ISO 13485 and ISO 9001 Inside a Third-Party Ultrasound Repair Workflow (2026)

1. Start with the denominator

A random FDA warning letter is not a device quality-system letter. A random MAUDE row is not a probe-repair failure. A random recall-string hit is not independent-servicer causation. Buyers who skip the denominator narrate the wrong industry.

Warning letters: 3,643 is not 220, and 220 is not 92

The public warning-letter index used for this report holds 3,643 letters spanning calendar years 2021 (689), 2022 (691), 2023 (608), 2024 (569), 2025 (733), and 2026 through the 30 July 2026 index cut (353). 2026 is a partial year. Year-to-year movement in that series is a publication-volume fact, not a device-QMS trend ⁹.

Issuing-office head in the same index:

CDRH is 6.0% of the file (220 / 3,643). Tobacco Products alone is 33%. A briefing that opens with “FDA has been sending warning letters about servicing” without this table has already chosen the wrong population.

Subject line is the second cut. Exact CGMP/QSR/Medical Devices/Adulterated appears 92 times. A broader device-quality screen — QSR, 21 CFR 820, or quality-system language plus device language — yields 125. Investigational-device / PMA adulterated-device subject lines number 40; “IDE” or “PMA” anywhere in the record, 101. The subject-line head of the whole 3,643 is tobacco (1,186), finished-pharmaceutical CGMP (339), and foreign-supplier verification (315). Device QSR is a minority sport even inside FDA’s published enforcement letters ⁹.

That is the first finding a quality agreement should absorb: FDA’s published warning-letter stream is not a ranking of independent ultrasound ISOs. It is mostly tobacco, drugs, food, and imports.

The “servicing” keyword is a false-positive machine

A keyword screen of the same 3,643 for servic / reprocess / remanufactur / repair returns 33 letters. Do not brief that number as “33 servicer warning letters.” Read the names.

Food and catering “service”:

• Rio Verde Food Service Inc., 27 February 2026, Human Foods Program, seafood HACCP / food CGMP / insanitary conditions ¹³.
• Rash Catering Services, LLC, 22 April 2024, Division of Southwest Imports, FSVP / seafood HACCP ¹⁴.
• Key Foods Co. dba Key Food Services, 27 June 2024, Division of Northern Border Imports, Foreign Supplier Verification Program ¹⁵.
• Appleton City Feed Service LLC, 1 November 2023, medicated-feed CGMP ¹⁶.

Telehealth and retail “Services”:

• D&H Medical Services, 8 June 2026, CDER, false and misleading claims / misbranded (telehealth) ¹⁷.
• Ivim Services LLC, 20 February 2026, CDER, same telehealth subject family ¹⁸.
• Smart Vending Services, LLC, 7 April 2026, Center for Tobacco Products ¹⁹.
• Twinroll Service AB, 3 April 2024, tobacco ²⁰.
• GSM Services, LLC, 17 May 2023, tobacco ²¹.

Compounding and pharmaceutical “Services”:

• Empower Clinic Services, LLC dba Empower Pharmacy, 2 April 2025, compounding pharmacy / adulterated drug products ²².
• Empower Clinic Services, LLC dba Empower Pharma, 2 April 2025, same family ²³.
• Fagron Compounding Services, LLC dba Fagron Sterile Service, 19 December 2024, compounding ²⁴.
• Central Admixture Pharmacy Services, Inc., letters dated 10 July 2024, 25 March 2024, and 29 March 2024, compounding / drug CGMP ^{25 26 27}.
• Optum Infusion Services 308 LLC, 13 December 2022, compounding ²⁸.
• CDL Services, Inc. DBA Technichem, 24 November 2025, finished-pharmaceutical CGMP ²⁹.
• NWL Netherlands Services B.V., 1 April 2025, finished-pharmaceutical CGMP ³⁰.
• BRS Analytical Services, LLC, 17 September 2025, finished-pharmaceutical CGMP ³¹.
• Chemical Services Group, Inc. / Royal Chemical Company, 5 April 2023, finished-pharmaceutical CGMP ³².
• Homeopathic Educational Services, 25 August 2025, unapproved ophthalmic drugs ³³.

Other “service” strings that are still not imaging ISOs: New Life Medical Services (CBER / biologics, 24 September 2025) ³⁴; Midland Vet Services (CVM, 30 November 2023) ³⁵; J&H Imports Services Corp (FSVP, 13 March 2023) ³⁶.

The device-reprocessing letter that actually belongs in a quality-system conversation is ReNovo, Inc. DBA Provision Device Reprocessing Solutions, 13 October 2023, CDRH, subject CGMP/QSR/Medical Devices/Adulterated. ReNovo is a reprocessor and distributor of reprocessed single-use devices — electrosurgical ablation wands, ENT coblators, trocars, burs, drill bits, surgical saw blades — not an ultrasound probe shop. FDA’s QSR findings there include failure to control nonconforming product (21 CFR 820.90(a) as then numbered) after failed air-particulate testing, and failure to control environmental conditions (820.70(c)) in a reprocessing room whose particulate procedure had not set acceptable levels. The same letter also alleges introduction of additional OEM models by letter-to-file without a new 510(k), because smaller lumens and different tip geometries presented a more challenging cleaning and re-sterilization scenario than the cleared models ^{37 38}.

That is a reprocessor letter. It is useful because it shows FDA writing down the controls this report will map onto a repair floor — nonconforming product, environment, and “you changed the object enough that the old clearance does not cover it.” It is not an ultrasound ISO ranking, and it is not 33 of anything.

The QSR letters that did issue are manufacturers and specification developers

Widen from the noisy keyword to the 125 QSR-device-ish letters and the 92 exact CGMP/QSR/Medical Devices/Adulterated subjects, and the named firms in the 2025–2026 sample are manufacturers, specification developers, and contract manufacturers. They are not independent ultrasound ISOs.

