The firm on the record is not the firm on the box

Say a subscriber’s device carries one company’s name on the label. A warning letter posts against a different company entirely — the contract manufacturer that actually built the thing. A firm watch keyed to the brand’s own name finds nothing, says nothing, and is not malfunctioning. It is doing exactly what it was told to do. The gap is upstream of the matcher, in the rule that let the label and the record diverge in the first place.

The label is allowed to name someone who didn’t make it

Device labeling rules do not require the name on a device to belong to whoever manufactured it. 21 CFR 801.1(c) sets the condition plainly: where a device is not manufactured by the person whose name appears on the label, that name has to be qualified by a phrase that reveals the real relationship — “Manufactured for”, “Distributed by”, or equivalent wording. The rule does not discourage this arrangement. It regulates it, by requiring the disclosure and then permitting the brand’s name to stand on the front of the box regardless. Private labeling and contract manufacturing are not an edge case in this industry; they are a normal way to bring a device to market, and FDA’s own labeling rule is written around that fact.

The record follows the maker

Enforcement records don’t use the label’s convenience name. A warning letter goes to the firm FDA actually inspected — the establishment doing the manufacturing, not necessarily the company whose name a customer would recognize. A device recall is similar by definition, not by habit: 21 CFR 7.3(i) defines the recalling firm as the firm that initiates the recall or, in an FDA-requested recall, the firm with primary responsibility for manufacturing the product. Neither definition mentions the brand. For a device built under contract, the name that ends up in openFDA’s recalling_firmfield, or on the addressee line of a warning letter, is routinely the contract manufacturer’s — a name that may not appear anywhere in the subscriber’s own product literature at all.

The label discloses the relationship once, in small print, at the point of sale. The enforcement record doesn’t carry the disclosure forward — it just uses whichever name FDA actually has on file for the firm that did the work.

Two identifiers, one join, kept separate on purpose

FDA Radar’s portfolio profile carries two firm fields, not one: firm, the brand, and cmo_firm, the contract manufacturer named at setup. The matcher treats them as two distinct match bases — not a fallback, not a looser version of the same check — because collapsing them into one field would mean picking a single name to watch when the FDA record could carry either. Both run through the same normalization the brand name gets: lowercase, strip punctuation, drop the legal-entity suffix, and nothing fuzzier than that, for the same reason a firm match is never allowed to be a guess. When a record does carry the manufacturing partner’s name, the reviewer sees a WHY string built for exactly that case — “Names your manufacturing partner — Meridian Device Manufacturing” — distinct from the one that fires when the record names the brand itself.

What this doesn’t tell you

A match on cmo_firmmeans FDA named your contract manufacturer in a warning letter or a recall. It does not mean the finding has anything to do with your specific device, or with the line that makes it — a manufacturing partner making dozens of products for dozens of clients can draw a warning letter over a violation that never touches your product at all. That reading is the same one the record always requires: whose quality system does the finding actually implicate, and does it reach the device you shipped. FDA Radar’s part is making sure the record reaches you under the right name in the first place. Per what we monitor and how often, both firm fields run against every item, every time — this is regulatory intelligence about whose name is on the record, never a judgment about what the finding means for you.