Here is a clause that appears in a great many supplier quality agreements, in almost exactly these words:

The Supplier shall maintain a robust quality management system and shall promptly notify the Buyer of any significant changes.

It reads well. It has survived legal review at both ends. And it is doing almost no work, because three of its words carry the whole meaning and none of them is defined. Robust according to whom. Promptly meaning what. Significant by whose judgement.

A clause like that is not a problem when everything is going well. It becomes a problem on the one day you need it, when a supplier has moved a process to a second plant, told nobody, and can point out with a straight face that they did not consider the change significant.

The good news is that this is a fixable drafting problem rather than a relationship problem. Most supplier quality agreements can be made materially stronger in an afternoon, without renegotiating commercial terms and without a single adversarial conversation. The method is simple: every clause gets a record, an owner and a review point. If a clause has none of those three, it is a wish rather than a requirement.

What the quality agreement is for, and what it is not for

A supplier quality agreement is the document that says who does what on quality. It sits alongside the commercial contract rather than inside it, and the regulators who have written most clearly about these documents are unusually direct on that point.

The FDA’s 2016 guidance on quality agreements for contract drug manufacturing recommends that quality agreements “be separate documents, or at least severable, from commercial contracts such as master services agreements or supply agreements”, and says they “should not cover general business terms and conditions such as confidentiality, pricing or cost issues, delivery terms, or limits on liability or damages”. The guidance also describes the sections most quality agreements contain: purpose and scope, definitions, resolution of disagreements, manufacturing activities, and the life cycle of and revisions to the agreement itself.

The EU’s good manufacturing practice guidance takes the same line from a different angle. EudraLex Volume 4, Chapter 7 on outsourced activities states that “There must be a written Contract between the Contract Giver and the Contract Acceptor which clearly establishes the duties of each party”, and that the contract should specify “their respective responsibilities and communication processes relating to the outsourced activities”.

Those two sources come from pharmaceutical and medical device supply, where the expectations are written down most explicitly. Two things follow from the pairing, and they apply well outside those sectors.

First, the agreement is a responsibilities document. Its job is to remove ambiguity about who acts, not to express an aspiration about quality.

Second, keeping it severable from the commercial contract is what makes it maintainable. A quality agreement you can revise without reopening pricing is a quality agreement that stays current. One that is buried in a master supply agreement will be exactly as accurate as it was on the day it was signed.

That separation is also why the life cycle section the FDA describes matters more than it looks. An agreement with no stated revision route quietly becomes a historical document.

The clause-to-evidence map

This is the part worth doing properly, and it is the part almost nobody does. Take your existing agreement, list the clauses, and for each one write down the record that proves compliance, the person who looks at it, and the interval at which they look.

The clause promises	The record that proves it	Who watches it	Review point
A certified quality management system	Certificate number, issuing body, scope statement, expiry date	Supplier quality	On expiry, automatically
Notice before any change to product, process, material or site	Dated change notifications, matched against what you actually received	Supplier quality and engineering	Each notification, plus an annual confirm-or-correct
Manufacture only at the agreed sites	Site list with valid-from and valid-to dates, linked to the parts made there	Master data owner	On change, plus annual
No subcontracting without prior approval	Approved sub-tier list with the approval date and approver	Category owner	On request, plus annual
Response to a corrective action request within an agreed time	CAPA record with raised date, acknowledged date, containment date, closed date	Quality engineer	Per case, reported monthly
Retention of batch, lot or build records for an agreed period	The retention period stated per record type, plus a tested access route	Quality systems	Annual spot check
Agreed performance levels for delivery and quality	The metric definition and the dataset it is calculated from	Supplier quality	Per scorecard cycle
No shipment of non-conforming material without a written concession	Concession and deviation register, with an expiry on each one	Incoming quality	Per case

The exercise usually produces two uncomfortable findings and one useful one.

