NDA and Quality Agreement for Contract Manufacturers

Introduction

Most contract manufacturing relationships run on one document. A master services agreement, or sometimes just a purchase order with terms on the back, containing a confidentiality clause of two paragraphs and a sentence reading something like "Supplier shall maintain a quality management system acceptable to Buyer." Both parties sign it, both parties file it, and neither reads it again until a lot fails or a drawing turns up at a competitor.

That single document is the mistake, and the regulator has said so in writing. FDA's guidance on quality agreements states plainly that quality agreements should not cover general business terms and conditions such as confidentiality, pricing or cost issues, delivery terms, or limits on liability or damages, and recommends that quality agreements be separate documents, or at least severable, from commercial contracts such as master services agreements or supply agreements.

The reason is not tidiness. An FDA investigator may ask to see your quality agreement during an inspection, and one welded into a supply contract means handing over your pricing. The two documents also answer completely different questions. The quality agreement answers who does what, and who decides. The NDA answers what the other party may do with what you told them. Mixing them produces a document that does neither job well and that nobody on either side can operate from.

This article gives you the structure of both, the clauses that actually determine whether they work, and the two or three lines whose absence quietly costs you a remedy you thought you had.

Who Is Required to Have One

If you make drugs, quality agreements are expected practice rather than a line in the regulation. FDA's November 2016 guidance covers commercial manufacturing and sets out what a quality agreement should contain. The same guidance makes the point that most buyers would rather not hear: no party to a quality agreement may delegate any of its responsibilities to comply with CGMP through the quality agreement or any other means. The paper divides the work. It does not divide the liability.

If you make medical devices, a written quality agreement is an explicit requirement. ISO 13485:2016 clause 4.1.5 says that where you outsource a process affecting product conformity you retain responsibility for conformity and must ensure control over it, that the controls are proportionate to risk, and that they include written quality agreements. That clause now reaches further than it used to in the United States, because FDA's Quality Management System Regulation took effect on 2 February 2026, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. If your knowledge of Part 820 is from the old Quality System Regulation, the written quality agreement requirement arrived with that change and is in force now.

If you make anything else, nothing legally obliges you. ISO 9001:2015 clause 8.4.3 gets close: you have to communicate to external providers the processes, products and services to be provided, the approval of products and services and of methods, processes and equipment and of the release of products and services, competence requirements including qualification of persons, the provider's interactions with you, the control and monitoring of its performance you intend to apply, and any verification or validation activities you or your customer intend to perform at the provider's premises. That is a quality agreement described in a sentence, and most machine shops have never been handed one.

The Five Sections

FDA says most quality agreements contain five sections, and the list is short enough to use as a table of contents.

Purpose and scope, covering the nature of the services to be provided. Name the products or part numbers, name the sites, and say what the contract facility is and is not doing.

Definitions, so that both parties agree on the precise meaning of terms. This looks like filler and is not. "Lot", "batch", "deviation", "critical", "significant change" and "release" all mean different things in different shops, and an argument about a deviation six months in is usually an argument about a definition nobody wrote down.

Resolution of disagreements, explaining how the parties will resolve disagreements about product quality issues or other problems. Not litigation. A named person on each side, a clock, and an escalation path.

Manufacturing activities, which FDA calls the most important element from a CGMP perspective. This is the body of the document.

Life cycle of, and revisions to, the quality agreement. Who can change it, how often it is reviewed, and what happens at termination. An agreement with no review date is an agreement describing a process that stopped existing two revisions ago.

Within manufacturing activities, the guidance breaks the work into six areas: quality unit activities, facilities and equipment, materials management, product-specific considerations, laboratory controls, and documentation. The format is open. Charts, matrices, narrative or a combination are all acceptable, and the only firm requirement is that the agreement clearly document which party is responsible for specific activities.

In practice the matrix wins. One row per activity, a column per party, and a third state for shared activities naming what each side does. The virtue of a matrix is that empty cells are visible, and a narrative hides the activity nobody claimed.

Change Control Is the Clause That Matters

If you write only one section of the quality agreement carefully, write this one, because every quality agreement failure anybody can actually remember was a change nobody was told about.

FDA's position is that either party may initiate a change, that some changes the owner should review and approve before implementation and others the contractor may implement without notifying the owner, and that how all changes are managed should be outlined in the agreement, including who performs the validation work the change requires. The guidance then lists the categories to address explicitly: components and their suppliers, establishment locations, manufacturing processes, products or product types sharing the same production line or equipment train or facility, testing procedures, major manufacturing equipment, shipping methods, the lot numbering scheme, container closure systems, and tamper evidence features.

Read that list as a buyer in any industry and most of it translates without effort. A sub-tier supplier change, a move to a different building, a new process, a different machine, a different test method, a different carrier, a different packaging. Every one of those is a thing a shop does on a Tuesday without thinking it concerns you, and every one of them has produced a field failure somewhere.

Three practical rules for the section.

Split the list into notify and approve. A change that needs your approval before implementation and a change that only needs telling you about are different obligations with different lead times. Lumping them together guarantees the important ones get treated like the trivial ones.

Put a number on the notice period. "Reasonable notice" is not a period. Thirty days before implementation for an approval-class change, with a longer window where requalification is involved, is workable for most shops and at least gives everyone something to be late against.

Say who validates. The most common gap is not the notification. It is that the change was notified, approved, and then nobody did the qualification work because each side assumed the other had it.

