Medical device companies face a distinctive legal contracting environment that combines pharmaceutical industry NDA and partnership contract issues with FDA device regulatory requirements, quality system (QMS) obligations, and the unique IP landscape of hardware, software, and combination products. The contracts that govern device development, manufacturing, and clinical studies are high-stakes documents that require careful drafting. A MedTech company that relies on generic commercial contract templates for its device development and manufacturing agreements is exposed to significant regulatory and legal risk that will not become visible until an FDA inspection, an IP dispute, or a quality system non-compliance event surfaces it.

This guide covers the key contracts in medical device development, how FDA regulation affects MedTech agreements, the critical IP provisions for device companies, and why Quality Agreements with contract manufacturers are non-negotiable.

What Contracts Are Central to Medical Device Development?

The contract landscape for a medical device company is broader and more complex than many founders and business development teams anticipate. Each contract type addresses a distinct phase of the device development and commercialization lifecycle.

Design Control Agreements

Design control agreements govern the relationship between the device company and any co-developer, engineering firm, or design consultant involved in developing the device. Under FDA Quality System Regulation (21 CFR Part 820, Subpart C) and its successor regulation under the QMSR (Quality Management System Regulation, 21 CFR Part 820, effective February 2026), design control applies to Class II and III devices. The design control agreement must specify: which party owns the device design and all design history file documentation, who is responsible for design input, design output, design review, design verification, design validation, and design transfer activities, and how design changes are documented and controlled.

Contract Manufacturing Agreements (CMAs)

A CMA governs the relationship between the device company and its contract manufacturer (CMO). The CMA must address: manufacturing specifications and tolerances, quality control and inspection obligations, change notification requirements (the CMO must notify the device company of any manufacturing process changes before implementation), delivery terms, cost structure, and the device company’s audit rights at the CMO facility. The CMA and the Quality Agreement work together: the CMA addresses the commercial relationship, while the Quality Agreement allocates the specific QSR obligations.

Clinical Investigation Agreements

For Class III devices and IDE-regulated studies, the clinical investigation agreement is the device equivalent of a pharmaceutical CTRA. It governs the relationship between the device sponsor and the clinical site conducting the investigation. Key provisions include: IP ownership of clinical data, indemnification (sponsor indemnifies for device defects and protocol design; institution indemnifies for investigator negligence), IRB compliance obligations, adverse event reporting, publication rights, and per-subject payment structure. FDA IDE regulations (21 CFR Part 812) impose additional requirements beyond those in a standard pharma CTRA.

Software Development Agreements for SaMD

Software as a Medical Device (SaMD) raises unique contracting challenges. The FDA has published specific guidance on SaMD (Software as a Medical Device: Clinical Evaluation, 2017) and the International Medical Device Regulators Forum (IMDRF) has published SaMD frameworks. Software development agreements for SaMD must address: ownership of the algorithm and the training data (if the SaMD uses machine learning), version control and change management obligations under FDA Software Guidance, cybersecurity obligations, and the regulatory pathway (510(k), De Novo, or PMA) and who is responsible for pursuing it.

Quality Agreements

A Quality Agreement (QA) is a separate contract from the CMA that specifically allocates QSR compliance responsibilities between the device company and its CMO. Every device company that uses a contract manufacturer must have a Quality Agreement. Without one, FDA will hold the device company accountable for QSR non-compliance at the CMO, regardless of what the CMA says. The Quality Agreement is not optional: it is a regulatory expectation documented in FDA guidance and reflected in FDA inspection observations.

How Does FDA Regulation Affect MedTech Contracts?

FDA regulation shapes the substantive content of MedTech contracts in ways that have no parallel in most other industries. Understanding the regulatory framework is essential to drafting contracts that are both legally sound and operationally practical.

510(k) and PMA Milestones in Device Contracts

Device development agreements should reference the regulatory pathway and milestone structure that governs the project. For a 510(k) device, the milestones might include: completion of 510(k)-relevant testing (biocompatibility per ISO 10993, electrical safety per IEC 60601, performance testing), 510(k) submission, and FDA clearance. For a PMA device, the milestones are more complex: IDE approval, clinical trial completion, PMA submission, PMA approval, and post-approval study initiation. Payments, obligations, and rights under the development agreement should be tied to these regulatory milestones.

Quality System Regulation and ISO 13485

Device manufacturers must comply with FDA Quality System Regulation (21 CFR Part 820, now updated to align with ISO 13485:2016 under the 2024 QMSR). This requirement flows down to contract manufacturers through the Quality Agreement. The Quality Agreement should specify which party is responsible for each of the major QSR elements: management responsibility, design controls, document controls, purchasing controls, corrective and preventive action (CAPA), complaints, servicing, and statistical techniques. A Quality Agreement that uses vague language (“the parties will cooperate on quality matters”) provides no regulatory protection.

EU MDR Requirements

If the device will be sold in the European Union, EU MDR 2017/745 compliance must be addressed in device contracts. EU MDR imposes: a requirement for a European Authorized Representative (EAR) if the device company is not based in the EU, a requirement for clinical evidence meeting higher standards than prior EU MDD requirements, mandatory registration in the EUDAMED database, and significantly higher post-market surveillance (PMS) obligations. Contracts with European distributors, notified bodies, and the EAR must address these obligations specifically.