The uncomfortable findings are that several clauses have no record at all, and that several records exist but nobody owns them. The useful one is that the list of things you genuinely need from suppliers turns out to be shorter than the agreement implies, which makes the request you send them easier to answer. That matters, because supplier response rate is the constraint that decides whether any of this works in practice.

None of this needs new infrastructure to start. A spreadsheet with four columns will expose the gaps perfectly well. It is only when you want the review points to fire on their own that you need somewhere to keep them, which is the argument for holding the agreement’s obligations in the same place you hold supplier records and documents rather than in a folder on a shared drive.

The three words to replace

Most weak clauses are weak for the same three reasons. Each has a straightforward fix.

Robust, appropriate, adequate. These invite a difference of opinion at the worst possible moment. Replace them with a named standard and a verifiable artefact. Not “a robust quality management system” but “certification to ISO 9001, with the certificate, its scope statement and its expiry date provided on request and on renewal”. If the site is a manufacturing site in a regulated sector, name the sector standard instead. ISO 13485 and IATF 16949 both certify at site level rather than company level, so a single corporate certificate does not answer the question you are asking. The control of external providers in ISO 9001:2026 works the same way: it asks you to state your requirements, not to hope they are understood.

Promptly, in a timely manner, as soon as practicable. Replace with a number, and attach the number to an event rather than to a feeling. Change notification is the clearest example. ISO 13485:2016 addresses this directly in its purchasing information requirements, which call for a written agreement that the supplier will notify the organisation of changes to the purchased product before those changes are implemented. Before implementation is the load-bearing phrase, and it is the one to borrow whatever sector you are in. In practice most teams turn that into a stated notice period for planned changes and immediate notice for unplanned ones. Whatever number you choose, choose it per category rather than globally, because thirty days of notice is generous for a packaging film and nowhere near enough for a sterilised component that needs revalidation.

Significant, material, major. This is the one that causes the most trouble, because it hands the judgement to the party with the least incentive to exercise it broadly. Replace it with a list. A change list does not need to be long to be effective: manufacturing site or line, production process or key process parameter, sub-tier supplier of a listed material, raw material grade or source, test method, software or firmware in a delivered product, packaging that contacts the product, and the standard or certificate the site holds. Then add a catch-all that asks the supplier to notify anything they are unsure about, and answer those quickly enough that asking stays cheap for them.

The last point is the one that decides whether the clause works. A change notification clause is only as good as your turnaround on the notifications you receive. If a supplier’s notice sits unanswered for six weeks, they will stop sending them, and no drafting will fix that.

The clauses worth the argument

Not every clause earns the negotiation time. These generally do, and they hold up across sectors.

Change notification, as above. The single highest-value clause in the document. Most supplier quality surprises are changes that were never announced.

Site of manufacture, named. A clause that commits the supplier to manufacture only at agreed sites gives you something specific to check, and it is the clause that makes the rest of your supplier and site data trustworthy. Ask for the site list with valid-from dates, not just a current snapshot.

Sub-tier visibility and approval. EudraLex Chapter 7 puts this plainly: “The Contract Acceptor should not subcontract to a third party any of the work entrusted to him under the Contract without the Contract Giver’s prior evaluation and approval.” You do not need full multi-tier mapping to benefit from this. Naming the sub-tiers that matter for the parts that matter is enough to start, and it is far easier to get at contract renewal than in the middle of an incident.

No unauthorised changes. Chapter 7 again: “The Contract Acceptor should not make unauthorized changes, outside the terms of the Contract, which may adversely affect the quality of the outsourced activities.” Worth including even where no GMP obligation applies, because it closes the gap between notifying a change and being allowed to make it.

Corrective action response times, tiered by severity. One response time for everything is either too slow for real problems or too aggressive for minor ones, and the second failure is worse because it trains everybody to miss the deadline. Tier it, and make sure the tiers match how your corrective action process actually classifies findings.

