Qualifying a Calibration Provider for FDA and AS9100 Procurement

If you work under FDA 21 CFR Part 820 or AS9100, calibration is not a commodity. It is supplier-controlled work that makes audit evidence. How you buy it decides how well that evidence holds up when an inspector or registrar shows up.

Most articles on what to ask a calibration lab are written to raise awareness. They are a fine start. They are not buying frameworks. Regulated buying sets a higher bar. You need a scope you can verify. You need contract terms that surface decision rule risk. You need clear out-of-tolerance handling. And you need paperwork you can drop straight into a supplier file. This article is the buying-process companion to those awareness pieces.

Why regulated procurement requires more than a generic vendor checklist

FDA 21 CFR 820.50 tells makers to set up steps that keep bought goods and services in line with spec. Calibration is one of those services. AS9100D clause 8.4 says outside processes need control in step with their effect on conformity. Calibration touches every reading from every instrument the lab handles. The risk is high next to the spend.

Generic vendor content asks awareness questions. Is the lab accredited? Are the techs trained? How fast is turnaround? Those matter, but they sit outside your buying workflow. A regulated buyer needs process answers. Can I verify the accreditation scope on my own? Will the lab print its decision rule on every certificate? When a unit comes back out of tolerance, how fast will they tell me, and what will they hand over for my look-back review?

Those answers belong in the supplier file. The rest of this article maps each one to a step you can take.

Verifying scope of accreditation through A2LA and ANAB directories

Recognized bodies grant ISO/IEC 17025:2017 accreditation. In the United States, the two you will meet most are the American Association for Laboratory Accreditation and the ANSI National Accreditation Board. Both keep public directories. Each lists every accredited lab and the exact work that lab may do.

A bare claim of ISO 17025 accredited is not enough. You need to check two things.

First, confirm the lab holds a current accreditation that is not suspended. Both the A2LA and ANAB directories show status. Labs do get suspended or dropped, and it is not always announced.

Second, confirm the exact parameter, range, and uncertainty you need are on the lab’s written scope. A lab accredited for pressure to 10,000 psi may not be accredited for vacuum. A lab accredited for torque to 1,000 ft-lb may not cover the small torque ranges used on surgical tools. The scope document is the source of truth. It lives on the accreditation body’s site, not in the lab’s brochure.

For your file, save a dated screenshot or PDF of the scope on the day you qualify the lab. If the scope changes later, that record shows you made the call with the facts you had.

For labs outside the United States, check that the accreditation body signed the International Laboratory Accreditation Cooperation Mutual Recognition Arrangement. A body outside that arrangement does not carry the same weight under ISO/IEC 17025:2017.

Decision rule disclosure language to require in calibration agreements

ISO/IEC 17025:2017 clause 7.8.6 makes labs apply a decision rule when they state conformity. That rule sets how measurement uncertainty is handled when a reading is compared to a tolerance. It drives the false accept risk the certificate carries.

ILAC G8 lays out the framework. Three rules turn up most often. Simple acceptance passes a unit whenever the reading falls inside tolerance, whatever the uncertainty. Guarded acceptance adds a guard band based on uncertainty, which cuts false accept risk. Risk-based rules pass or fail on a stated probability of conformity.

The same reading, with the same uncertainty, can pass under one rule and fail under another. Without disclosure, you cannot tell which bar the certificate met.

Here is contract language you can use:

The Provider shall apply a documented decision rule in accordance with ISO/IEC 17025:2017 clause 7.8.6 and shall disclose the decision rule on every calibration certificate. If a guard-banded decision rule is applied, the Provider shall identify the guard band as a function of measurement uncertainty.

This clause does not argue about which rule the lab should use. It just makes the lab state what it already does. A lab that cannot state it is a risk, whatever the rule.

Out-of-tolerance notification SLAs and impact analysis support requirements

When a unit comes back out of tolerance, two things must move fast. You have to hear about it. Then you have to start a look-back review of every reading that unit took since its last good calibration.

FDA 21 CFR 820.72(a) says you must have steps for handling gear found out of calibration. AS9100D clause 8.7 says nonconforming output must be controlled. Your own procedure sets the clock for the review. But the lab’s notice is what starts it.