IDE-Regulated Clinical Investigations

Clinical investigations of significant risk devices in the US require an IDE (Investigational Device Exemption) from FDA. The clinical investigation agreement for an IDE study must comply with both FDA IDE regulations (21 CFR Part 812) and FDA IRB regulations (21 CFR Part 56). The agreement must address subject rights documentation, adverse device effect reporting (21 CFR 812.150), and device accountability. IDE investigations also require monitoring and auditing rights that mirror pharmaceutical GCP monitoring requirements.

What IP Provisions Are Critical in MedTech Development Agreements?

IP ownership in medical device development has several unique dimensions that differ from pharmaceutical IP issues. Hardware, software, and regulatory data all present distinct ownership questions.

Background IP and Foreground IP

The standard background IP / foreground IP framework used in pharma agreements applies to MedTech development as well. Background IP (each party’s pre-existing technology) must be clearly defined and excluded from the IP assignment provisions. Foreground IP (inventions made during the development engagement) should be owned by the device company. The engineering firm or CMO should retain no ownership rights to device-specific foreground IP; they should receive only a license to their own background IP as needed to perform the services.

Freedom to Operate

Medical device development agreements often allocate responsibility for freedom-to-operate (FTO) analysis between the parties. FTO analysis determines whether the developed device design would infringe any third-party patents. The development agreement should address: which party is responsible for commissioning FTO analysis, who bears liability if the device is found to infringe a third-party patent after the development is complete, and what happens if an FTO issue is identified during development.

Software and SaMD IP

For SaMD, the IP issues are more complex than for hardware devices. Who owns the algorithm? Who owns the training data used to develop the machine learning model? Who owns the model itself? These questions must be answered specifically in the software development agreement. In most cases, the device company should own all training data, the model, and the algorithm, regardless of whether the development was performed by an external software development firm. The firmware and application code should also be owned by the device company or subject to a perpetual, irrevocable license.

Regulatory Data Ownership

FDA 510(k) and PMA submissions are owned by the regulatory applicant. Development agreements must clearly establish who the regulatory applicant is and who owns all regulatory submissions and correspondence. A device company that allows an engineering firm or CMO to become the regulatory applicant may lose control of its regulatory pathway if the relationship with that firm terminates.

Client Scenario: The Missing Quality Agreement

A MedTech startup developed a Class II orthopedic device using a contract manufacturer. The device company and the CMO had a well-drafted Contract Manufacturing Agreement covering specifications, delivery terms, and pricing. However, they did not execute a Quality Agreement before production began. The companies were focused on getting the device to market quickly and treated the Quality Agreement as a formality to be completed later.

During a routine FDA inspection of the CMO’s facility, the FDA investigator found multiple Quality System Regulation non-conformances: incomplete design history file documentation for the device, an inadequate CAPA system, and missing incoming inspection records for critical device components. FDA issued a 483 observation letter that included the device company by name because the device company was the regulatory owner of the product being manufactured at the non-compliant facility.

Without a Quality Agreement in place, there was no contractual basis to allocate responsibility for the QSR elements between the device company and the CMO. The device company was exposed to regulatory action even though it had not manufactured the device and had no direct control over the CMO’s quality system. At Lopes Law LLC, we now recommend that every device company execute a Quality Agreement with its CMOs before any production begins, not after the first 483.

What Distribution and Licensing Agreements Do MedTech Companies Need?

Once a medical device has received FDA clearance or approval, commercialization requires distribution and potentially licensing agreements that have their own specific requirements.

Distribution Agreements

Device distribution agreements must address: the distributor’s territory (domestic and international), exclusivity, minimum purchase commitments, compliance with FDA distributor requirements (including complaint handling and adverse event reporting obligations that flow to distributors), and the device company’s audit rights over the distributor. International distribution agreements must also address local regulatory requirements, import permits, and country-specific labeling requirements.

Licensing Agreements for Device Technology

A device company that licenses its technology to a third party for manufacture or sale must ensure that the license agreement addresses: the regulatory pathway (who is the regulatory applicant in the licensed territory?), quality system compliance obligations in the licensed territory, post-market surveillance requirements, and IP ownership of improvements developed by the licensee. Device licensing agreements must be more regulatory-specific than standard technology licensing agreements.

International distribution agreements for medical devices are increasingly complex as regulatory requirements diverge between the US (FDA), EU (MDR), and other major markets. A single distribution agreement covering multiple territories must address the regulatory requirements in each territory separately. At Lopes Law LLC, we review MedTech distribution and licensing agreements with attention to both the commercial terms and the regulatory compliance allocation, ensuring that neither party is left holding unexpected compliance obligations in territories where they have limited regulatory expertise.

For pharmaceutical NDA and confidentiality agreement considerations that overlap with MedTech contracts, see our post on Pharmaceutical NDAs: What Biotech and Pharma Companies Need to Know. For clinical trial agreement provisions, see Clinical Trial Research Agreements: Key Legal Provisions. For pharma confidentiality agreements with similar data protection considerations, see Confidentiality Agreements in Pharmaceutical Development.

Reach out, we are friendly. Call now for a free consultation at (267) 777-9117 or schedule your free 20-minute consultation online.