A supplier sends a certificate PDF with the quote. It looks correct: an ISO 13485 heading, a recognizable certification body logo, dates that fall inside the current period. Then you notice the certificate names a device family, not the model you are buying. The document is real. It simply does not cover your order.
That gap is the reason to verify medical product certification at SKU level rather than at supplier level. A certificate attaches to a defined scope, and a scope statement is narrower than most buyers assume. The practical question is not “is this supplier certified” but “does this specific document cover this specific model, at this specific site, for this specific market, on this date”.
Answer that by working through four independent registers and documents, in order. Each one can fail on its own, and each failure invalidates a different part of the claim. The sequence below is the one to verify medical product certification against, because it separates what the company holds from what the product carries.
Why you must verify medical product certification by SKU
Most buyers verify the company and stop. The company-level check answers whether the manufacturer holds a quality management system certificate. It does not answer whether the certificate’s scope includes the product you are ordering, whether the certificate is currently in force, or whether the product carries its own market conformity evidence.
Registration alone is also easy to misread. FDA establishment registration means the facility is registered, not that a device has clearance. A European self-declaration covers lower-risk classes only; higher-risk devices need a notified body certificate. Reading either as a product-level approval leaves a gap that a customs officer, a distributor’s regulator, or a tender evaluator will eventually find.
The fix is a chain, and the chain is only as strong as its weakest link:
| Link | What it establishes | Where it fails |
|---|---|---|
| Legal identity of the manufacturer | The entity you contracted is the entity on the certificate | Certificates belonging to a different legal entity |
| Document scope by SKU | The certificate covers your model and site | Family-level or generic scope wording |
| Register confirmation | The certificate exists and is in force | Numbers that do not resolve |
| Product-level conformity | The specific model meets the target-market rules | Missing or mismatched declaration of conformity |
Work the chain in this order. A valid certificate number printed on the letterhead of a company that is not the legal manufacturer is still a problem for your order. For the wider document set this check sits inside, see how compliance documentation is mapped by SKU.
What the ISO 13485 certificate actually tells you
ISO 13485 is the quality management system standard for medical device manufacturers. It certifies that a manufacturing operation runs a controlled quality system. It does not certify that any individual product conforms to a product standard, and it does not certify market access in any jurisdiction.
Read four fields before accepting it:
- Issuing body and accreditation. The certification body must itself be accredited by a national accreditation body. Recognized names include TÜV, BSI, SGS, Intertek, DNV and Bureau Veritas, plus many regional bodies. Confirm the certification body appears in the IAF CertSearch database; a self-declared or unrecognized issuer carries no weight.
- Certificate number. Every genuine certificate has a resolvable number. A decorative or absent number is the first red flag.
- Scope statement. This is the field buyers skip most often. ISO 13485 held for warehousing is not ISO 13485 held for placing devices on the market. The scope wording decides what the certificate covers, and it must name the product category you are sourcing.
- Validity and surveillance. Certificates typically run three years with annual surveillance audits. An in-date certificate from a supplier that has missed a surveillance audit is a document, not an assurance. Ask for the most recent surveillance audit summary.
Cross-check the certificate number against the certification body’s own register rather than trusting the PDF. A PDF is an image of a certificate. The register entry is the evidence.
How to confirm the notified body and CE documentation
For devices that require notified body involvement, the CE mark carries a four-digit identification number next to it. That number identifies the notified body, and it is verifiable.
Open the European Commission’s NANDO database and search the number. Confirm two things: that the body is designated under Regulation (EU) 2017/745, and that its designated scope covers your product category. A body authorized for one category cannot issue certificates for another. This single check catches the majority of invalid or misattributed CE claims, and it is the step that most often changes the answer when you verify medical product certification on a new supplier.
Two further checks belong here:
- The mark itself. Legitimate CE marking follows the proportions set out in the regulation, with letters at least 5 mm tall and a defined spacing between the two characters. The widely reported “China Export” mark uses visually similar letterforms with different spacing and carries no regulatory standing.
