Reading a medical device certificate: CE, EU MDR, FDA and ISO 13485
What each certificate actually certifies, why a quality system certificate says nothing about a specific product, how to check that a certificate is genuine and current in about ten minutes, and why a claim printed on a datasheet is not evidence of anything.
Somewhere in every equipment tender file there is a page headed Certificate, printed in colour, carrying two or three logos and a stamp. A good proportion of the time it certifies something other than what the bidder believes it certifies, and occasionally it certifies nothing at all. Reading these documents properly is a skill that takes about an hour to acquire and saves procurement committees from a category of mistake that is very hard to unwind after award.
Start with one question: product or company
Medical device certificates fall into two families, and confusing them is the most common error in the room.
A quality system certificate, of which ISO 13485 is the relevant one, says that a named legal entity operates a management system for medical devices at named sites, within a stated scope, and that a certification body audited it. It says nothing about whether any particular device is safe, effective, or even inside the scope of the certificate.
A product conformity document, such as an EU certificate issued by a notified body or a United States clearance letter, attaches to devices. It says that this device, or this family of devices, has been assessed against a defined set of requirements.
Both are worth having. They answer different questions, and a bidder who submits one when you asked for the other has either misunderstood or is hoping you will.
Document
What it actually tells you
What it does not tell you
ISO 13485 certificate
A certification body audited this company's medical device quality system, for this scope, at these sites, valid to this date
Whether the device you are buying is covered, and whether it is safe
EU certificate from a notified body
An independent designated body assessed this device or device family against EU medical device legislation
Anything about models outside the certificate scope
Declaration of Conformity
The manufacturer formally declares the device meets the applicable legislation, names the legislation, the class, and any notified body involved. Required, and legally significant
It is the manufacturer's own statement, so it is not third party evidence on its own
United States 510(k) clearance
The regulator agreed this device is substantially equivalent to an existing legally marketed device, and issued a number you can look up
That it was independently tested, and that the exact variant offered is included
Establishment registration or device listing
The manufacturer told the regulator that it exists and what it makes
Anything at all about approval or quality. This is a notification, not an assessment
Test report to IEC 60601-1 or a related standard
A laboratory tested a specific configuration and issued a report number
That other models in the range were tested, unless the report says so
CE marking and EU MDR in practice
The current European framework is Regulation (EU) 2017/745, commonly called the MDR, which applied from May 2021 and replaced the older directives. Transition arrangements have been extended more than once, so devices still circulate on legacy certificates issued under the previous law. The certificate itself will say which legislation it was issued under and when it expires. Read those two lines first, before anything else on the page.
Devices are classified I, IIa, IIb or III by risk. The classification determines who has to be involved:
Class I, other than sterile, measuring or reusable surgical instruments, is self declared by the manufacturer. The device carries a CE mark with no number after it, and there is no notified body certificate to produce. This is entirely legitimate, and a great deal of hospital furniture sits here.
Class I sterile, measuring or reusable surgical, and all of IIa, IIb and III require a notified body. The CE mark is followed by a four digit number identifying that body.
A four digit number is therefore diagnostic. A Class IIa device presented with a bare CE mark and no number, or with a notified body certificate whose scope does not cover that device type, is a problem. Equally, demanding a notified body certificate for a manual ward bed will get you nothing from the honest bidder and a convincing forgery from the other one.
Two further details are worth checking. A manufacturer outside the European Union must appoint an authorised representative, whose name and address appear on the labelling and on the declaration of conformity. And notified bodies are designated for specific device code ranges, so a properly designated body is not thereby competent for everything. The European designation database is public and searchable, and it lists every notified body, its number, and its exact designated scope. Note also that CE marking covers the European market; Great Britain now uses a separate marking, and a device may legitimately hold one and not the other.
United States terminology: cleared, approved, registered, listed
These four words are used interchangeably in sales material and mean quite different things.
Cleared means a 510(k) premarket notification was accepted, on the basis that the device is substantially equivalent to one already legally on the market. This is the route most hospital equipment takes. It produces a clearance number, and the clearance is searchable in a public database by number, by device name, and by manufacturer. If a bidder claims it, ask for the number. Checking it takes two minutes.