A non-exhaustive public sample, all CDRH, all QSR/device subject lines:

The finding is the empty cell you cannot fill: FDA’s published QSR letters in this sample rarely name third-party imaging ISOs. That is consistent with the 2024 remanufacturing guidance, not a discovery that independent shops are perfect. Firms that only service are generally outside manufacturer registration, and therefore outside the inspection population that produces most of these letters ^{6 8}. Absence of a letter is not a quality system.

The letters that do exist are still usable — as manufacturer quality-system examples of the controls this report will demand on a repair floor. ZOLL’s CAPA finding is about failing to escalate “no fault found” / “no product returned” / “user attempted repair” codes that hid a recurring ventilator problem ³⁹. Medline’s CAPA finding is about actions not commensurate with a dFMEA severity (air embolism) after hundreds of disconnection complaints ⁴⁰. Philips Ultrasound’s purchasing finding is about an internal complaint-handling contractor that was not on the approved-supplier list and had no documented evaluation against quality requirements ⁴¹. Abbott’s design-transfer finding and Flextronics’s process-validation finding are two ends of one specification-developer / contract-manufacturer relationship ^{42 43}. None of those firms is an independent ultrasound ISO. All of those findings have a repair-floor analogue: if your partner codes every comeback as “no fault found” and never opens a nonconformance, you have ZOLL’s trending problem in miniature. If they cannot show how a purchased board or a purchased service was qualified, you have Philips’s 820.50 problem in miniature.

ZOLL’s and Medline’s 2026 letters also contain a transition sentence that matters for anyone still quoting 1996 clause numbers. Inspections that closed in 2025 were conducted under the Quality System regulation then in force. Corrective actions proposed after 2 February 2026 must be pursuant to the QMSR ^{39 40 5}. The clause numbers in those letters (820.50, 820.90, 820.100) are the old map. The QMSR map is ISO 13485:2016, plus FDA-specific overlays for reporting, tracking, and unique device identification ^{3 4 64}.

MAUDE: 7,618 diagnostic-ultrasound reports, not a repair-failure rate

MAUDE is a reporting database. It is not a fleet census, a failure-rate engine or a servicer-attribution file. This extract of the yearly event files, export date 8 June 2026, has no serial or catalog columns. The report therefore uses a reproducible diagnostic-imaging subset: FDA product codes IYN (ultrasonic pulsed Doppler imaging system), IYO (ultrasonic pulsed echo imaging system) and ITX (diagnostic ultrasonic transducer) ^{10 65 74 76 78}.

The diagnostic subset rises from 686 reports in 2020 to 1,895 in 2024, then 1,688 in 2025; 2026 is partial. There is no install-base or scan-volume denominator. The chart describes reporting volume, not a change in failure probability.

Event type among the 7,618 diagnostic-imaging reports:

Death 31 is not a probe-repair mortality statistic. The extract has no narrative, no device-problem code in this cut and no field that says “third-party repair.” A death-coded row is a report associated with a diagnostic-ultrasound product code, not proof that an independent shop caused the event.

Brand is blank on 41 of 7,618 rows (0.54%). Manufacturer is blank on 787 (10.3%). Those are identity holes, not a ranking of shops. They reinforce the work-order control this report demands: the private service record must carry the specific asset identity that this public extract cannot supply ¹⁰.

Product codes: the “ultrasound-related” slice is not a diagnostic-probe file

The broader sensitivity screen that produced 68,501 rows is a union: product code in an ultrasound-related classification set, or an ultrasound / transducer string. It is retained here to show why the narrower 7,618-row diagnostic subset is necessary. Mixing all 68,501 into one “probe failure rate” is a grain error. The head of the broad screen:

LFL alone is 34% of the 68,501 (23,340). It is a surgical ultrasonic instrument code — Harmonic-style shears and related devices — not a diagnostic imaging probe. ODG is endoscopic ultrasound. PSV is an ultrasound bronchoscope. GEI is electrosurgical accessories. The diagnostic transducer/system trio used for the report’s core MAUDE analysis is IYN + IYO + ITX = 7,618, or 11.1% of the broad screen ^{10 76}.

Further down the same head, still not “the probe”: EOQ (bronchoscope, flexible or rigid, 21 CFR 874.4680) appears 659 times, often as a subsequent code on endoscopic ultrasound systems ^{79 80}. NLQ is the reprocessed single-use ultrasonic surgical instrument code that sits next to LFL in FDA’s own classification definition ⁸¹. ELC, LOF, FEO, DXO, FCG, and DRS contribute another several thousand rows; name them from FDA’s product-code classification database before you brief them as diagnostic-probe events ⁸².

The honest use of this table is methodological. You cannot compute a diagnostic-probe failure rate, a third-party-repair failure rate, or a disinfection-failure rate from either 68,501 or 7,618. You can say that the broad screen is dominated by other device families and that 94.7% of the diagnostic-code subset is coded as malfunction; you cannot assign those reports to a repair shop.

If you want the probe-specific infection-control half of the story — inspect-before-you-disinfect, covers, automated reprocessors — that is a different report: Ultrasound Probe High-Level Disinfection 2026. This article does not retell that cycle. It owns the quality-system evidence a buyer can demand after the probe has already left clinical use.

Recalls: 58,785 rows, 1,157 ultrasound-string hits, 276 QSR-string hits

The current recall extract holds 58,785 product-level rows. An ultrasound-string hit returns 1,157. A QSR-string hit returns 276. A laser-regex hit returns 65. Those are string counts, not rates, not root-cause taxonomies, and not servicer causation ⁸³.

Use the recall file here as a third public denominator, not as a fourth way to rank shops. A QSR-string hit on a recall row means the reason text or a related field mentioned quality-system language. It does not mean an independent ISO caused the recall. It does not mean a manufacturer’s QSR letter “explains” the 1,157. The files are adjacent, not nested.

2. Servicing is not remanufacturing

The quality agreement has to use FDA’s words, not the shop’s brochure.

The 10 May 2024 guidance

FDA issued final guidance, Remanufacturing of Medical Devices, on 10 May 2024, for industry, entities that perform servicing or remanufacturing, and FDA staff. The docket is FDA-2018-N-3741. The PDF is the 10 May 2024 document whose draft dated to 24 June 2021 ^{6 84 85}.