For medical devices this is not optional either: ISO 13485's outsourcing requirement is read to include the supplier telling you about changes to the device or service before they are implemented, which is the same clause with a different cover page.

Release, and Who Really Owns It

Be explicit about release, because the intuitive answer is wrong in a way that costs money.

The contract facility is responsible for approving or rejecting the product or results of its own manufacturing operations. The owner is responsible for approving or rejecting the drugs made by the contract facility, including final release, and in all cases the owner must not introduce adulterated or misbranded product into commerce. Two approvals, not one. The contract manufacturer releasing to you is not your release, and a quality agreement that gives the contract facility "release authority" without saying which release it means has created exactly the ambiguity you were trying to remove.

In an unregulated supply chain the same structure is worth copying. The shop accepts its own work against the drawing. You accept the lot against the purchase order. Those are different decisions on different evidence, and conflating them is how a certificate of conformance ends up treated as your incoming inspection.

The agreement should also say how and when the parties communicate, with named contacts on both sides, and it should give you audit rights covering both routine quality audits and for-cause visits. An audit right that exists only on paper because nobody set a notice period is a right you will not exercise in the week you need it.

What the NDA Is Actually For

The NDA has one job that a court will care about, and it is not stopping disclosure. It is establishing that you took reasonable measures to keep the information secret, which is part of the statutory definition of a trade secret: information the owner has taken reasonable measures to keep secret and which derives independent economic value from not being generally known and not being readily ascertainable by proper means.

That framing changes how you read your own template. The NDA is evidence. Signing one and then emailing unmarked drawings to a generic info@ address undercuts it, because the question a court asks is what you actually did, and the agreement is one item in that record alongside access controls, marking and who you let on the floor.

Six fields decide whether yours is worth anything.

The permitted purpose. Name it: evaluating and quoting, and if awarded, manufacturing a specific part or program. A purpose written as "evaluating a potential business relationship" permits almost anything and constrains almost nothing.

What counts as confidential. Marking is the cleanest test, but shops receive drawings by email, through portals and verbally on the phone. The standard fix is that written material is marked and anything disclosed orally is confirmed in writing within a stated window of days. Pick the window and keep it short.

Term and survival. This is where off-the-shelf templates quietly fail manufacturers. A flat five-year term is fine for a pricing discussion and disastrous for a process. If your competitive advantage is a fixture design or a heat treat recipe, you want confidentiality obligations surviving for as long as the information remains a trade secret, with a finite term only for the commercially sensitive material that genuinely goes stale.

Return or destroy on termination, with a carve-out. A shop cannot reach into a backup tape or strip your part number out of an ERP history, and a clause demanding it is a clause the shop breaches on day one. Allow archival copies retained under continuing confidentiality obligations.

Export control. An NDA is a contract between two private parties and it authorizes nothing under ITAR or the EAR. If the drawing is controlled technical data, the controls apply to who at the shop can see it and where its servers are, regardless of what either of you signed. Say so in the agreement, and say that the receiving party will not transfer the information to a foreign person without written authorization.

And the one line everyone leaves out, which is the next section.

The Notice That Preserves Your Damages

The Defend Trade Secrets Act contains a whistleblower immunity: an individual cannot be held criminally or civilly liable under federal or state trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a document filed under seal in a proceeding.

Attached to that immunity is a notice obligation. An employer shall provide notice of the immunity in any contract or agreement with an employee that governs the use of a trade secret or other confidential information. A cross-reference to a policy document setting out the employer's reporting policy for suspected violations satisfies it.

The penalty for omitting the notice is specific and is why this is worth a paragraph. If the employer does not comply, the employer may not be awarded exemplary damages or attorney fees in an action against an employee to whom notice was not provided. Exemplary damages under the DTSA can run to twice the award. Losing them, plus fees, for a missing paragraph is a bad trade.

Two details get misread. First, "employee" in this subsection includes any individual performing work as a contractor or consultant, so it reaches well past your own payroll. Second, the obligation attaches to agreements with individuals rather than to a corporate NDA with a contract manufacturing company. The cheap answer is to put the notice in every template that governs the use of confidential information and stop reasoning about which ones need it.

What Belongs in Neither

Several things routinely get drafted into one of these two documents and belong in the supply agreement.

Tooling ownership. Who paid for the die, who holds it, who maintains it, what happens to it on termination, and whether the shop may use it for anyone else. It is commercial and it is the single most expensive thing to have left vague.

Ownership of improvements. If the shop develops a better fixture or a faster process while making your part, who owns it. A clause assigning everything to the buyer is often why a good shop walks away from a program.

Price, payment and liability limits. FDA names these as things that do not go in a quality agreement.

Keep the stack to three documents, each doing one job: a supply agreement for commerce, an NDA for information, and a quality agreement for who does what and who decides. Reference each other by name and date, and make sure each one can be handed over alone.

Conclusion

The pair works when each document is narrow. The quality agreement names the activities, assigns each one, sets a change control list with notify and approve split out and a numbered notice period, says who releases and on what evidence, and gets reviewed on a schedule. It carries nothing about price, delivery terms or confidentiality, so it can be handed to an investigator intact. The NDA names a specific purpose, defines what is confidential and how it is marked, survives for as long as the trade secret does, allows archival copies, admits that it authorizes nothing under export control, and carries the DTSA immunity notice so that a future claim keeps its exemplary damages. Neither document moves responsibility: FDA's line about not being able to delegate CGMP obligations through a quality agreement is the sentence to remember, because the version of this most buyers are carrying is a single contract that quietly assumes the opposite.