Verifying Notified Body Certificates for Medical Devices and IVDs

As a distributor or importer of medical devices or in vitro diagnostic medical devices (IVDs) in the European Union, you bear significant responsibilities under the Medical Device Regulation (MDR) (EU) 2017/745 and the In Vitro Diagnostic Medical Device Regulation (IVDR) (EU) 2017/746. A critical aspect of your due diligence is verifying the validity and scope of Notified Body certificates issued for the devices you place on the market. This ensures that only compliant devices enter the supply chain.

#The Role of Notified Bodies

Notified Bodies are independent third-party organisations designated by EU Member States to assess the conformity of certain medical devices and IVDs with the applicable regulatory requirements before they can be placed on the EU market. Their designation is based on their competence, independence, and impartiality. For medium- and high-risk devices, a Notified Body assessment, culminating in a certificate, is mandatory for CE marking.

As an economic operator, you must verify that the manufacturer has indeed obtained a valid certificate from a Notified Body where required, and that this certificate covers the specific device in question. This is explicitly stated for importers in Article 13(2)(b) MDR and Article 13(2)(b) IVDR, and for distributors in Article 14(2)(b) MDR and Article 14(2)(b) IVDR.

#The NANDO Database: Current Verification Tool

Until the full implementation of EUDAMED, the primary public resource for identifying Notified Bodies and their scopes of designation is the New Approach Notified and Designated Organisations (NANDO) information system. This database is maintained by the European Commission.

When verifying a Notified Body certificate, you should:

• Confirm the Notified Body's designation: Check that the Notified Body indicated on the certificate is listed in NANDO and holds a current designation for the relevant regulations (MDR or IVDR).
• Verify the scope of designation: Ensure the Notified Body's scope in NANDO covers the specific device type, class, and conformity assessment procedure applied to the device in question. For example, if a device is a Class IIb medical device, the Notified Body must be designated for Class IIb devices under the MDR.
• Check the certificate details: Compare the certificate number, date of issue, and expiry date on the document provided by the manufacturer against any available public record, where applicable. Also, ensure the certificate clearly identifies the manufacturer and the specific devices or groups of devices covered.

Example from NANDO database: A Notified Body's entry in NANDO will list its identification number (e.g., NB 0123), the EU regulations under which it is designated, and a detailed scope of its designation, often broken down by device class, codes (e.g., according to Annexes VI and VII of the MDR/IVDR), and conformity assessment modules.

#EUDAMED: The Future of Certificate Verification

EUDAMED, the European Databank on Medical Devices, is designed to be the central repository for medical device and IVD information in the EU. Its full implementation will significantly streamline the process of certificate verification.

Under Article 56(4) MDR and Article 52(4) IVDR, Notified Bodies are required to enter information concerning certificates issued, suspended, or withdrawn, and their amendments, into EUDAMED. This includes the certificate number, its status (issued, suspended, withdrawn), and the scope of its coverage. This centralisation will make it easier for economic operators and competent authorities to access up-to-date certificate information.

While EUDAMED's modules are being implemented in stages, the module for Notified Bodies and Certificates is not yet mandatory. However, once mandatory, it will become the definitive source for certificate verification. It is essential for economic operators to understand What changes for distributors and importers now that EUDAMED modules are mandatory, including how this affects certificate checks.

Current Status Caution: The full mandatory use of all EUDAMED modules, including the module for Notified Bodies and Certificates, is still subject to official announcement by the European Commission. Until then, the NANDO database remains the primary public source for Notified Body designation scope, and certificate verification relies on due diligence with the manufacturer's provided documentation. Readers should confirm the current status and scope with their national competent authority.

#Manufacturer's Obligation to Provide Information

Manufacturers have a clear obligation to provide economic operators with the necessary information to perform their duties. This includes providing copies of relevant certificates. According to Article 10(4) MDR and Article 10(4) IVDR, manufacturers must draw up and keep up-to-date documentation on the devices, including certificates issued by a Notified Body. It is part of the importer's and distributor's due diligence to ensure access to these documents.

#Steps for Certificate Verification

Here is a systematic approach for distributors and importers:

1. Obtain the certificate: Request a complete, legible copy of the Notified Body certificate from the manufacturer. It must be in an official EU language, or accompanied by a translation if necessary for local authorities.
2. Verify Notified Body identity: Check the Notified Body's identification number (e.g., NB 0123) and name on the certificate against the NANDO database. Ensure it is a valid Notified Body designated under the MDR or IVDR.
3. Cross-reference scope in NANDO: Confirm that the Notified Body's designation in NANDO explicitly covers the conformity assessment procedure, device class, and specific type of device listed on the certificate. Pay close attention to any limitations or exclusions in the scope.
4. Check certificate details: Verify the certificate number, issue date, and expiry date. Ensure the manufacturer's name and address on the certificate match the details for the legal manufacturer of the device. Confirm that the devices listed or referenced by the certificate correspond precisely to the devices you are placing on the market.
5. Look for annexes: Certificates often reference annexes that detail the specific devices or product families covered. Ensure you have access to these annexes and that the devices are correctly listed.
6. Confirm status: Check for any indications of suspension or withdrawal in NANDO or, once available, in EUDAMED. If there is any doubt, contact the manufacturer and, if necessary, the Notified Body directly.

#Common mistakes in practice

• Not checking the Notified Body's designation scope: Assuming a Notified Body certificate is valid because the Notified Body is listed in NANDO, without verifying if its scope covers the specific device class or type.
• Failing to obtain the full certificate: Accepting a partial certificate or summary, which may omit critical details like device lists in annexes.
• Not verifying the expiry date: Placing devices on the market with an expired certificate or one nearing expiry without confirmation of renewal.
• Overlooking manufacturer details: Not confirming that the manufacturer listed on the certificate is the legal manufacturer of the devices you are importing/distributing.
• Ignoring changes in certificate status: Failing to re-check certificate status periodically, especially if there are concerns, potentially missing a suspension or withdrawal.
• Misinterpreting device coverage: Assuming a general certificate covers all products from a manufacturer, rather than verifying it covers the specific model or variant.
• Not understanding transitional provisions: Applying MDR/IVDR requirements to devices covered by transitional provisions under MDD/IVDD, or vice versa, without proper certificate verification for the applicable regulation.

#Record Keeping

Maintain thorough records of all certificate verification activities. This includes copies of the certificates, dates of verification, and any communication with manufacturers or Notified Bodies. This documentation is crucial for demonstrating your compliance with Article 13(2) MDR and Article 14(2) MDR (and corresponding IVDR articles) during inspections by national competent authorities. For more information on your record-keeping duties, refer to EUDAMED Actor Registration and the Single Registration Number (SRN).

Upon full EUDAMED implementation, certificate information will be directly accessible, reducing the manual burden of verification. However, the responsibility for ensuring the devices you supply are compliant remains yours. Leveraging platforms that integrate EUDAMED data, such as the EUDAMED AI platform, can assist in streamlining this process by providing structured access to information that supports your regulatory obligations.

This material is for information only and is not legal advice. For binding interpretation consult your national competent authority.