Two definitions, in the Agency’s public language:

• Remanufacturing is the processing, conditioning, renovating, repackaging, restoring, or any other act done to a finished device that significantly changes the finished device’s performance, safety specifications, or intended use ^{7 8}.
• Servicing is the repair and/or preventive or routine maintenance of one or more parts in a finished device, after distribution, for purposes of returning it to the safety and performance specifications established by the OEM and to meet its original intended use ^{7 8}.

FDA’s 9 May 2024 press announcement adds the enforcement posture: the Agency determines whether the specific tasks performed on the device constitute remanufacturing according to the FD&C Act and its implementing regulations, not according to an entity’s self-identified designation as a “remanufacturer” or a “servicer” ⁷. Calling the work order “service” does not make it servicing. Changing intended use, or significantly changing safety or performance specifications — including, FDA has said in the associated webinar materials, improvements and enhancements — is the analysis ^{86 87}.

Third-party servicers, in the press announcement’s language, are entities other than the manufacturer or the healthcare delivery organization using the device that maintain, restore, refurbish, repair, or service a finished device after distribution for purposes of returning it to OEM safety and performance specifications and original intended use. The Agency continues to treat proper servicing as critical to the total product life cycle. The guidance is written to remove a perceived barrier to repair that does not alter safety, performance, or intended use — Jeff Shuren’s quoted line on issuance day ⁷.

What that means for registration, QMSR, and the quality agreement

Servicers who only service are generally not required to register as manufacturers. Remanufacturers are. That sentence is the reason Section 4’s establishment file has no independent-servicer type, and the reason Section 1’s QSR-letter sample is a manufacturer sample ^{6 8 11 88}.

QMSR applies to finished-device manufacturers who intend to commercially distribute medical devices. FDA’s QMSR page defines a finished device, at 21 CFR 820.3, as any device or accessory suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized. Accessory manufacturers can be in scope. An independent shop that returns a hospital’s own console or probe to OEM specification, and does not commercially distribute a significantly changed finished device, is not automatically a QMSR manufacturer ^{5 64 89}.

That is not a permission slip to run a garage. It is a jurisdiction map. The hospital still has Conditions of Participation that require maintained equipment ⁹⁰. HTM still has equipment-management practice, including ANSI/AAMI EQ89:2015 (R2023), which exists to identify maintenance strategies for medical equipment in healthcare facilities — a hospital-side document, not a substitute for ISO 13485 on a repair partner ^{91 92 93}. The quality agreement is how the hospital or ISO imports manufacturer-grade controls onto a partner who is not, as a default, inside 21 CFR 807 manufacturer registration ⁸⁸.

If the partner does remanufacture — significant change to performance, safety specifications, or intended use — they step into manufacturer obligations: quality system, registration and listing, adverse-event reporting, and, where the change requires it, a new premarket submission. ReNovo is the worked example of “the object changed enough that the old 510(k) does not cover the new models,” written against 21 CFR 807.81(a)(3)(i) and FDA’s own change-to-existing-device guidance ^{37 38 94}. A board swap that returns a console to the OEM performance envelope is not that fact pattern. A firmware change that alters a safety specification, or a probe modification that changes intended use, can be.

The 2018 FDA report to Congress on the quality, safety, and effectiveness of servicing, and the later discussion paper on evaluating whether activities are servicing or remanufacturing, are the policy background the 2024 guidance closes. This article does not re-argue that docket. It uses the final 2024 line as the quality-agreement line ^{95 96 97}.

Repair does not restore a disinfection validation

One more bright line, because procurement keeps trying to buy it. A repaired probe is a testable physical object. The hospital’s validated cleaning and disinfection or sterilization instructions remain the OEM’s, in the probe IFU, for the hospital’s own reprocessing program. Independent repair does not re-run that validation, does not certify the hospital’s chemistry, and does not convert a cracked lens into a disinfected device. Rongtao does not provide clinical high-level disinfection. The integrity stop before disinfection is documented in the HLD report; the economic fork once the probe has failed is in repair versus replace. This paper’s job is the quality-system file that should exist between those two decisions.

3. What ISO 13485 and ISO 9001 change on the floor

ISO 13485:2016 is Medical devices — Quality management systems — Requirements for regulatory purposes. ISO’s public product page states the standard’s job: a QMS that can be used by an organization involved in one or more stages of the medical-device life cycle, including design and development, production, storage and distribution, installation, servicing, and final decommissioning, or provision of associated activities ^{1 98}. That sentence is why a repair partner invokes 13485. It is also why the invocation is a claim, not a legal transformation: ISO 13485 is a manufacturer standard. A third-party shop that holds a certificate is saying its scoped activities are run under manufacturing-equivalent controls. The certificate does not make the shop an OEM, does not put it inside QMSR unless it is a manufacturer or remanufacturer, and does not authorize the brands on the workbench ^{1 5}.

ISO 9001:2015 is the generic QMS standard. Its public scope is any organization that needs to demonstrate consistent products and services meeting customer and applicable statutory and regulatory requirements. It is not device-specific. It is weaker than 13485 on medical-device purchasing, traceability, sterile barrier, advisory notices, and regulatory reporting language. Holding both is a stacked claim: generic process discipline plus device-regulatory QMS. The 2015 edition remains the certified edition on walls in 2026 even as ISO’s 9001 revision process (DIS / FDIS) runs in parallel; the certificate in the receiving packet is 9001:2015 until the shop is recertified to a later edition ^{2 99 100}.

Do not paste the copyrighted standard. Cite the product page and the preview. Map clause numbers to floor artifacts. The five clauses that earn their place in a repair quality agreement are 4, 7.4, 7.5, 8.3, and 8.5 ^{1 98}.

