MedQraft
← All insights
QMS / ISO 13485

Notification of Supplier Change: Records to Keep After Receiving the Email

This practical guide connects the scope of changes, review basis, and applicable lots in a fictitious case of changing manufacturing location.
It contains practical questions and checklists to convert the supplier’s explanation into our product judgment records.

Last regulatory review: 2026-09-19 Rev. 1.0 7 min read

Receiving Change Notice vs. Making a Decision

We received an email from the supplier stating, "The manufacturing location will change.
There will be no changes to the drawings and delivery specifications."
The purchasing manager relayed this information, and parts made at the new location are expected to arrive next month.

At this time, what actions need to follow within the company?

The mere fact of receiving the email does not mean that a change has been reviewed.
It is essential to establish whether a review manager has been assigned, what products the parts are used for, whether the premises of existing evaluations are maintained, and when the changed products will start arriving.
Only then does it become a usable record in actual operations.

This document presents MedQraft's practical recommendations for handling supplier change notifications.

This does not mean that the same testing, auditing, or approval procedures should apply to all changes.
The specific level of control should be determined according to the product's risk, nature of the change, contract, and company procedures.

Distinguishing the Scope of Reference Guidance

Section §3.4 of the GHTF/SG3/N17:2008 Supplier Management Guidance outlines the perspectives for agreeing on the responsibilities and management of manufacturers and suppliers.
Change management is also an area to consider during agreement and addresses the procedures for assessing changes in validated processes and determining the need for revalidation.

This document serves as non-binding guidance, and the text cites regulatory standards and specifications at the time of publication without directly transposing them to the current legal obligations or the latest regulatory provisions.

The table below and the examples provided are not translations of the original forms but are created to explain the practical flow.
Additionally, IMDRF has published a Consultation on Revision of Supplier Management Guidance.
The distinction between the announcement of public consultations and the issuance of final documents must be made, and this document does not present the contents of the revision as definitive requirements.
The date of material verification is September 19, 2026.

Finding the Boundaries of Changes at the Acceptance Stage

In the first review, it is advisable to confirm “why it changes” and “exactly what changes.”
Depending on whether the supplier’s assertion of the same specifications refers only to the dimensions in the drawings or also includes materials or process conditions, the subsequent questions will differ.

Below is a self-created example for organizing acceptance records.
You can simply supplement the necessary items in your company's existing change management form.

Confirmation Area Question Examples of Related Documents
Change Details Is the difference between before and after specified specifically? Comparison table, revision history of drawings, process description
Target Identification Is our part number linked to the supplier’s number? Purchase specifications, part lists, supplier part number comparisons
Scope of Application What products, inventory, and orders are affected? List of products used, inventory and order status
Timing of Application Can the first changed lot and shipment schedule be identified? Supplier lot information, transition schedule
Review Basis Is there any supporting documentation for sameness or suitability? Evaluation reports, comparison results, inspection records

Instead of leaving undisclosed information as blank, consider indicating the status as "Pending Supplier Confirmation".
If the request date and responsible person are included, it will clarify who is responsible for the next actions.

It is important not to arbitrarily input completion dates or record expected information as confirmed facts.

Fictitious Case: Same Drawings, Just a Change of Processing Location

The following is a hypothetical situation for illustration only, not a case of an actual client.
The supplier of processed parts used in medical devices has notified us that they are moving the production location from A to B.
They assert that the part number and dimensional tolerances will remain unchanged.

The development manager can review what characteristics and conditions were covered in the existing evaluation.
The quality manager may inquire about differences in processing and inspection methods at the new location compared to existing management details.
The purchasing manager can check the delivery schedule for the changed parts and the plan for depleting existing inventory.

In a small organization, it’s better to keep different review perspectives separate, even if one person takes on multiple roles.
For instance, if the supplier’s documentation only includes the dimensions of the drawings, it is necessary first to assess whether this encompasses the whole set of items our team needs to verify.

