The Workbench · Craft
A quality agreement names who has to call first
This blog has already covered how Clause 4.1.5 requires a written quality agreement whenever a process gets sent outside the building, and how Clause 7.4.1's own risk-scaled criteria decide how hard a supplier gets vetted before an order goes out. Neither essay named the one line both documents are actually built to carry, buried a sub-clause past where most purchasing files stop reading: a standing promise, in writing, that the supplier will say something before a change ships — not after a nonconforming lot shows up at incoming inspection.
The clause sits one paragraph past where most files stop
Clause 7.4.2 requires purchasing information to describe the product being bought — the specification, the requirements for acceptance, any required qualification of the supplier's own personnel, and the quality management system requirements that apply — and it requires the organization to make sure that information is adequate before it's ever sent to the supplier. Most purchasing files stop there, because that's the half of the clause a spec sheet already satisfies. The clause doesn't stop there. Where appropriate, it also requires the organization to reach agreement with the supplier that the supplier will notify it of any change to the purchased product before that change is implemented, whenever the change could affect the product's continued ability to meet the purchasing requirements on file.
A purchase order states a spec; it doesn't ask to be told anything
A purchase order is a one-time instrument: it names what's being bought and the terms of that specific buy, and once it's accepted, its job is done. Nothing about accepting a PO creates a standing duty for the supplier to come back later and volunteer that a raw material changed, a sub-supplier changed, or a step in their own process moved. That duty exists only where a separate document creates it — the quality agreement the clause is actually asking for, distinct from the commercial paperwork and often never signed at all once a supplier relationship has been running long enough to feel settled.
FDA asked for the same promise, in the same place
Before the Quality Management System Regulation's fold-in, 21 CFR 820.50(b) ran the US side of the identical idea: purchasing data had to specify requirements for purchased products and services, and, where possible, the purchasing documents had to include an agreement that suppliers would notify the manufacturer of changes to the product or service before those changes were made. Since QMSR's February 2, 2026 compliance date, 820.50 states nothing on its own — it's one of the sections this blog has already covered as reserved, pointing to ISO 13485:2016's own purchasing clauses instead. The obligation didn't get stricter or looser in the move. It just lost its own paragraph, which makes it easier for a purchasing SOP to quietly drop the one line that isn't about specifying a part.
What the agreement has to name, not just promise
“We have a quality agreement with that supplier” isn't the same claim as “that agreement does what Clause 7.4.2 asks.” A document that satisfies the clause has to say what counts as a reportable change — a material substitution, a tooling change, a new production site, a changed sub-supplier of their own — and it has to say the notice comes before the change is implemented, not folded into the next shipment's paperwork as a courtesy. A boilerplate agreement that only states general quality expectations, with no defined trigger for what has to be reported and no stated timing, has signed something without actually creating the standing obligation the clause is built around.
The notice isn't the end of the organization's own job
Getting the notice right doesn't verify anything by itself. Clause 7.4.3 still requires the organization to decide how a purchased product gets verified, scaled to the supplier's own risk profile, and a supplier-reported change is exactly the kind of event that should reopen that decision rather than get filed and forgotten. A process change on the supplier's side can also be the fact that triggers a revalidation an organization owes its own downstream process, if the purchased input feeds something that was qualified against the version of the part that no longer exists. The agreement's only job is to make sure the organization finds out in time to make that call — not to make the call for it.
Where this meets the file
A supplier quality agreement template built around a defined list of reportable change types, a stated notice-before-implementation timeline, and a visible link back to the verification and revalidation decisions a notice should trigger is previewed in the launch catalog. If your program writes this agreement differently, the shelf takes that correction directly.
The Regulatory Toolkit launches soon — a free shelf of source-mapped templates, checklists and browser-only tools for regulatory teams. Get one email when it opens, or contribute a template.