QMSR’s incorporation by reference is the US legal reason those clause numbers now matter to manufacturers. FDA determined that ISO 13485’s requirements, taken in totality, are substantially similar to the old QS regulation. The Agency added FDA-specific overlays so the incorporation would not conflict with the FD&C Act: unique device identification (21 CFR 830) against identification, medical-device tracking (21 CFR 821) against traceability where it applies, and medical-device reporting (21 CFR 803) against reporting to regulatory authorities. Where ISO 13485 conflicts with the Act, the Act controls ^{3 4 5 64 101 102 103}. ISO 9000:2015 clause 3 (terms) is also incorporated, with FDA’s own definitions winning conflicts ^{5 104}.

FDA’s Regulatory Flexibility analysis in the final rule is the public small-entity document: thousands of very small domestic device establishments were estimated to bear a one-time switch cost, while establishments already running both the old QS regulation and ISO 13485 were estimated to save the dual-compliance burden. That analysis is about manufacturers, not about independent servicers ^{3 105}. FDA’s QMSR FAQ is the companion plain-language page: effective 2 February 2026; inspections after that date use a new process (compliance program 7382.850) rather than QSIT; investigators may review QMS records created before the effective date; the old 820.180(c) inspection exceptions for management review, quality audits, and supplier audit reports are not maintained ^{64 5}.

For a hospital contracting an independent ultrasound shop, the practical translation is: you are not inspecting them under 7382.850 unless they are a manufacturer you are not. You are writing a quality agreement that borrows the same artifacts those inspections look for.

Clause 4 — QMS and records: the certificate is a scope claim

Clause 4 is the documented system: quality manual or equivalent, medical-device file, control of documents, control of records. On a repair floor the demandable artifacts are boring, and that is the point.

• The certificate (ISO 13485:2016, and ISO 9001:2015 if claimed), current, from a named certification body, with a scope statement that actually covers the work you are buying — probe repair, board repair, parts distribution, installation, or some subset. A 13485 certificate scoped to “manufacture of disposable drapes” does not cover a TEE repair line ^{1 12}.
• A quality manual or process map that names receiving, identification, measurement, nonconformance, and release as documented processes, not as slogans.
• Record retention that survives the warranty. A typical 90-day hardware warranty is not a records policy. If the serial comes back at day 89, the original receiving photos, test traces, and release signature have to still exist ¹².

FDA’s QMSR FAQ on pre-effective-date records is the manufacturer analogue: the system is the records, including old ones ⁶⁴. A shop that cannot produce last quarter’s work-order file is not “ISO.” It is a PDF on a wall.

Clause 7.4 — purchasing: the part and the subcontractor are the product

Clause 7.4 is purchasing controls: evaluate suppliers, specify requirements, verify purchased product. The old QSR number was 21 CFR 820.50. The letters in Section 1 are the field manual.

Philips Ultrasound’s 9 September 2025 letter is the ultrasound-named example, and it is a manufacturer letter. FDA’s first numbered QSR observation is failure to ensure purchased products and services conform to specified requirements. The purchased “product” was an internal complaint-handling and MDR contractor (GCHO / QES). The Manage Supplier Quality procedure defined internal service suppliers as suppliers, then was not implemented: no documented evaluation of the contractor’s ability to meet quality requirements, no defined type and extent of control, the contractor not on the approved-supplier list, no agreement to notify of service changes that might affect finished-device quality ⁴¹. Translate that onto an independent repair partner without turning it into an OEM ranking: if the shop outsources winding, crystal replacement, sterilization of a subassembly, calibration, or even complaint intake, those names belong on an approved-supplier list with a quality requirement and a change-notice clause. A quality agreement that is silent on subcontractors has purchased an unknown QMS.

ZOLL’s 30 April 2026 letter makes the same 820.50 point on two suppliers that FDA said were miscategorized below the procedure’s criticality level, and on a missing supplier change-control agreement for software used in complaint investigation ³⁹. Abbott’s 23 January 2026 letter is design transfer of FreeStyle Libre 3 performance specifications to third-party manufacturers — the specification-developer end of purchased manufacture ⁴². Flextronics America’s 27 January 2026 letter is the contract-manufacturer end of a related sensor line: process validation (old 820.75(a)) where operators were making undocumented equipment adjustments after observed sensor damage ⁴³. Together they are a worked example of purchased production. A repair shop that buys boards, crystals, cables, or whole assemblies without incoming criteria is running the same gap at smaller scale.

The parts-specific half of purchasing — origin, counterfeit risk, incoming qualification — is documented in Rongtao’s parts provenance report. This article does not retell that taxonomy. It needs one sentence from it: the replacement part is a purchased product under 7.4, whether it is OEM-surplus, harvested, or newly manufactured. A receiving inspection that is “opened the box, looked fine” is not 7.4.

Demandable artifacts:

• Approved-supplier list, or equivalent, covering parts and outsourced processes.
• Purchasing specifications: model, revision, test criteria, packaging, documentation to accompany the lot.
• Incoming verification record tied to the work order.
• A change-notice obligation: the partner tells you when the part origin, the test method, or a subcontractor changes.

Clause 7.5 — production and service provision: identity, measurement, release

Clause 7.5 is where a repair actually happens: identification, traceability, preservation, process control, servicing activities, monitoring and measurement. Old QSR neighbours include 820.70 (production and process controls), 820.80 (receiving, in-process, and finished-device acceptance), 820.86 (acceptance status), and the manufacturer-servicing provisions that used to live at 820.200. Under QMSR those numbers collapse into the ISO clause plus FDA overlays for identification, tracking, and reporting ^{89 101 102 103}.

I'll use eCFR 820 as [89] already and 803 as [102].

Identity is the control MAUDE’s blank fields make visible. A work order that cannot carry model, serial, software version where relevant, customer, date received, reported fault, and disposition is not a 7.5 record. This MAUDE extract cannot even offer serial or catalog as a completeness check ¹⁰. That absence is a limitation of the extract. It is also a reminder: if the public safety file is thin on identity, the private service file has to be thick.