Most vendor agreements never set a notice window. A regulated contract should. Here is language you can use:

The Provider shall notify the Customer of any out-of-tolerance calibration result within five business days of the calibration event. Notification shall include the as-found and as-left values, the reference standard used, the measurement uncertainty, and the parameters that were found out of tolerance. Upon Customer request, the Provider shall furnish supporting documentation reasonably required for the Customer's retrospective impact analysis.

Five business days is a sound default. Some shops need a shorter window for safety-critical gear. The upon-request clause is what turns the lab into a partner in your review, instead of a wall you have to argue with later.

Supplier qualification audit questions for FDA and AS9100 environments

These five questions are built for regulated buying. They sit on top of the awareness questions in other vendor guides:

• Can I verify your scope of accreditation through A2LA, ANAB, or another ILAC MRA signatory? Give me the certificate number.

• What decision rule do you use by default? Is it printed on every certificate? If you guard band, what is the guard band as a function of measurement uncertainty?

• How fast do you report an out-of-tolerance result? What will you send us to support our look-back review?

• What measurement uncertainty is typical for the parameters and ranges we will send? How does that compare with our accuracy ratio targets?

• If we get an FDA Form 483 observation, or an AS9100 nonconformance that traces to your work, what audit support do we get, and how fast?

A lab that answers all five in writing has a quality system ready for regulated work. A lab that cannot, or that says case by case, has not built the paperwork base that regulated buyers lean on.

Building a defensible procurement evidence file

The procurement file is what ties the lab relationship to your quality system. For an FDA inspection or an AS9100 supplier audit, it should hold five things. First, a dated copy of the lab’s current accreditation certificate, pulled from the body’s directory rather than from the lab. Second, the full scope document, with the parameters you use marked. Third, the signed quality agreement, with the decision rule and notice clauses in it. Fourth, your own qualification audit records, with the five questions above and the lab’s written answers. Fifth, a re-check schedule, usually yearly, that confirms the accreditation is still live and the scope still covers you.

That file sits under the certificates the lab sends you. The certificates prove single measurements. The file proves the relationship itself was vetted and is kept current.

Frequently Asked Questions

How do you qualify a calibration provider for FDA or AS9100 procurement?

You need three things beyond a generic checklist. Verify the lab’s scope of accreditation yourself through the A2LA or ANAB directory. Put contract terms in place that require the decision rule on every certificate. Set an out-of-tolerance notice window, with paperwork support for your look-back review. Together those build the procurement file that backs FDA Part 820 supplier control and AS9100 clause 8.4.

How do you verify a calibration laboratory's scope of accreditation?

Use the public directory of the accreditation body. In the United States that is usually A2LA or ANAB. Search by the lab’s certificate number. Confirm the accreditation is live and not suspended. Download the scope. Match the parameter, range, and uncertainty on the certificate to that scope. The directory is the source of truth, not the lab’s brochure.

What contract language should regulated buyers require from a calibration provider?

At a minimum, require two clauses. The lab must print its decision rule on every certificate, per ISO/IEC 17025:2017 clause 7.8.6. The lab must report any out-of-tolerance result inside a set window, usually five business days. That notice should carry the as-found and as-left values, the reference standard used, the measurement uncertainty, and the records you need for your look-back review.

Does FDA 21 CFR Part 820 require ISO/IEC 17025 accredited calibration?

No, not strictly. Section 820.72 asks for calibration traceable to national or global standards. But FDA inspectors more and more expect accreditation as proof of lab skill. That is doubly true for readings that drive product release. Most device makers now default to accredited work to cut risk.

What documentation should be in a calibration supplier qualification file?

It holds a dated copy of the lab’s accreditation certificate from the body’s directory. It holds the full scope document. It holds a signed quality agreement with decision rule and notice clauses. It holds your qualification audit records with the lab’s written answers. It holds a re-check schedule. That file sits under the certificates and proves the supplier relationship itself was vetted.

For organizations operating under FDA Part 820 or AS9100, working with a calibration laboratory that produces this evidence by default reduces both procurement effort and inspection risk. Tra-Cal Laboratories maintains ISO/IEC 17025:2017 accreditation with a publicly verifiable scope, applies documented decision rules on every certificate, and supports customer impact analyses when out-of-tolerance results occur. Request a calibration capability review to start the qualification conversation.