Qualifying a Calibration Provider for FDA and AS9100 Procurement
For organizations operating under FDA 21 CFR Part 820 or AS9100, calibration is not a commodity service. It is supplier-controlled work that produces audit evidence, and the procurement decision determines how defensible that evidence will be when an inspector or registrar arrives.
Most published "questions to ask your calibration lab" articles are written for general buyer awareness. They are useful starting points. They are not procurement frameworks. Regulated procurement requires a higher bar: verifiable accreditation scope, contract language that surfaces decision rule risk, defined out-of-tolerance handling, and documentation the buyer can put directly into a supplier qualification file. This article is the procurement-process companion to those buyer-awareness pieces.
Why regulated procurement requires more than a generic vendor checklist
Under FDA 21 CFR 820.50, manufacturers are required to establish and maintain procedures to ensure that purchased products and services conform to specified requirements. Calibration is one of those services. Under AS9100D clause 8.4, externally provided processes are subject to control proportional to their effect on conformity. Calibration affects every measurement made with every instrument the laboratory touches. The ratio of risk to spend is unusually high.
Generic vendor evaluation content addresses awareness questions: Is the lab accredited? Are technicians qualified? What is the turnaround time? Those questions matter, but they sit outside the procurement workflow. The questions a regulated buyer needs to answer are procedural: Can I verify the accreditation scope independently? Will the lab disclose the decision rule it applies on every certificate? When a calibration shows out of tolerance, what is the notification commitment, and what supporting documentation will the lab provide for our retrospective impact analysis?
Those answers belong in the supplier qualification file. The rest of this article maps each one to specific procurement actions.
Verifying scope of accreditation through A2LA and ANAB directories
ISO/IEC 17025:2017 accreditation is granted by recognized accreditation bodies. In the United States, the most commonly encountered are the American Association for Laboratory Accreditation and the ANSI National Accreditation Board. Both maintain public directories that list every accredited laboratory and the scope of work each laboratory is accredited to perform.
A claim of "ISO 17025 accredited" is not sufficient on its own. Two specific verifications are required.
First, confirm that the laboratory holds a current, unsuspended accreditation. Both A2LA and ANAB directories show certificate status. Suspensions and withdrawals happen and are not always announced.
Second, confirm that the specific parameter, range, and uncertainty you require are on the laboratory's documented scope of accreditation. A laboratory accredited for pressure calibration to 10,000 psi may not be accredited for vacuum measurements. A laboratory accredited for torque to 1,000 ft-lb may not be accredited for the small-torque ranges used in surgical instrumentation. The scope document is the source of truth, and it lives on the accreditation body's website, not on the calibration laboratory's marketing material.
For procurement files, capture and retain a dated screenshot or PDF of the scope document at the time of supplier qualification. If the scope changes between qualification and a future audit, the original record demonstrates that the procurement decision was made with current information.
For non-U.S. suppliers, verify that the accreditation body is a signatory to the International Laboratory Accreditation Cooperation Mutual Recognition Arrangement. Accreditations from non-MRA bodies do not carry the same recognition under ISO/IEC 17025:2017.
Decision rule disclosure language to require in calibration agreements
ISO/IEC 17025:2017 clause 7.8.6 requires laboratories to apply a decision rule when issuing statements of conformity. The decision rule determines how measurement uncertainty is treated when comparing a measured value to a tolerance, and it directly affects the false accept risk that the calibration certificate carries.
ILAC G8 describes the framework. The most common decision rules in practice are simple acceptance, where conformity is declared when the measured value is within tolerance regardless of uncertainty; guarded acceptance, where a guard band based on measurement uncertainty reduces false accept risk; and risk-based decision rules that accept or reject based on a documented probability of conformity.
The same measurement, with the same uncertainty, can produce a "pass" certificate under simple acceptance and a "fail" certificate under guarded acceptance. Without disclosure, the buyer has no way to know which standard the certificate represents.
Recommended contract language for regulated procurement:
The Provider shall apply a documented decision rule in accordance with ISO/IEC 17025:2017 clause 7.8.6 and shall disclose the decision rule on every calibration certificate. If a guard-banded decision rule is applied, the Provider shall identify the guard band as a function of measurement uncertainty.
This language requires no negotiation about which decision rule the laboratory uses. It requires the laboratory to disclose what it already does. Laboratories that cannot disclose are a procurement risk regardless of the decision rule itself.
Out-of-tolerance notification SLAs and impact analysis support requirements
When a calibration shows out of tolerance, two things have to happen quickly. The buyer has to be notified, and the buyer has to begin a retrospective impact analysis on every measurement made with that instrument since its last in-tolerance calibration.
Under FDA 21 CFR 820.72(a), the manufacturer must establish procedures for the proper handling of equipment found to be out of calibration. Under AS9100D clause 8.7, nonconforming output requires control. In both cases, the timeline for impact analysis is set by internal procedure, but the trigger is the laboratory's notification.