- The declaration of conformity. This is the manufacturer’s signed statement of responsibility. It must name the specific model, the intended purpose, the applicable regulation, and the manufacturer. A declaration covering a device family without listing your model is insufficient for your SKU.
Under MDR, technical documentation retention obligations run for at least ten years for most devices and longer for implantables. Ask how long your supplier retains batch records, because that answer determines whether a traceability request in year four can be satisfied.
Where to check device registration and certificate status
European device and certificate data is consolidating in EUDAMED, the European database on medical devices. Its modules are being brought into mandatory use in stages, so what you can check depends on the date.
| EUDAMED module | What a buyer can confirm | Timing note |
|---|---|---|
| Actor registration | Manufacturer and authorized representative registration, with an SRN | Already usable for operators who have registered |
| UDI / device registration | Device identification data, searchable by UDI-DI | New devices must be registered before placement from May 2026 |
| Certificates | Certificates issued by notified bodies, and their status | Certificates issued before May 2026 must be uploaded by May 2027 |
| Market surveillance | Recalls, safety notices and enforcement actions | Later phase |
Until every module is fully populated, use EUDAMED as one input rather than the single authority. Combine it with the notified body’s own register and the certificate document itself. Where the three agree, confidence is high. Where they disagree, stop and ask the supplier which record is authoritative. Working out which party carries which obligation is covered in destination-market import responsibilities.
For North American sourcing, the equivalent check is the FDA establishment registration and device listing. Request specific clearance numbers where a clearance is claimed, and confirm the registration is active. Registration status and product authorization are separate records; confirm both exist. Buyers who verify medical product certification in the US market usually keep these two records side by side for exactly this reason.
Verifying a certification claim without a certificate
Scanned documents get edited. Logos get pasted onto fresh letterheads, dates get extended, and one manufacturer’s certificate number turns up on another company’s datasheet. Audit data reported in industry sourcing coverage indicates that a substantial share of “certified” suppliers fail unannounced third-party audits, which is why document review alone is insufficient. This is the scenario that makes it worth knowing how to verify medical product certification without relying on a supplier-supplied file.
When a supplier cannot produce original documents, scan these as structural signals rather than proof of intent:
- The company address resolves to an office building rather than an industrial zone, and no production line video can be arranged.
- The certificate scope uses generic wording such as “medical devices” instead of naming the product category.
- The NMPA registration does not carry a product-specific facility code matching your device.
- Lead times depend on a third party the supplier refers to only as a partner factory.
For higher-value or repeat orders, arrange third-party inspection through an organization such as SGS or TÜV, and review batch records and pre-shipment inspection results. This costs money and it is the layer most buyers omit. It is also the layer that catches the packaging variant substitution that document review cannot see.
How mixed first aid kits complicate verification
A first aid kit is usually an assembly, not a single device. A wall-mounted workplace kit may contain a tourniquet, adhesive dressings, a conforming bandage, an antiseptic wipe, scissors and a foil blanket. Each component can carry a different classification, a different manufacturer, and different documentation obligations.
Verification therefore has to be done per component, then mapped back to the finished kit SKU. To verify medical product certification for an assembled kit, work component by component before you look at the finished SKU as a whole:
| Kit component type | Typical documentation anchor | Common failure |
|---|---|---|
| Tourniquet, dressings, bandages | Manufacturer declaration plus test report by model | Certificate covers a different size or variant |
| Antiseptic or medicated items | Formulation and classification evidence for the target market | Ingredients not cleared in the destination market |
| Scissors, cases, non-medical hardware | General product conformity, not device rules | Classed as a device, inflating the document set |
| Outer bag or box | Packaging and labeling requirements | Labeling lacks the importer or representative details |
Build a component-to-document register for each kit SKU and keep it with the purchase order. When a component changes supplier, the register tells you exactly which documents must be refreshed before the kit ships. Without it, a substitution inside a kit can silently invalidate the compliance file for the whole SKU. Label wording is the other half of this file, and the labeling and language requirements by market set out what each destination expects on the pack.