Measurement is the control the letters keep finding missing in manufacturing, and that a repair buyer can specify in one line: what was measured, on what equipment, with what pass/fail, before release. Medline’s 25 March 2026 letter includes a production-equipment maintenance finding (old 820.70(g)(1)): visible particulate on the tops of cleanroom machines, cleaning forms that did not require the tops, and about 114 foreign-matter complaints ⁴⁰. Exactech’s 19 December 2025 letter is process controls that did not define specifications and testing for polymer powder used in molded implants ⁴⁵. Flextronics is undocumented equipment settings on a process whose output could not be fully verified later ⁴³. The repair analogue is a bench whose leakage tester, scope, or real-machine fixture is out of calibration, or a “tested OK” tick with no trace.

Rongtao’s stated measurement practice is a 48-hour real-machine test before shipment, with photos or videos where applicable, on a floor with hundreds of ultrasound testing platforms, 35+ engineers, and 3,000+ parts SKUs. That is a client proof point, not a regulatory finding. It is the kind of artifact clause 7.5 makes demandable: a named test, a duration, a link to the serial, evidence the customer can file ¹².

Release is acceptance status. A unit that is still in quarantine cannot ship because someone in sales promised Friday. 3B Medical’s 20 May 2026 letter, among manufacturer issues on a sleep-therapy device, includes failure to submit a 21 CFR 806.10 report within 10 working days of initiating a correction or removal — a firmware update that could cause unexpected shutdown ^{46 47}. The repair analogue is smaller and still real: if you released a serial you later discovered had failed a test, the quality agreement needs a notification path. It does not need the shop to file an 806 report unless they are a manufacturer conducting a correction or removal of a commercially distributed device.

Demandable artifacts:

• Work order with identity fields complete.
• In-process and final test record, equipment identification, pass/fail, operator.
• Acceptance status on the unit (quarantine / in-test / released / scrapped).
• Pack-out preservation: probe lens protection, ESD for boards, humidity and shock where the IFU or the shop’s own procedure requires it.
• Turnaround that is a process output, not a slogan. Rongtao’s stated standard is 5–8 business days, which is a capacity claim you verify on actual orders, not a quality-system exemption ¹².

IEC 62353 exists as the recurrent-test and test-after-repair standard for medical electrical equipment. It is a hospital-side and service-side test method family, not a substitute for ISO 13485, and not a claim that every ultrasound probe is an 62353 object. Cite it as the public document HTM already knows; do not pretend it is the QMS ¹⁰⁶.

Clause 8.3 — nonconforming product: quarantine is a process, not a shelf

Clause 8.3 is control of nonconforming product: identify it, segregate it, decide what happens, record the decision. Old QSR: 21 CFR 820.90.

ReNovo’s first QSR observation is the textbook: air-particulate testing failed; the firm did not initiate a nonconforming-product report to assess product impact; a CAPA on the compressor also did not assess product impact ³⁷. BMC Medical’s 20 May 2026 letter is the complaint-side cousin: seven of eleven reviewed complaint records were cancelled even though they met the firm’s own definition of a complaint (any communication alleging deficiencies in identity, quality, durability, reliability, safety, effectiveness, or performance after release) ⁴⁸. ZOLL’s CAPA observation is the trending cousin: “no fault found,” “no product returned,” and “user attempted repair” codes kept recurring ventilator complaints out of the CAPA threshold, including after a Class I recall CAPA had been closed as effective ³⁹.

On a repair floor the objects are a cracked lens that arrived that way, a board that failed the outgoing test, a part that failed incoming, a serial that came back inside warranty. If those objects do not enter a nonconformance record with a disposition (rework, return to customer as-is with documented concession, scrap, use-as-is with documented rationale), clause 8.3 is not implemented. “We’ll try again” is not a disposition.

Demandable artifacts:

• NCR / deviation log keyed to serial or lot.
• Physical or system quarantine distinct from released stock.
• Disposition authority named in the quality agreement (who may concession a cosmetic housing mark; who may not concession a failed leakage test).
• Feedback into purchasing (7.4) and improvement (8.5) when the same part or the same fault repeats.

Clause 8.5 — improvement: CAPA is not a binder

Clause 8.5 is improvement, including corrective action and preventive action. Old QSR: 21 CFR 820.100.

Medline’s first observation is CAPA not commensurate with risk: CAPA-01872 opened after an increase in NAMIC syringe/manifold disconnection complaints attributed to excess silicone; the health-hazard evaluation called the risk low while the dFMEA identified air embolism as the highest-severity issue for loose connections; corrective action was scrap of inventory plus more frequent machine cleaning; 221 complaints and 177 MDRs later, including one air-injection MDR and one clinician biohazard-exposure MDR; post-correction complaints-per-million still exceeded the effectiveness threshold for three quarters; FDA’s letter records that the firm later closed the CAPA, opened another, and moved from a field-notice plan to a removal ⁴⁰. Contec’s 2 October 2025 letter is CAPA with causes not adequately investigated, actions not documented, a preventive action dated after CAPA closure, and effectiveness verification that had not confirmed customers understood an open recall ⁴⁴. ZOLL is CAPA procedure not followed, including a CAPA request rejected as a first-time event despite a severity that the firm’s own SOP said required CAPA ³⁹.

A third-party ultrasound shop will not have Medline’s complaint volume. It will have comebacks, in-warranty failures, and “no fault found” returns. The quality agreement should require: a threshold for opening a corrective action (for example, repeat failure of the same board SKU, or any safety-relevant test escape), root-cause discipline that does not stop at “customer misuse,” and an effectiveness check that is not “we trained someone.”

ISO 14971 is the risk-management standard ISO 13485 points at. A repair partner is not required to rewrite the OEM’s risk file. They are required not to silently change the risk profile of the object they return. That is the remanufacturing line again ^{107 6}.

ISO 9001 on the same floor

Map 9001:2015 without pretending it is 13485. Clause 8.4 (control of externally provided processes, products and services) is the generic twin of 13485 7.4. Clause 8.5 (production and service provision) is the generic twin of 7.5. Clause 8.7 (control of nonconforming outputs) is the generic twin of 8.3. Clause 10 (improvement) is the generic twin of 8.5 ². What 9001 will not give you, by itself, is medical-device regulatory language, sterile-barrier process, advisory-notice, or the traceability intensity 13485 expects for implantable and other specified devices. For ultrasound board and probe repair, 9001 without 13485 is a process certificate. 13485 without a scope that names the repair activity is a different company’s certificate. Demand both the standard and the scope ^{1 2}.