Concessions and deviations, with expiry dates. Every concession should carry an end date or a quantity limit. Concessions that quietly become permanent are one of the most common ways a specification drifts without anyone deciding to change it.

Records, retention and access. State the retention period per record type and, more importantly, state the access route. A retention clause that has never been tested is an assumption. One spot check a year turns it into a fact, and gives you the audit trail you will want if a customer or notified body ever asks how you verified it.

Audit rights, including remote. Write in the option of a documented remote assessment alongside on-site audit rights. It costs nothing to include and it is what makes a digital or remote audit available to you later without a fresh negotiation.

Exit provisions. Last-time-buy rights, record handover, tooling return and a transition period. These are far cheaper to agree at the start of a relationship than at the end of one, and they make an eventual structured offboarding a process rather than an argument.

The clauses that create work for you

Here is the part that most templates leave out, and it is the part that makes the rest credible.

A supplier quality agreement that only imposes obligations tends to be complied with narrowly. One that also states what you will do tends to be complied with willingly, and it is a much easier document to get signed. The FDA guidance and the EU GMP chapter both frame these documents as establishing the duties of each party, which is a useful reminder that there are two parties in the phrase.

Four mutual clauses are worth writing in.

Your approval turnaround. If you require notice before a change, state how quickly you will respond. Suppliers who wait months for a deviation decision start making decisions themselves.

Your forecast horizon. Say what visibility you will provide and how far ahead. Much of what looks like supplier delivery unreliability is a forecast problem wearing a supplier’s name, and saying so in the agreement is an act of good faith that costs very little.

A named contact on your side, with a named backup. Agreements routinely require the supplier to nominate a quality contact and say nothing about who the supplier should call. This one clause removes a surprising amount of friction.

The results come back. Commit to sharing the supplier’s own performance data with them on a stated cycle. This is the cheapest clause in the document and one of the most effective, because the data already exists on your side. Sending the supplier scorecard back is what turns evaluation from something done to a supplier into something they can act on, and it makes every subsequent data request easier to land.

Where the agreement meets the scorecard

Most disputes about a supplier scorecard are not disputes about performance. They are disputes about definitions, and they are almost always traceable to a clause that was never written.

Two teams looking at the same shipments will produce different on-time delivery numbers if one measures against the date the supplier promised and the other against the date the buyer requested. Add goods-receipt date versus dock date, a tolerance window measured in days versus hours, and different treatment of partial deliveries, and the gap between two honest calculations can be very wide.

The agreement is where those definitions belong. For each metric you intend to hold a supplier to, write down the event that starts the clock, the event that stops it, the tolerance, the treatment of partials and reschedules, and the data source of record. That is perhaps a paragraph per metric, and it converts an annual argument into a shared reference.

The same logic applies to quality metrics. Parts per million defective is not one number until you have said whether it counts incoming rejections only or includes line stoppages and field returns, and whether it is measured per part number or per site. Settling that in the agreement is what allows a weighted scorecard to be discussed on its merits.

There is a useful discipline here: do not write a metric into the agreement that you are not yet able to calculate. A committed metric you cannot produce is worse than no metric, because the first time you fail to produce it you have taught the supplier that the agreement is decorative.

Retiring clauses is part of maintaining them

Quality agreements only ever grow. Every incident adds a clause, and nothing ever removes one. After a few years the document is long, parts of it contradict other parts, and nobody can say which clauses are actually monitored.

The fix is a review point on the document itself, which is exactly what the FDA guidance means by including the life cycle of and revisions to the agreement. Once a year, walk the clause-to-evidence map and ask three questions of each clause: has anybody looked at this record in the past twelve months, is the named owner still in the role, and would we notice if the supplier stopped complying.

A clause that fails all three is not protecting you. It is either a record you should start collecting or a clause you should remove, and removing it is a legitimate answer. A shorter agreement that is fully monitored is stronger than a long one that is monitored in patches, and it is a much better basis for the kind of conversation you want in a quarterly business review.