Approved is reserved for premarket approval, which applies to the highest risk category. Very few pieces of general hospital equipment go through it. A brochure claiming approval for a ward bed is using the word loosely.
Registered and listed mean the manufacturer filed an establishment registration and told the regulator what it produces. It is an administrative notification. The regulator states plainly that registration does not denote approval, and it does not permit any logo or seal implying endorsement. A certificate of registration produced by a third party consultancy, with a border and a seal, is a document somebody paid to have printed.
ISO 13485: read the scope, the sites and the dates
Most ISO 13485 certificates submitted in tenders are genuine. The problem is that the wrong genuine certificate is submitted, or the right one is read carelessly. Work through it in this order.
Legal entity name. It must match the manufacturer named on the offered device and on the manufacturer's authorisation. A certificate belonging to a trading company, a group holding company or a contract assembler is not evidence about the factory making your goods.
Site addresses. The plant that will manufacture your order must be one of the sites listed. A company with several factories is not certified at all of them by default.
Scope wording. This is the sentence people skip. Design and manufacture of surgical instruments does not cover an operating table. If your product family is not described, the certificate is not about your product.
Dates. Issue and expiry. An expired certificate is common in tender files, usually because nobody looked.
Certification body and accreditation. The issuing body should itself be accredited by a national accreditation body that signs the international mutual recognition arrangement. Unaccredited certification exists, is legal, and is worth considerably less.
How to verify a certificate in about ten minutes
Identify the issuing body from the certificate. Then find that body's website yourself by searching for its name. Do not use the link or the QR code printed on the document you are trying to verify, which is the one thing a forger controls completely.
Almost every certification body publishes a searchable register. Search by certificate number, then by company name, and confirm the status is active, the expiry date has not passed, and the scope and site list match what you were given.
For a European product certificate, look up the four digit notified body number in the public designation database, confirm the body is currently designated under the current legislation, and confirm that its designated scope covers the device category in question.
For a United States clearance, search the clearance number in the public database and confirm the device name and manufacturer.
If any of this cannot be reconciled, write to the issuing body quoting the certificate number. They answer, and they are usually quick, because unauthorised use of their mark is their problem too.
Red flags
No certificate number, or a number that does not appear in any register.
The scope is a marketing sentence rather than a description of products and processes.
The certificate names a country office or a distributor as the certified entity while the goods are made elsewhere.
A single certificate offered as covering an entire catalogue across several unrelated device types.
A document assembled in a word processor: inconsistent fonts, a low resolution logo, a signature block with no name, or a verification address on a domain that is not the certification body's own.
Why a datasheet claim is not evidence
CE certified, FDA approved, ISO certified and manufactured to international standards are all sentences that can be typed by anyone. None of them contains a number, an issuer or a date, which are the only three things that make a claim checkable. Treat an uncheckable claim as absent.
There is a related and subtler distinction. Designed in accordance with IEC 60601-1 is an engineering intention. Tested to IEC 60601-1 by a named laboratory, report number and date stated is evidence. Ask for the report, and when it arrives, check which model variants and which configuration it covers, because certification is granted to specific configurations. A trolley mounted version of an approved wall mounted device is not automatically included, and a certificate covering one model in a family does not automatically extend to the one you are buying. If the offered model is not named or clearly within a named range, ask the manufacturer to confirm coverage in writing.
Putting this into your tender document
Require, for each certificate: the certificate number, the issuing body, the issue and expiry dates, the full scope wording, and the manufacturing site address.
Require the certificate holder's legal name to match the manufacturer named in the offer and in the manufacturer's authorisation, and state that any discrepancy is grounds for rejection.
Where a device requires a notified body, require the four digit number to be stated in the offer and legible on the product label at delivery. Where a United States clearance is claimed, require the clearance number.
State that the procuring entity reserves the right to verify every document directly with the issuing body, and that a certificate which cannot be verified will be treated as not submitted.
Deal with Bangladesh separately. Registration and import permission from the national drug administration, where the device category calls for it, is a domestic requirement that no foreign certificate satisfies. Say in the contract who carries that risk and who pays for the delay if it goes wrong.