cover the machining operations. This distinction costs $30,000–$200,000 per recalled lot when discovered during an FDA audit.

The second most dangerous shortcut is treating ISO 13485 and IATF 16949 as equivalent for medical device qualification. IATF 16949 is more rigorous than ISO 9001 in process control — but it lacks the risk management framework (ISO 14971), biocompatibility documentation, and device history record requirements that medical device regulation demands. A CNC supplier that has IATF 16949 for automotive work and no ISO 13485 is not qualified for Class II or III medical device components without significant additional quality system work.

ISO 13485 vs IATF 16949: What Each Covers for CNC Medical Device Suppliers

Yicen Precision's Service d'usinage CNC operates under an ISO 13485-aligned quality management system with process validation documentation, Device History Record capability, and biocompatible material supply chain controls for Class I and Class II medical device components.

Biocompatible Materials for CNC Machined Medical Components

The 8-Point Medical CNC Supplier Qualification Audit

1. Certificate Scope Verification

Request the actual ISO 13485 certificate and verify: (a) the accreditation body is ANAB or equivalent, (b) the scope text explicitly includes CNC machining or precision machining — not just ‘assembly’ or ‘distribution’, (c) the certificate is current (check expiry date). A certificate with scope ‘design and assembly of surgical instruments’ does not cover machining.

2. Process Validation Documentation (IQ/OQ/PQ)

Request a process validation summary (not the full protocol — that is confidential) for a comparable machining operation. Verify that Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) protocols exist and are current. A supplier that cannot produce process validation documentation is not operating a validated process regardless of their certificate.

3. Device History Record (DHR) Sample

Request a redacted example DHR for a completed medical lot. Verify it contains: raw material certificate (traceable to heat lot), in-process inspection records, final CMM dimensional report mapped to drawing callouts, and lot release authorisation. This is the document FDA reviews during inspections — if the supplier cannot produce a complete example, they will not pass an FDA audit.

4. Biocompatible Material Supply Chain

For implantable material components: request the certificate of conformance for the specific material lot the supplier would use on your programme, including: material specification compliance (AMS 4928, ASTM F138, etc.), heat lot number traceability, third-party mechanical test data, and confirmation of ISO 10993 biocompatibility testing applicable to the material grade. Generic material specifications are not sufficient.

5. Cpk Capability Data

Request Cpk data for the specific feature type matching your programme — turning diameter, thread form, bore, or profile. Medical production requires Cpk ≥ 1.67 on Critical-to-Quality (CTQ) features. A supplier quoting Cpk ≥ 1.33 is at automotive quality level, not medical. Cpk data must come from a production run, not a capability study on a specially selected run.

6. First Article Inspection (FAI) Example

Request a redacted FAI package for a comparable medical component. The FAI should include: all drawing callouts ballooned, measurement results from calibrated CMM traceable to NIST, material certification, and process parameter records. Aerospace FAI (AS9102 Form 1/2/3) is an equivalent level of rigor and acceptable as reference.

7. Calibration Records

Request calibration records for the CMM and measuring equipment that would be used for your programme. Calibration must be traceable to national standards (NIST or equivalent) with calibration frequency appropriate to the measurement uncertainty required. A CMM calibrated annually for ±0.005 mm features may not be adequate — verify calibration interval matches your tolerance requirements.

8. FDA QMSR / FDA Registration

For components destined for medical devices sold in the US market: verify the supplier’s FDA registration (DUNS or FDA registration number) is current. As of February 2026, FDA QMSR aligns 21 CFR Part 820 with ISO 13485 — suppliers previously qualified under the old QSR may have gaps in their documentation. Request their QMSR gap assessment or transition documentation.

Why IATF 16949-Only Suppliers Are Not Directly Qualified for Medical

Several CNC machining suppliers — including Yicen Precision — hold both IATF 16949 and ISO 13485-aligned quality systems. IATF 16949 alone is insufficient for medical device qualification because:

• IATF 16949 does not require Device History Records — the primary FDA audit document
• IATF 16949 uses AIAG PFMEA (automotive risk format) vs ISO 14971 (medical risk management) — these are different frameworks with different output requirements
• IATF 16949 does not address ISO 10993 biocompatibility documentation — essential for patient-contact implantable materials
• IATF 16949 does not align with FDA QMSR (post-February 2026) — the new FDA quality system regulation references ISO 13485:2016, not IATF 16949

For medical device programmes, the required path is: ISO 13485 certificate (with machining scope) + FDA QMSR alignment + biocompatible material documentation + IQ/OQ/PQ validation + DHR capability. IATF 16949 is a complement to this stack, not a substitute.

Questions fréquemment posées

What certification does a CNC machining supplier need for medical device components?

ISO 13485:2016 certification with scope explicitly covering CNC machining operations is the baseline requirement. Verify the certificate is from an ANAB-accredited registrar and the scope text includes machining or precision manufacturing — not just design or assembly. Additionally: FDA registration (21 CFR Part 807) for suppliers producing components for US-marketed medical devices; process validation documentation (IQ/OQ/PQ); and Device History Record capability. ISO 13485 alone is not sufficient — verify all three additional elements.

Is IATF 16949 acceptable instead of ISO 13485 for medical CNC machining?

No. IATF 16949 is the automotive quality standard — it does not satisfy FDA QMSR, ISO 14971 medical risk management, ISO 10993 biocompatibility, or Device History Record requirements. A supplier with IATF 16949 but no ISO 13485 lacks the medical-specific quality infrastructure required for regulated medical device components. IATF 16949 demonstrates strong process control discipline (which is valuable as a foundation), but the medical-specific elements must be built on top of it through an ISO 13485-aligned quality system.

What Cpk does medical CNC machining require?

Medical CNC machining requires Cpk ≥ 1.67 on Critical-to-Quality (CTQ) features — features directly affecting device safety or functional performance. This is equivalent to approximately 1 defective part per million (1 ppm) at process steady state. Cpk ≥ 1.33 (automotive standard minimum) produces approximately 64 ppm — unacceptable for medical devices where field failures affect patient safety. General non-critical features can be held to Cpk ≥ 1.33, but every drawing callout designated CTQ by the design engineer or quality system requires Cpk ≥ 1.67 demonstrated from production data.

Conclusion: Verify Scope, Validation, and DHR Capability Before Approval

• ISO 13485 certificate with CNC machining scope + process validation (IQ/OQ/PQ) + Device History Record capability = the minimum qualification bar for Class II and III medical device components
• IATF 16949 alone is not a substitute for ISO 13485 in medical device supply chain qualification
• Cpk ≥ 1.67 on CTQ features is the medical production standard — not Cpk ≥ 1.33

Yicen Precision provides ISO 13485-aligned CNC machining for medical device components. Submit your drawings for a qualification discussion at yicenprecision.com.