Rongtao holds both, with certificates published on the live site ^{12 108 109}. That is evidence of a scoped QMS. It is not OEM authorization, not a 99% success rate, and not a substitute for the work-order artifacts above.

4. What FDA establishment listing will not tell you

FDA’s establishment registration and device listing file is a manufacturer-and-importer instrument. It is not a servicer directory.

The extract used for this report holds 419,651 establishment-type rows (export 22 July 2026). There is no type called independent servicer, ISO, depot repair, or HTM contractor. The exclusive-label head ^{11 110 111}:

The long tail is combination labels, which is how real firms actually register. Export-only plus manufacture: 8,082. Complaint-file plus manufacture: 7,439. Complaint-file plus specification developer: 7,200. Contract manufacturer plus manufacture: 5,214. Specification developer plus manufacture: 4,589. Repack/relabel plus manufacture: 4,293. Specification developer plus complaint-file (the other order): 3,461. Manufacture plus contract manufacturer (the other order): 3,067. Complaint-file plus specification developer plus manufacture: 1,859. Contract sterilizer plus contract manufacturer: 1,304. Complaint-file plus repack/relabel: 1,155. Manufacture plus complaint-file: 1,138. Those combination rows are still manufacturer-side types stacked together. Stacking them does not create a servicer type ¹¹.

Two labels confuse buyers and should be named.

Specification developer (31,872 exclusive rows) is “develop specifications but do not manufacture at this facility.” That is the Abbott-side of the Abbott/Flextronics pair in Section 1, not a repair depot ^{42 43 11}. A shop that writes a test protocol for a hospital is not, by that fact, a specification developer under 21 CFR 807.

Complaint file establishment per 21 CFR 820.198 (19,040 exclusive rows) is a manufacturer-side complaint unit. The type name still cites the old QSR section number. QMSR has incorporated ISO 13485 and has not kept the 1996 numbering the listing file still prints. That is a file-hygiene finding, not a mystery about 19,040 secret servicers ^{11 5 64}.

Contract sterilizer (39,376) is the closest neighbour to a “we send things out to be processed” type, and it is still not independent imaging service. It is a sterile-processing manufacturer role ¹¹.

Who must register is 21 CFR 807.20: owners and operators engaged in the manufacture, preparation, propagation, compounding, assembly, or processing of a device intended for human use, unless exempt, must register and list devices in commercial distribution ⁸⁸. Remanufacturing, as FDA uses the word, is that kind of processing when it significantly changes the finished device. Servicing that returns the device to OEM specification, performed on a hospital’s or ISO’s own asset without placing a new finished device into commercial distribution, is the activity the 2024 guidance generally leaves outside manufacturer registration ^{6 7 8}.

So the lookup “is this repair shop FDA-registered?” returns one of three honest results:

1. Yes, as a manufacturer / spec developer / contract manufacturer / etc. Then you are not looking at a pure servicer. You are looking at a firm that has taken on finished-device obligations, and QMSR is their problem as well as yours. Ask what they list, and whether the listed devices include anything they remanufacture for sale.
2. No. That is the expected result for a shop that only services. It is not a quality-system failure. It is also not a quality-system success. You are now in the quality-agreement world of Section 5.
3. You cannot tell, because the search UI asked the wrong question. Searching the listing file for a DBA that only appears on invoices will miss a manufacturer registration under a parent name, and will not create a servicer hit that cannot exist.

OpenFDA’s registration-listing API is the same file in machine-readable form. It does not add a servicer type ¹¹¹. FDA’s device registration-and-listing explainer is the human-readable map of who the file is for ¹¹⁰.

Used-equipment buyers who want a five-gate acceptance protocol for a console they are purchasing, rather than a repair they are sending, should use Rongtao’s used ultrasound machine buying guide. That is a different object: title, identity, and residual risk on a machine changing owners. This section is the repair-partner object: a shop that may never appear in 807 at all.

5. A worked quality-agreement checklist

This checklist is compressed from the evidence above. It is not an unsourced RACI and not a consulting framework invented to fill a section. Each line is an artifact the denominators, the letters, the standards, or the 2024 guidance made demandable.

1. Scope and legal posture.
Written statement of the work: probe repair, board repair, parts supply, on-site, depot. Written statement that the partner’s default activity is servicing as FDA defined it on 10 May 2024 — return to OEM safety/performance/intended use — and that remanufacturing (significant change) will not be performed without prior written notice and, where required, manufacturer obligations ^{6 7}. OEM brand names in the scope are compatibility identifiers, not authorization ¹².

2. Certificates, with scope.
Current ISO 13485:2016 certificate; ISO 9001:2015 if claimed. Certification body named. Scope line matches the work. Certificates on a public page are a start; the PDF in the agreement file is the artifact ^{1 2 108 109}. Do not treat 13485 as QMSR registration.

3. Identity on every work order.
Model, serial, software version where relevant, customer asset tag, date received, reported fault, accessories received (batteries, biopsy guides, TEE bite guards). The MAUDE extract’s missing serial/catalog columns and the diagnostic subset’s 41 blank-brand / 787 blank-manufacturer rows are the public reminder that identity is a control, not a courtesy ¹⁰.

4. Receiving inspection.
Incoming condition documented (photos of the lens, strain relief, connector, board handles, corrosion). Separate customer-caused damage from in-process damage. This is clause 7.5 plus 8.3 at the dock ¹.

5. Purchasing controls for parts and subcontractors.
Approved sources, incoming verification, change notice. Philips 820.50 and ZOLL 820.50 are the manufacturer examples of “purchased service not on the list” ^{41 39}. Link the parts provenance file rather than rewriting it: ultrasound parts provenance.