If additional confirmation is necessary, organize and request clarification on which items and why they are needed.
Conversely, if existing evidence sufficiently covers conditions following the change, they can explain its applicability and review the possibility of avoiding unnecessary retesting.

It is crucial not to jump to conclusions like “since the location has changed, all items must be retested” or “since the drawings are the same, there is no impact.”
The core of the record should be what differences were discovered and what evidence led to the conclusion.

Documenting Review Results Along with Application Conditions

When the review concludes, it is important to have a detail that someone else can execute, rather than just a simple checkmark.
Distinguish whether the materials are insufficient, if additional confirmation is needed for potential application, or if it has been determined that it can be applied within the review scope.

Record Elements Self-generated Example
Review Subject Supplier notification number, affected parts, conditions before and after change
Support Used Report number and revision, verified items, review scope
Remaining Items Requested materials, purpose of additional confirmation and responsible person
Decisions and Conditions Applicability status, conditions to be completed before application, decision-maker
Confirmation of Application First changed lot, identification method for incoming goods, results of confirmation and record locations

Be sure not to confuse the review status with the allowable status.
If there is only an indication of “under material review” and it is unclear how to handle the incoming changed products, then purchasing schedules and quality judgments may move differently.

In cases where hold or conditional processing is needed, the management method should be determined according to the company's authorization rights and material handling procedures.

The necessity of reporting or obtaining approval for regulatory changes is a separate issue from the completion of the supplier review.
Verify the current requirements for the product and market, and connect that judgment with the responsible review if necessary.

Linking First Lot and Documents After Implementation

After the review, verify whether the conditions written in the review records were actually applied at the site.
The supplier indicated that they would convert starting next month; however, existing production may arrive later, or the changed products may arrive sooner than expected.

This is why it is essential to match actual lot or product identification information rather than simply distinguishing based on calendar dates.
If there is a need to differentiate inventory before and after the change, warehouse and production sites must be able to utilize that distinction.

If purchase specifications or inspection guidelines have been amended based on the review results, be sure to check that they are reflected in the documents that the responsible person actually uses.
Determine whether the initial incoming confirmation is sufficient or if observation for a certain period is necessary based on the nature of the change and review results.

For related information, refer to the document revision linked to the point of use.
This will help in preventing the issue of leaving documentation conclusions trapped within the document repository.

Exposing Unverified Areas When Data is Insufficient

There may be situations where the supplier cannot immediately provide all documentation.
In such cases, rather than concluding with a brief reply of “no issues,” it is better to outline what has not been verified and why that information is necessary for judgment.

Consider potential options such as additional explanations, limited access to documents, and alternative justifications, but do not assume that documentation not provided exists.
Even under tight schedules, it should be clear within the company's procedures who can make decisions regarding applicability and what conditions must be met.

The goal is not to increase the number of record forms.
Examine whether there are any discontinuities between the acceptor, reviewer, decision-maker, and confirmation of applications for the specific notification received.

Even if one person is responsible, if the stages and bases are segregated, it will be easier to explain decisions later.

Questions to Check Within Our Company

  • What changes is the supplier supposed to notify, when, and to whom?
  • Is the notification received by the purchasing manager appropriately communicated to the designated reviewer?
  • Are the supplier's claims and the evidence verified by our team distinguished?
  • Is the status of additional materials visible to the responsible person?
  • Does the decision to apply lead to the first changed lot, purchase information, and usage documents?

If there are any challenging answers among these five questions, it can be a good starting point to follow the flow regarding a recent change.

MedQraft’s QMS consulting collaborates with organizations to review the necessary scope based on the procedures and records they use.

You can check the support scope in the QMS consulting information.

The reference materials include the aforementioned GHTF final document and IMDRF consultation notice regarding the revised guidance.
The tables, fictitious cases, and questions in the text are authored by MedQraft and do not replace the suitability judgments of specific products or the licensing conclusions of individual markets.

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement