This is incorrect. All COTS in a medical device is considered SOUP (Software Of Unknown Pedigree). All COTS must be validated for its intended use regardless of the supplier and a risk analysis must be performed for the use of the COTS. The device manufacturer is held liable for defects, not the supplier.