6. Measurement and release.
Named tests, named equipment, pass/fail, operator, date. Quarantine versus released status. A 48-hour real-machine test is one compliant pattern; the agreement should state the pattern you are buying, not “tested” as an adjective ¹². IEC 62353 where HTM already requires it for the equipment class ¹⁰⁶.

7. Nonconforming product.
NCR for failed incoming parts, failed outgoing tests, and in-warranty returns. Disposition authority. ReNovo 820.90 is the reprocessor example of “failed environmental test, no NCR, no product impact assessment” ³⁷.

8. Comebacks and CAPA.
Definition of a complaint that cannot be cancelled because it is inconvenient (BMC’s cancelled records that met the written definition) ⁴⁸. Trending that does not hide behind “no fault found” (ZOLL) ³⁹. Effectiveness checks that can fail (Medline) ⁴⁰. A typical 90-day hardware warranty is the commercial overlay, not the CAPA procedure ¹².

9. What the partner will not certify.
Repair does not restore a disinfection validation. Repair does not create OEM authorization. Repair does not place the shop under QMSR unless the shop remanufactures or otherwise manufactures. The hospital keeps 42 CFR 482.41 equipment-maintenance obligations and its own reprocessing program ^{90 5}.

10. Records you can audit without an FDA badge.
A sample pack, on request, for a named serial: receiving photos, work order, parts lot, test record, NCR if any, release, shipping identity. FDA investigators of manufacturers may now review supplier-audit and management-review reports that the old 820.180(c) excepted ⁶⁴. You are not FDA. You can still contract for the sample pack.

11. Establishment listing, asked correctly.
If the partner commercially distributes remanufactured finished devices, they should be in the 807 file as a manufacturer or the appropriate type, and QMSR applies ^{88 5}. If they only service, they will usually be absent, and that absence is expected. Do not score the absence as a defect. Do not score a random manufacturer registration in a similar name as proof of repair quality ¹¹.

12. Change control on the agreement itself.
Firmware processes, test fixtures, subcontractor lists, and certificate scope change. 3B’s 806 finding is a manufacturer correction/removal clock; your analogue is “tell us before the process that released last year’s serials changes” ^{46 47}.

That is twelve lines, not a RACI. Staffing (35+ engineers), SKU count (3,000+), floor area (3,000 m²), geography (140+ countries and regions), and 15+ public cases are capacity and transparency claims a buyer can verify on the live site. They are not substitutes for lines 3–8 ¹².

6. ISO 13485 ultrasound repair FAQ

Does an ISO 13485 certificate mean the shop is OEM-authorized?
No. ISO 13485:2016 is a medical-device-sector QMS standard whose scope includes servicing organizations. It does not confer authorization, endorsement, or affiliation from GE Healthcare, Philips, Siemens, Hitachi, Mindray, Samsung Medison, Toshiba (Canon), Aloka, Biosound Esaote, or any other brand. Those names, when a shop uses them, are compatibility identifiers ^{1 12}.

Does FDA’s QMSR apply to our independent ultrasound repair vendor?
Not automatically. QMSR amends 21 CFR 820, incorporates ISO 13485:2016, and applies to finished-device manufacturers (and remanufacturers). It became effective 2 February 2026. An independent servicer that only services is generally outside manufacturer registration and outside that CGMP frame. If the vendor remanufactures, they step into it ^{3 4 5 6 64}.

Do they need to show up in FDA’s establishment registration file?
Only if they are a manufacturer (including a remanufacturer) required to register under 21 CFR 807.20. The listing file’s 419,651 rows have no independent-servicer type. Absence from the file is the expected result for a pure servicer and is not, by itself, a quality-system finding ^{11 88 110}.

FDA warning letters mention “servicing” 33 times — is that a wave of ISO enforcement?
No. In the 3,643-letter index the 33 is a keyword hit, mostly food service, telehealth Services, compounding Services, tobacco Services, and similarly named firms. The device-reprocessing example in that hit list is ReNovo / Provision Device Reprocessing Solutions (13 October 2023, CDRH, CGMP/QSR/Medical Devices/Adulterated), a single-use device reprocessor, not an ultrasound ISO. Published QSR letters in the sample name manufacturers and specification developers ^{9 13 17 22 37 39}.

MAUDE is mostly malfunction. Does that mean independent repair is safe — or that it is dangerous?
Neither. Malfunction is 94.7% of the 7,618 reports in the IYN/IYO/ITX diagnostic-ultrasound subset. It is not a rate and MAUDE has no third-party-servicer attribution in this extract. The broader 68,501-row screen is even less suitable because it is dominated by surgical and endoscopic device codes. Death 31 in the diagnostic subset is not a probe-repair mortality statistic ^{10 66}.

Does a repaired probe come back with a restored disinfection validation?
No. Repair restores a testable physical object. The hospital’s IFU, chemistry, and logs remain the disinfection claim. Independent repair does not run clinical high-level disinfection and does not recertify the hospital’s cycle. See the HLD report for the inspect-before-you-disinfect gate.

If the shop has ISO 9001 but not ISO 13485, is that enough?
ISO 9001:2015 is a generic QMS. It can support process discipline. It does not carry 13485’s medical-device purchasing, traceability, and regulatory language. For ultrasound repair, demand 13485 scoped to the actual activity, and treat 9001 as a complement, not a substitute ^{1 2}.

When does a board swap become remanufacturing?
When the activity significantly changes the finished device’s performance, safety specifications, or intended use — including some improvements — as determined by the activity, not by the shop’s label. A swap that returns the device to the OEM envelope is servicing under the 2024 guidance. A change that needs a new 510(k) under 21 CFR 807.81 is not “just service.” Document the determination ^{6 7 94}.

7. Methodology and limitations

Takeaway: every computed number above is reproducible from public FDA files with the filters stated here. Silences and false positives are labeled as properties of those files.