Tier the review effort the way you tier everything else. Your critical and strategic suppliers deserve a genuine annual clause review. For the long tail, a confirm-or-correct on the certificates and the site list is proportionate, and that judgement should follow the same risk-based segmentation you already use for evaluation frequency.

A first pass you can do this week

You do not need a legal project to make progress. Pick your three highest-spend or highest-risk suppliers and do this.

1. Print the current quality agreement and list its clauses in a four-column table: clause, record, owner, review point.
2. Fill in the columns you can. Leave the rest blank rather than guessing, because the blanks are the output of the exercise.
3. Circle every use of robust, appropriate, adequate, promptly, timely, significant, material and major.
4. For the change notification clause only, draft the replacement: the change list, the notice period per category, and your own response commitment.
5. Check the certificate expiry dates you hold against the certificates the supplier holds. This single check finds more issues than most people expect, and it is a friendly conversation to have.
6. Note which of the blanks in column two are records you could collect through your existing supplier portal rather than by email.

Three suppliers is enough to tell you whether your template needs a revision or a rewrite, and it gives you a worked example to take to the rest of the base. If you want a structured way to prove the approach before rolling it out, a short supplier performance pilot on those same three is a reasonable way to do it.

The short version

A supplier quality agreement is not a statement of intent. It is a list of obligations, each of which should point at a record, an owner and a date. Write clauses you can measure, say what you will do as well as what you require, put your metric definitions in the document rather than in the argument, and review the whole thing once a year with permission to delete.

Suppliers are rarely the obstacle here. Most of them would much rather be held to a clear standard they can meet than a vague one they can only fail unexpectedly.

If you would like to see how the obligations in an agreement can be held against live supplier records, certificates and scorecards in one place, we are happy to walk you through it.

Frequently asked questions

Is a supplier quality agreement the same as a supply agreement?

No, and it is generally better if it is not. The FDA’s guidance on quality agreements recommends they be separate documents, or at least severable, from commercial contracts, and that they leave out general business terms such as confidentiality, pricing, delivery terms and liability. The practical benefit is maintainability: you can revise a severable quality agreement as processes change without reopening the commercial negotiation.

Do we need one for every supplier?

Very few organisations need a full quality agreement with every supplier, and attempting it usually produces a lot of unsigned documents. Tier it. A full agreement for suppliers whose output affects product conformity or regulatory status, a short quality annex for the middle tier, and standard purchase order terms for the long tail is a defensible structure. The segmentation model you already use for evaluation can decide the tiers.

What is the single most valuable clause to fix first?

Change notification, in almost every case. Most supplier quality surprises are changes that happened without notice. Replace the word significant with an explicit change list, require notice before implementation rather than promptly, set the notice period per category, and state your own response time in the same clause.

How do we handle a supplier who will not sign our template?

Ask which specific clauses they object to, because the answer is informative. Objections to record retention, site naming or sub-tier disclosure sometimes reveal a capability gap rather than a commercial position, and a capability gap is something you can work on together through supplier development. Objections to one-sided approval timelines are usually fair, and adding your own commitments is the cheapest concession available.

Where should the agreement’s obligations actually live?

Wherever you will see them without looking for them. An agreement in a contract repository is a legal record; the obligations inside it need to be operational, which means certificate expiry dates that raise a task, change notifications that create a record, and clause owners who are named people rather than departments. Teams that keep this in documents tend to discover lapses at audit time, which is the argument for moving supplier obligations out of spreadsheets.

Does this apply outside regulated industries?

The drafting method does, entirely. The regulatory sources quoted here are simply the places where the thinking has been written down most clearly. A change notification clause with a defined change list is just as useful for an electronics contract manufacturer or a packaging converter as it is for a pharmaceutical contract facility, and the clause-to-evidence map works the same way in IT services as in automotive.