Medical Device (ISO 13485 & FDA 510(k)) Engineering Outsourcing: Vetting NPD Firms, Design History Files & Hourly Rates

01The regulatory frame you are buying into

When you outsource design work on a medical device, you outsource activities, not responsibility. The manufacturer of record answers to FDA for design controls whoever did the engineering.

• 21 CFR Part 820 and the QMSR. FDA's Quality Management System Regulation replaced most of the old Quality System Regulation text by incorporating ISO 13485:2016 by reference, effective February 2, 2026. In practice, design and development planning, inputs, outputs, review, verification, validation, transfer and change control now follow ISO 13485 clause 7.3, with FDA-specific additions kept in Part 820.
• The design file. What US teams have long called the design history file (DHF) is, under ISO 13485, the design and development file. Either name, it must show that the device was developed under the plan and that outputs meet inputs. If your partner keeps it on their servers in their format, you do not really have it.
• 510(k) premarket notification. Most Class II devices reach the market through a 510(k) showing substantial equivalence to a predicate. The submission draws directly on the design file: bench testing, software documentation, biocompatibility, electrical safety and risk management.
• Supporting standards. ISO 14971 for risk management, IEC 62304 for device software life cycle, IEC 60601-1 for electrical safety of medical electrical equipment, and IEC 62366-1 for usability engineering are the usual set an electromechanical program must plan for.

Purchasing controls (ISO 13485 clause 7.4) mean your NPD firm is a supplier you must evaluate, approve and monitor. Treat the selection as a supplier qualification, not a design contest.

02Vetting an NPD firm: what to ask before you compare rates

Ask for evidence, not slide decks. A firm with a working quality system can answer each of these in a day.

1. Certificate scope. Ask for the ISO 13485 certificate and read the scope line. Design and development of medical devices should be in it. A certificate covering only contract manufacturing does not cover your design work.
2. Sample design-control artifacts. Ask for a redacted design plan, a traceability matrix and a design review record from a past program. Look for linked inputs, outputs and verification IDs.
3. Tooling for the file. Which eQMS or PLM holds the records, and can you export the full file with signatures and audit trail in a neutral format at any time?
4. Software process. For any device with firmware or an app, ask for their IEC 62304 software development plan template and how they assign software safety class.
5. Risk file ownership. Who chairs risk management meetings under ISO 14971 and who signs the risk management report.
6. People. Ask for the named roles on your program and the share of hours senior staff will bill. Ask how staff changes are notified.

Score answers on a simple 0-2 scale per item. A firm scoring below 8 of 12 tends to cost more later, whatever its rate. For the contract itself, the RFP and MSA scope builder generates the clauses below.

03Delivery models compared for a regulated program

Most device companies mix models. The question is which work sits where, and who holds the pen on the design file.

A common pattern that holds up in audits: the NPD firm leads architecture and design verification, a contract engineer inside your QMS owns traceability and risk, and offshore resources handle drawing cleanup and tolerance stack documentation under your review.

04Cost model: a Class II electromechanical device, worked through

Take a Class II handheld device with a motor, a sensor board and embedded firmware, heading to a 510(k). Assume the firm quotes 2,400 engineering hours across concept, design, design verification and transfer.

• Turnkey firm at $165/hr: 2,400 x $165 = $396,000. Add a typical 10% change-order allowance between phases: $39,600. Planned total about $435,600.
• Hybrid model: the firm takes 1,500 hours at $165 = $247,500. A contract engineer from a staffing agency takes 600 hours of traceability and risk work at a $105/hr bill rate = $63,000. Offshore bureau takes 300 hours of CAD documentation at $18/hr = $5,400, plus 18% internal review overhead = $972, so $6,372. Hybrid total: $316,872, before your own project management time.

The hybrid saves about $118,700 on paper, but only if your team has the capacity to coordinate three suppliers and own the design file. If it does not, the turnkey number is the honest one.

Two tax points change the comparison. Under Section 174A, domestic research and experimental spend can be deducted in the year paid, while foreign R&E is amortized over 15 years. And US contractor spend can count toward the Section 41 credit at 65% where you retain substantial rights and bear the risk of failure. On $247,500 of qualifying US contract research, that is $160,875 of qualified research expense; at a typical 7.9% net federal credit rate, about $12,709. Model both with the R&D credit and Section 174 calculator.

05Contract clauses that protect the design file

The master services agreement and the quality agreement are separate documents. Sign both before the first design review.

Ask whether the firm's rate card escalates mid-program and cap it for the program duration. Many contracts allow annual uplifts that hit a long program twice.

06Warning signs in an NPD proposal

Read the proposal as an auditor would. These patterns show up often enough in buyer reviews to deserve a direct question each.

• Verification bundled into design hours. Design verification is a separate, protocol-driven activity. If the proposal folds it into a single design line, you cannot tell whether test protocols, reports and traceability are priced at all.
• No line for risk management. ISO 14971 work runs through every phase. A proposal with no hours for hazard analysis, FMEA updates and the risk management report has either left it to you or will add it later as a change order.
• Software priced as a lump. Firmware for a device with a software safety class above A carries documentation that can equal the coding effort. Ask for the IEC 62304 deliverables list with hours against each.
• Testing lab fees excluded without an estimate. Electrical safety, EMC and biocompatibility testing are third-party costs. Ask for an estimate range so your budget is complete.
• Senior staff named, junior staff billing. Ask for the planned hour split by role and a right to approve substitutions.

None of these is a reason to reject a firm. Each is a reason to get the number in writing before you sign.

07Phased checklist from supplier selection to design transfer

Phase 1: Before signing

• Confirm ISO 13485 certificate scope covers design and development.
• Run the 12-point vetting score; get two quotes on the same scope.
• Agree the design and development plan template and who approves it.

Phase 2: Design inputs and architecture

• Inputs reviewed and signed in your system, not only theirs.
• Risk management plan under ISO 14971 approved; software safety class set under IEC 62304.
• Predicate device and 510(k) testing strategy written down.

Phase 3: Design outputs and verification

• Traceability matrix updated at every design review.
• Verification protocols approved before testing starts; test labs booked early for IEC 60601-1.
• Monthly export of the design file to your vault.

Phase 4: Validation and transfer

• Usability validation per IEC 62366-1 where required.
• Design transfer to the contract manufacturer with a released device master record.
• Final file export and supplier performance review for your approved supplier list.

If you are building out a Boston-area team, see the Massachusetts medtech procurement guide for local rate context.

08Run the numbers: engineering staffing agency vs. CAD/FEA outsourcing TCO calculator

The same benchmarks as this sheet, with your inputs. Share link and printable brief open the full calculator page.