Warning letters. Public FDA Warning Letters index, 3,643 letters, years 2021–2026, index complete as of 30 July 2026. Issuing-office and subject-line counts are exact string matches on the indexed fields. “CDER-named offices combined ~970” aggregates the several CDER office strings in the index (including “Center for Drug Evaluation and Research (CDER),” “Center for Drug Evaluation and Research | CDER,” and “Center for Drug Evaluation and Research”). “QSR-device-ish 125” is a broader quality-system-plus-device language screen than the 92 exact CGMP/QSR/Medical Devices/Adulterated subjects. “IDE/PMA 40” is the exact investigational-device / PMA adulterated-device subject; 101 is the looser anywhere-in-record count. The servicing keyword screen is servic|reprocess|remanufactur|repair and is reported as a false-positive-heavy list, not as a servicer census. Sample QSR letters and sample keyword-hit letters were opened from their public FDA URLs in August 2026. One enforcement corpus; no second count from a duplicate HTML archive ⁹.

MAUDE. Yearly event files, export date 8 June 2026, 2020 through partial 2026. The core diagnostic subset is product codes IYN, IYO and ITX: 7,618 rows, 7,217 malfunction, 362 injury, 31 death and 8 other/blank; 41 blank brand and 787 blank manufacturer. The separate broad sensitivity screen uses an ultrasound-related product-code set or an ultrasound/transducer string and returns 68,501 rows; it is used only to demonstrate cross-specialty contamination. This extract has no serial or catalog columns. Product-code names come from FDA’s classification database, not MAUDE narratives (the extract has none). Counts are not rates, and death 31 is not a probe-repair mortality statistic. OpenFDA’s device-event API is the public machine-readable neighbour of the same reporting system ^{10 65 82}.

Recalls. Product-level recall extract, 58,785 rows. Ultrasound-string 1,157, QSR-string 276, laser-regex 65. String hits, not causation ⁸³.

Registration and listing. 419,651 establishment-type rows, export 22 July 2026. Counts are rows as labeled, including combination-type strings. Specification-developer 31,872 and complaint-file 19,040 are exclusive-label counts unless stated as combination rows. There is no independent-servicer type in the file ^{11 110 111}.

Standards and guidance. ISO 13485:2016 and ISO 9001:2015 cited from ISO product pages and preview; no copyrighted full-text reproduction. QMSR cited from the 2 February 2024 Federal Register (89 FR 7496 / 2024-01709), govinfo HTML, FDA’s QMSR page, and FDA’s QMSR FAQ. Remanufacturing versus servicing cited from the 10 May 2024 FDA guidance page, the guidance PDF, the 9 May 2024 press announcement, and the remanufacturing-and-servicing hub. eCFR citations are current Title 21 parts 803, 806, 807, 820, 821, and 830, plus the device classification parts named in the product-code table. AAMI EQ89 is cited from currently public catalog pages (ANSI webstore, AAMI product page, and a 2015 trade announcement describing the standard’s purpose), not from copyrighted full text. IEC 62353 and ISO 14971 are cited from their catalog pages as adjacent method/risk documents, not as computed evidence ^{1 2 3 4 5 6 91 106 107}.

Client facts. Rongtao operating facts are from the live site and the verified company profile only: ISO 13485:2016 and ISO 9001:2015, 48-hour real-machine test, 35+ engineers, 3,000+ SKUs, 5–8 day turnaround, typical 90-day warranty, 15+ public cases, 140+ countries and regions, 3,000 m² Guangzhou, founded 2013. Forbidden unverified claims (99% success, 100,000+ repairs, 24/7, 60-day or 180-day warranty) are not used ¹².

Limitations. Warning letters are published enforcement, not a sample of all inspections and not a ranking of independent servicers. MAUDE is voluntary-plus-mandatory reporting with known under- and over-reporting, no denominator, and no servicer field. Registration listing cannot answer a servicer-identity question it was not built for. ISO certificates do not imply OEM service authorization. QMSR does not automatically cover every independent servicer. Repair does not restore a disinfection validation. This report does not retell right-to-repair docket politics, probe repair-versus-replace economics, board-level FMECA, or Spaulding/HLD chemistry; those are separate published pieces, linked where a reader needs the door.

Conclusion

A wall certificate is a claim. QMSR, as of 2 February 2026, is how the United States writes ISO 13485:2016 into manufacturer CGMP. The 10 May 2024 remanufacturing guidance is how the United States writes the line between servicing and manufacturer obligations. Third-party ultrasound repair sits on the servicing side of that line until someone significantly changes the object — and the public FDA files will not rank the shops for you.

The denominators are the discipline. 3,643 warning letters collapse to 220 CDRH letters and 92 exact QSR-device subjects; the 33-hit “servicing” keyword is a false-positive list with one real reprocessor example. A broad 68,501-row MAUDE ultrasound screen collapses to 7,618 reports in the IYN/IYO/ITX diagnostic subset, 94.7% coded malfunction, with no servicer-causation field. 419,651 establishment-type rows contain no independent servicer. Those are not arguments for sloppy repair. They are arguments against using the wrong public file as a vendor scorecard.

What you can demand is smaller and more useful: identity on the work order, receiving inspection, purchasing control of parts and subcontractors, measurement with a pass/fail, quarantine of nonconforming product, release, and a complaint path that cannot be cancelled because it is inconvenient. ISO 13485 clauses 4, 7.4, 7.5, 8.3, and 8.5 are the map. The letters to ZOLL, Medline, Philips Ultrasound, Abbott, Flextronics, Contec, Exactech, 3B, BMC, and ReNovo are manufacturer and reprocessor illustrations of those controls failing, not a league table of imaging ISOs.

Independent hardware service remains how fleets stay in clinical use after the OEM’s commercial clock moves. Policy context for that fact lives in Rongtao’s right-to-repair and independent servicing report. This report’s job is narrower. If a partner cannot show the floor artifacts, you do not have a quality system. You have a PDF.

If you are writing or revising a quality agreement for ultrasound probe or board repair, send the model list, the tests you already require on return, and the last page of the candidate’s ISO 13485 scope. That is enough to see whether the certificate and the bench are the same object. Certificates live at rongtaomedical.com.