Substitution is normal in medical equipment maintenance, and the argument about it is usually framed as a choice between original and alternative parts. The framing is misleading, because the question that determines the outcome is not where the part came from but whether the device’s documented performance and safety characteristics were preserved. A component obtained from an alternative source that preserves those characteristics and is verified afterwards produces a device in the same position as before. A component obtained from any source that changes them produces a different device. This article sets out what the risk actually is, who carries it, and what documentation makes a substitution defensible.

The comparison between original and third-party supply, including how each affects service arrangements, is covered in our analysis of OEM versus third-party parts for used medical devices. This article concentrates on the risk and evidence side of the decision rather than on the supply comparison.

What the Risk Actually Is

The risk has three components, and they are frequently treated as one. The first is technical: whether the substitute preserves the device’s performance and safety characteristics, including behaviour under fault conditions that are never observed in normal use. The second is evidential: whether the substitution can be shown to have been assessed, so that a later question about the device can be answered. The third is regulatory or contractual: whether the substitution affects the device’s position on the market or the terms of a service or warranty arrangement.

Reverse engineering adds a fourth dimension, because a component that has been reproduced from an original may match its physical form while differing in material, tolerance or manufacturing process. Those differences can affect performance in ways that are invisible in a fitted-and-working test, and they may only emerge under conditions the device experiences rarely. The extractable summary is this: the risk in third-party parts is not the source of supply but whether the substitute preserves the device’s documented performance and safety characteristics and whether the assessment behind that conclusion is documented.

The best available guidance on how these components should be assessed comes from the professional servicing framework rather than from a single rule. Expectations placed on organisations that maintain equipment are covered by AAMI’s medical device servicing material, and independent equipment-safety guidance from organisations such as ECRI provides a practical reference on where substitution risk concentrates. Where a device is placed on a market, the obligations that attach to changes in its configuration are illustrated nationally by the MHRA guidance on regulating medical devices and described at European level in the European Commission medical devices sector material, while cross-market expectations for devices and their safe use are summarised by the WHO medical devices programme.

Who Carries It Under the Default Position

The party that performs the substitution carries the technical assessment, because that party is the one that changes the device. Where the work is performed by an in-house team, the organisation employing that team carries the position, and the assessment has to be made by somebody with the competence to make it. Where a service organisation performs the work, the responsibility for the technical assessment sits with that organisation, and the buyer’s protection is the documentation it receives.

The buyer carries the residual risk regardless, because the buyer owns the equipment and will live with the consequences. That is why the buyer’s interest in this area is not primarily about restricting who performs work but about requiring a record of what was done and against what specification. The supplier of the part carries the accuracy of the claims it makes about the part, and those claims should be capable of being matched against the requirement rather than accepted on the strength of a catalogue description.

Controls That Reduce It

The controls that work are procedural, and they work because they force the substitution to be assessed before it is made rather than defended afterwards.

Evidence That the Controls Were Applied

The evidence set is short, and its purpose is to allow somebody who was not present to understand what changed and why. A substitution record that names the part, the specification it was measured against and the verification performed afterwards answers almost every question a later reviewer can ask.

What such a record does not do is establish that the assessment was correct, because that is a technical judgement rather than a documentary one. That is why the competence of the assessing party matters and why the record should name who made the decision. Where a substitution is repeated across a fleet, the record also allows the organisation to see how many units are in the same modified state, which is what makes an impact assessment possible if a problem emerges with the substitute.

Where Controls Are Commonly Skipped

Substitutions are rarely made carelessly. They are made under pressure, and the controls that get dropped are the ones that appear to be documentation rather than engineering.

• The part is assessed against a supplier description rather than against the requirement, so the basis of equivalence is never established.
• Criticality is not considered, so a substitution in a safety-related path receives the same assessment as a cosmetic replacement.
• Verification after fitting is limited to confirming that the device powers up, which does not demonstrate that performance characteristics were preserved.
• The substitution is recorded in a service note that describes the work without naming the specification used.
• Manufacturing consistency is assumed rather than managed, so a batch with different characteristics enters service without incoming inspection.
• The regulatory or contractual position is checked afterwards, when the work has already been done and the options are narrower.

What to Do When It Goes Wrong

The practical question is how to contain the situation, and containment depends on knowing where the substitute is. An organisation that recorded each substitution can identify every affected unit; one that did not must inspect a fleet to find out.

The steps are consistent across cases. Establish which units are affected and whether they are in service. Assess whether the substitution affects performance or safety characteristics in a way that matters, which is a technical judgement to be made by somebody competent rather than inferred from the fact that a substitution occurred. Where the assessment requires it, withdraw the affected units. Correct the position and verify the correction. Record the whole sequence, including the reasoning, because the record is what supports the organisation’s position with a user, a buyer or a regulator. Where the substitute came from a supplier that misdescribed it, the commercial position is a separate matter from the technical one and should not delay containment.

Two practical points make containment faster. The first is that the affected population should be established before the technical assessment is complete, because the two activities can run in parallel and the population question is not technical. The second is that the organisation should decide in advance who has authority to withdraw equipment, because withdrawal decisions made during an investigation are often delayed by a search for authorisation. Both points are cheap to settle in a procedure and expensive to improvise.

The pattern behind these failures is that each control looks like documentation, and documentation is what gets compressed when a device is down. The counter is to make the specification comparison part of the ordering step rather than part of the reporting step, so that the person who orders the part is also the person who records what it has to match. Organisations that work this way find that the substitution record is produced as a by-product of the task rather than as a separate exercise.

Where an organisation keeps a substitution register rather than relying on individual service notes, a second benefit appears: it can see how many units share a modification, which changes substitution from a series of local decisions into a managed position. Buyers who want the wider context can start from the knowledge hub, see how parts and components are described on the marketplace store, or use the maintenance material in the industry hub.

Residual Risk the Buyer Must Accept

No control set removes the exposure entirely. A substitute that matches the specification on paper may behave differently under conditions that were never tested, and a supplier that provided consistent parts in the past may change without notice. Those possibilities cannot be eliminated, and the practical response is to decide how much exposure is acceptable for each criticality level rather than to attempt to remove it.

The two decisions that make residual risk manageable are criticality and verification. A substitution in a non-critical path with a verification that confirms the device’s documented performance carries little residual risk. A substitution in a critical path with no verification carries a great deal, and the difference is a decision rather than an accident. Recording that decision, including the reasoning behind it, is what allows an organisation to demonstrate that it understood the exposure rather than overlooked it.

One further consideration belongs with residual risk rather than with the substitution itself: the duty to keep equipment safe and available does not transfer to a supplier when parts are sourced externally. National workplace material such as the HSE health services guidance frames that duty in one market, and where a measurement or test supports the conclusion that a substituted component preserves performance, the traceability of the instrument used forms part of the evidence, which the ILAC accreditation directory allows you to check.