What to request in an RFQ document schedule
Put the document request into the RFQ itself, with deadlines. Suppliers who hold genuine documentation produce it without resistance; hesitation is itself a data point.
Ask for the following, by model and by site:
- ISO 13485 certificate showing number, issuing body, scope wording, site and expiry date
- The certification body’s register entry, or the number you will use to check it
- Notified body number and NANDO designation scope, where CE marking involves a notified body
- Declaration of conformity naming your exact model and intended purpose
- Test reports cited by standard and edition, naming the accredited laboratory
- Batch-level inspection reports and AQL results for the production run
- EUDAMED registration status, where applicable to your timeline
- Documentation retention policy and the retention period you can rely on
State the acceptable response window in the RFQ. A supplier that cannot assemble the set within it has told you something useful before pricing is even discussed.
For kit-based orders, the outer format also affects what has to be labeled and documented. The differences between wall-mounted and portable kit configurations are a practical example: the same contents in a different housing can change both the label fields and the component register you need to maintain.
A verification routine you can run before each order
Run the same five checks every time, and record the outcome against the SKU rather than against the supplier:
- Legal identity. Confirm the certificate holder is the legal manufacturer you contracted, not a related trading entity.
- Scope by SKU. Read the scope statement and confirm it names your product category and production site.
- Register confirmation. Resolve the certificate number in the issuing body’s register, and confirm the notified body in NANDO where CE marking applies.
- Product-level evidence. Match the declaration of conformity to your exact model, and confirm the cited test reports are current and from an accredited laboratory.
- Change control. Set the next review date from the certificate expiry and from any component or site change.
Keep the result with the purchase order. When you verify medical product certification this way, the file answers a regulator’s question in minutes instead of weeks, and the answer is evidence rather than recollection. Buyers who need to apply the same discipline across a multi-line catalogue tend to build it into a standard document schedule rather than handling it order by order.
FAQ about verifying medical product certification
Does an ISO 13485 certificate prove a product is compliant?
No. ISO 13485 certifies that the manufacturing operation runs a controlled quality management system. It says nothing about whether a specific model conforms to a product standard or meets the regulatory requirements of a destination market. You need the quality system certificate and the product-level evidence separately, plus a scope statement that names your product category.
How do I check whether a certificate is still valid?
Take the certificate number and search it in the issuing certification body’s own register, not the PDF. Confirm the holder name matches the legal manufacturer, the scope covers your product, and the expiry date is current. Then ask for the most recent surveillance audit summary, because a certificate depends on those audits being passed between recertifications.
What is the difference between a declaration of conformity and a test report?
The declaration of conformity is the manufacturer’s signed statement of responsibility, naming the model, intended purpose and applicable regulation. A test report is the laboratory evidence produced against a cited standard. The declaration is the commitment; the report is the support. A declaration without citable test reports behind it is a claim, not evidence.
Can I verify a European certificate if the manufacturer is outside the EU?
Yes, and additional checks apply. Non-EU manufacturers need an authorized representative established in the EU, and that representative’s details should appear in the documentation. Verify the notified body in NANDO, check the certificate status and device registration in EUDAMED where the modules are populated, and confirm the representative’s appointment is current.
How often should certification documents be re-verified?
Re-verify before each large order and whenever a model, site or component supplier changes. Certificates have finite validity and depend on surveillance audits. Set a review date from the expiry date rather than the order date, and scan for any scope change to your SKU as a trigger for a fresh document set.
What should I do if a certificate number does not resolve?
Stop the order and ask the supplier to explain. A number that does not resolve in the issuing body’s register means the certificate is not valid for your purposes, whatever the PDF looks like. Ask for the correct certificate and its register entry. If the supplier cannot provide a resolving number, log the claim as unverified and source elsewhere.