CE Marked, but Is It Compliant? How to Verify a Medical Device Supplier Under EU MDR

Know what each document actually proves

This guide is for purchasing and regulatory teams checking routine EU supply of medical devices under Regulation (EU) 2017/745. In vitro diagnostic devices follow the separate IVDR. Custom-made devices, investigational devices and special derogations need their own review. The checks below are a suggested purchasing workflow; your legal duties depend on whether you act as an importer, distributor, manufacturer or end user.

Step 1: identify the device and the companies behind it

Ask for photographs of the actual device and packaging labels, current instructions for use where required, and the documents below. Keep the supplier’s quotation and advertised claims so you can compare them with the manufacturer’s intended purpose.

• Exact product. Record brand, model, catalog number, accessories, relevant software version, sterile status and intended users or patients. Request the Basic UDI-DI and device UDI-DI where applicable; explain any legacy-device identifiers separately.
• Responsible companies. Identify the legal manufacturer and its address, the seller’s role, the EU authorised representative for a non-EU manufacturer, and the importer where applicable. A reseller’s name can legitimately differ from the manufacturer’s.
• Conformity basis. Request the current signed declaration and, if the route requires them, complete notified-body certificates with schedules, supplements and device mappings. If the supplier relies on an older Directive, request the transition evidence in Step 5.

Step 2: read the declaration before the certificate

For an MDR device, compare the declaration with Annex IV. Check the legal manufacturer and authorised representative where applicable, product identification and intended purpose, Basic UDI-DI, risk class, the statement of conformity with Regulation (EU) 2017/745, and the place, date and authorised signature. Where a notified body is involved, check its identity, the procedure and certificate references. The declaration should be current and unambiguously cover the offered device; a generic company statement is insufficient.

Ask the manufacturer to explain the classification rule and conformity assessment route. Class I devices that are neither sterile, measuring nor reusable surgical instruments generally use the manufacturer’s own declaration without notified-body involvement. Those three Class I categories require notified-body involvement limited to the relevant aspects. Do not demand a notified-body certificate merely because a device bears a CE mark, or accept ‘Class I’ without checking that the classification fits.

Step 3: verify the notified body and the certificate separately

Open the Commission’s notified-bodies page and follow its MDR list in NANDO. Search by the four-digit notified-body number or name. Check designation under Regulation (EU) 2017/745 and the relevant device and procedure scope. Designation under another law, including the IVDR, is not enough for an MDR assessment. For a legacy certificate, check the applicable Directive and transition arrangements instead of treating it as an MDR certificate.

NANDO identifies the body and its designation; it does not authenticate every certificate bearing that number. Compare the certificate’s manufacturer, legislation, number, assessment route, scope, dates and attached schedules. Check available certificate status information and any amendments, suspension or withdrawal. If authenticity or coverage remains unclear, contact the issuing body using independently verified contact details and request confirmation of the exact certificate and product scope.

A genuine quality-system certificate can cover a device group rather than list every commercial model. Ask for a documented link from the model to that group and any additional certificates required by the route. A standalone ISO 13485 certificate or laboratory report does not establish MDR conformity.

Step 4: cross-check EUDAMED without treating it as an approval list

Use the EUDAMED public site to compare the manufacturer or authorised representative’s actor record, device identifiers and available certificate records with the supplier’s documents. Search with the SRN, UDI-DI, Basic UDI-DI or certificate number as appropriate to the search screen. An SRN identifies an actor; it is not a product approval number.

The first four modules became mandatory on 28 May 2026, but registration has transitional rules. New MDR certificates issued from mandatory use must be registered; qualifying earlier MDR certificates have a later registration deadline, 28 May 2027. Device registration also depends on placement history and the applicable transition. A missing search result alone therefore does not establish unlawful supply. Ask for the applicable deadline and supporting evidence, and verify unresolved certificate questions with the issuer.

A distributor acting only as a distributor does not register as an actor under MDR Article 31, although national registration rules may apply. Check the seller’s actual role before treating the absence of its own SRN as a failure.

Step 5: investigate older certificates before accepting or rejecting them

An MDD or AIMDD certificate with a printed expiry date in the past may still support a qualifying legacy device under Article 120. The extension is conditional, not a blanket permission until 2027 or 2028. Ask for a manufacturer’s declaration identifying the devices, certificates, applicable end date and fulfilment of the transition conditions. Evidence may include a notified-body confirmation letter or the relevant application and agreement records; a particular letter template is not mandatory.

The review must address continued Directive compliance, no significant change in design or intended purpose, no unacceptable risk, and the applicable QMS, application and written-agreement conditions. For the extended Article 120(3c) route, the key 2024 milestones were the QMS and formal application by 26 May and the written agreement by 26 September. Check the exact device category and any earlier-expiry conditions with the regulatory reviewer. An application alone is not MDR certification.

Step 6: match the documents to what will actually arrive

• Product and purpose. Compare the offered model, accessories, software, sterile condition and claims with the declaration, certificate scope and instructions. Request a written mapping for differing brands or catalog numbers; a similar product photograph does not establish coverage.
• Labels and supply-chain roles. Check the manufacturer, authorised representative and importer information where applicable, plus CE marking, relevant notified-body number and required identifiers. Confirm the information and language required for the destination Member State.
• Ongoing supply. Ask about affected lots, safety notices or recalls, storage and transport conditions, and a contact for complaints and corrective actions. Importers and distributors have their own verification duties; a supplier assurance does not transfer those responsibilities.

Worked example: a real certificate, but an unresolved model

Suppose a supplier offers an upper-arm blood-pressure monitor called Model Home and sends an ISO 13485 certificate plus an MDR certificate for a manufacturer’s monitoring-device group. The declaration identifies Model Clinic, while the advertisement adds a home-use claim. This is a hypothetical example, not a finding about a real supplier.

The certificate’s existence does not resolve the model or intended-purpose gap. Ask the manufacturer to connect Model Home to the declared device, provide its current labeling and explain whether home use is within the assessed scope. Verify the issuer and relevant certificates. If the manufacturer supplies a valid model mapping and matching evidence, record it; if the differences remain unexplained, keep the purchasing review open and escalate them.

Keep a dated supplier-verification record

Save one review sheet per model: device and intended purpose; legal entities and roles; declaration version; classification and route; certificate numbers and status; NANDO and EUDAMED searches with dates; any legacy-transition basis; label and model mappings; open questions, owner and decision. Retain the documents reviewed and revisit the conclusion when the product, manufacturer, claims or certificate status changes.

This document check supports a purchasing decision. It cannot by itself establish the device’s clinical performance or replace the technical, quality and ongoing regulatory review appropriate to your role. Resolve material gaps before accepting the supply.

Review MDR supplier evidence with Regunow

Use Regunow to research EU medical device requirements, examine official references and analyze supplier documents. Bring the device identity, conformity route and evidence gaps together in a report for your regulatory and purchasing team’s review.