Generic vendor agreements rarely specify an out-of-tolerance notification window. Regulated procurement contracts should. Recommended contract language:
The Provider shall notify the Customer of any out-of-tolerance calibration result within five business days of the calibration event. Notification shall include the as-found and as-left values, the reference standard used, the measurement uncertainty, and the parameters that were found out of tolerance. Upon Customer request, the Provider shall furnish supporting documentation reasonably required for the Customer's retrospective impact analysis.
The five-business-day window is a defensible default. Some regulated environments may require shorter windows for safety-critical instrumentation. The "upon Customer request" provision is what allows the laboratory to be a partner in the impact analysis rather than a wall the buyer has to negotiate with after the fact.
Supplier qualification audit questions for FDA and AS9100 environments
The following questions are specific to regulated procurement and complement the buyer-awareness questions covered in adjacent vendor evaluation resources:
Is your scope of accreditation publicly verifiable through A2LA, ANAB, or another ILAC MRA signatory? Provide the certificate number.
What decision rule do you apply by default, and is it disclosed on every certificate? If guard banding is applied, what is the guard band as a function of measurement uncertainty?
What is your out-of-tolerance notification SLA? What documentation will be provided to support our retrospective impact analysis?
What measurement uncertainty values are typical for the parameters and ranges we will submit, and how do those uncertainties compare to our internal accuracy specification ratios?
If we receive an FDA Form 483 observation or an AS9100 nonconformance that traces back to a calibration you performed, what audit support can we expect, and within what timeframe?
A laboratory that can answer all five questions in writing during qualification has a quality system mature enough to support a regulated procurement relationship. A laboratory that cannot, or that defers the answers to "case by case," has not yet built the documentation infrastructure that regulated buyers depend on.
Building a defensible procurement evidence file
The procurement evidence file is the artifact that ties the calibration relationship to the buyer's quality system. For an FDA Quality System Inspection or an AS9100 supplier surveillance audit, the file should contain a dated copy of the laboratory's current accreditation certificate from the accreditation body's directory, not from the laboratory itself; the full scope of accreditation document, with the parameters relevant to your work highlighted; the signed quality agreement, including decision rule disclosure language and out-of-tolerance notification SLA; internal supplier qualification audit records, including the questions above and the laboratory's written responses; and a periodic re-verification schedule, typically annual, that confirms the accreditation remains current and the scope still covers your needs.
This file is the procurement evidence layer that sits beneath the calibration certificates the laboratory delivers. The certificates are evidence of individual measurements. The procurement file is evidence that the relationship itself was qualified and is being maintained.
Frequently Asked Questions
How do you qualify a calibration provider for FDA or AS9100 procurement?
Regulated procurement of calibration services requires three things beyond a generic vendor checklist: independent verification of the laboratory's scope of accreditation through A2LA or ANAB directories, contract language that requires disclosure of decision rules on every certificate, and a defined out-of-tolerance notification SLA with documentation support for retrospective impact analysis. These elements form the procurement evidence file that supports FDA Part 820 supplier control and AS9100 clause 8.4 requirements.
How do you verify a calibration laboratory's scope of accreditation?
Scope of accreditation is verified through the public directory of the accreditation body, most commonly A2LA or ANAB in the United States. Search by the laboratory's certificate number, confirm the accreditation is current and unsuspended, and download the scope document. Match the parameter, range, and uncertainty on the calibration certificate against the documented scope. The accreditation body's directory is the source of truth, not the laboratory's marketing material.
What contract language should regulated buyers require from a calibration provider?
At a minimum, regulated procurement contracts should require the laboratory to disclose its decision rule on every calibration certificate in accordance with ISO/IEC 17025:2017 clause 7.8.6, and to notify the buyer of any out-of-tolerance result within a defined window, typically five business days. The notification should include as-found and as-left values, reference standard used, measurement uncertainty, and supporting documentation for the buyer's retrospective impact analysis.
Does FDA 21 CFR Part 820 require ISO/IEC 17025 accredited calibration?
FDA 21 CFR Part 820 does not strictly require ISO/IEC 17025:2017 accredited calibration. The regulation requires calibration traceable to national or international standards under 820.72. However, FDA inspectors increasingly expect accreditation as evidence of laboratory competence, particularly for measurements that affect product release decisions. Most regulated medical device manufacturers default to accredited calibration as a risk reduction measure.
What documentation should be in a calibration supplier qualification file?
A defensible supplier qualification file contains a dated copy of the laboratory's accreditation certificate from the accreditation body's directory, the full scope of accreditation document, a signed quality agreement with decision rule and out-of-tolerance notification language, internal supplier qualification audit records with the laboratory's written responses, and a periodic re-verification schedule. This file sits beneath the calibration certificates as evidence that the supplier relationship itself was qualified.
For organizations operating under FDA Part 820 or AS9100, working with a calibration laboratory that produces this evidence by default reduces both procurement effort and inspection risk. Tra-Cal Laboratories maintains ISO/IEC 17025:2017 accreditation with a publicly verifiable scope, applies documented decision rules on every certificate, and supports customer impact analyses when out-of-tolerance results occur. Request a calibration capability review to start the qualification conversation.