How to Handle Inconsistency of Quality System Certificates for EU Registration of Medical Devices?

How to Handle Inconsistency of Quality System Certificates for EU Registration of Medical Devices?

When applying for EU CE marking, if your company's ISO 13485 certificate, MDSAP certificate, or other quality system documentation does not align with EU regulations or notified body requirements, it may lead to registration delays, technical file corrections, or even certification rejection. The first step is to identify the specific type of inconsistency: Does the scope of the system mismatch the product category? Is the certificate version outdated relative to current regulations (e.g., MDR/IVDR)? Or does the manufacturing site covered by the system differ from the registration applicant? For each case, strategies such as supplementary audits, updating system documents, narrowing or expanding certification scope, or reapplying may be required.

Core Problem

Quality system certificate inconsistency is a common but often underestimated obstacle in EU medical device registration. Typical scenarios include: the system scope does not include design and development (mandatory for Class IIa and above), the certificate is issued by a non-EU-recognized notified body, the covered manufacturing site does not match the CE registration application, or the certificate has not been updated to reflect ISO 13485:2016 or MDR/IVDR additional requirements. The core issue is that notified bodies require quality system evidence to fully cover the product lifecycle (design, production, post-market surveillance) and to be harmonized with applicable regulations. Inconsistencies can lead to incomplete technical files and subsequent supplementary audits or rejection.

Registration Judgment Logic

Enterprises can follow this logic to determine the course of action:

• Confirm whether the product falls within the scope of EU medical device regulation (MD/IVD/custom-made/AIMD, etc.).
• Determine the risk class per classification rules (Class I, IIa, IIb, III, or IVD Class A–D) to identify whether notified body review is required.
• Check whether the existing system certificate is issued by an EU-recognized notified body (listed under (EU) 2019/1387) and whether its scope covers the product category and design activities.
• Compare ISO 13485:2016 with MDR Annex IX or IVDR Annex VII requirements to assess gaps (e.g., post-market surveillance, clinical evaluation, vigilance system).
• If holding an MDSAP certificate, verify whether it covers EU regulatory modules (MDR/IVDR); if not, additional conversion is needed.
• For multi-country registrations (e.g., GHWP, Southeast Asia, Middle East, Latin America), evaluate whether existing documentation can be reused, noting local quality system requirements (e.g., local agent review, language, regulatory differences).

Required Documents and Evidence

Key documents to resolve inconsistencies include:

• Valid copies of ISO 13485 or MDSAP certificates (Chinese and English versions).
• Quality manual and procedure documents (especially design control, risk management, CAPA, post-market surveillance, clinical evaluation).
• Notified body audit reports (if available) and evidence of non-conformance resolution.
• Product classification documents (e.g., MDCG guidelines or classification rules).
• Quality system section of the technical file (describing how the system meets Annex IX/XI requirements).
• Authorized representative agreement (European representative).
• Post-market surveillance plan and PSUR/PMCF report templates (if applicable).

Common Mistakes

• Directly translating and submitting domestic NMPA documents without rearranging evidence per target market requirements.
• Excessive model variants with insufficient test reports, clinical evidence, or label coverage.
• Selecting local agents based solely on sales cooperation without clarifying regulatory responsibilities, certificate control, and post-market obligations.
• Inconsistencies between labels, instructions for use, promotional materials, and registration documents, leading to corrections or post-market compliance risks.
• Failing to plan for multi-country document reuse, resulting in repeated work and increased costs.

Enterprise Preparation Checklist

• Confirm the certificate issuer is listed in the EU Notified Body database (NANDO).
• Verify the certificate scope covers the product category (e.g., wording such as “design, development, production of medical devices”).
• Review the quality manual to ensure MDR/IVDR requirements (e.g., clinical evaluation, post-market surveillance, vigilance) are incorporated.
• If the certificate is expiring, initiate recertification audits early to avoid gaps.
• Prepare a gap analysis table listing differences between the current system and MDR/IVDR requirements, along with remedial actions.
• Designate a European authorized representative and ensure their role and responsibilities are documented in the quality system.
• For multi-country registrations, create a core quality system document library and develop localization templates.
• Retain all audit reports and corrective evidence for potential notified body audits.

AIMEILI's Perspective

Enterprises often mistakenly believe that “having a certificate is enough.” In reality, notified bodies focus on whether the system is effectively implemented and covers the product lifecycle. We recommend prioritizing a system-to-regulation gap analysis early in the project, rather than rushing to submit technical files. ISO 13485 is the foundation, but must be supplemented with MDR/IVDR-specific requirements such as post-market surveillance, periodic clinical evaluation updates, and economic operator registration. Elements that can be reused include quality management principles, risk management framework, and CAPA processes. Elements that must be localized include declarations of conformity, registration information, language, authorized representative documentation, and certain country-specific quality system add-ons (e.g., Brazil ANVISA GMP requirements). The role of the local agent (authorized representative) is often underestimated: they are not just document couriers but also controllers of the certificate and interfaces for changes; if the agent changes or becomes invalid, certification may be voided. For multi-country registrations, it is advisable to first complete a “core quality system document” and then add or subtract based on each country's regulatory requirements, significantly reducing repetitive work and correction risks.

Frequently Asked Questions

Q: Can my ISO 13485 certificate issued by UKAS (United Kingdom) be used for EU CE registration?

A: After Brexit, UKAS is no longer an EU notified body, so its certificate cannot be directly used for CE marking. You must convert the certificate to one issued by an EU notified body (e.g., TÜV SÜD, BSI NL) or obtain a new certificate through parallel audits. Some notified bodies may accept a “limited supplementary audit” based on the UKAS report to issue a new certificate, but this must be confirmed in advance.

Q: How to handle the situation if the quality system scope does not include design?

A: For Class IIa and above, notified bodies mandate that the system cover design and development. If your current certificate covers only production, you must apply for scope extension to include design. This typically requires submitting design control procedures and undergoing a design-related on-site audit. For Class I products (non-sterile, no measuring function), design coverage may be exempted, but it is recommended to include it to simplify future upgrades.

Q: Can an MDSAP certificate replace ISO 13485 for CE registration?

A: The MDSAP certificate itself is not equivalent to ISO 13485, but MDSAP audits cover ISO 13485 requirements. EU notified bodies generally accept MDSAP as evidence of system audits, but must additionally verify whether the audit included MDR/IVDR-specific content (e.g., PMCF, post-market vigilance). In practice, many notified bodies still require a separate ISO 13485 audit or at least a gap assessment.

Implementation Recommendations

In actual projects, enterprises should decompose the issue into five tasks: regulatory judgment, document preparation, evidence reuse, localization, and post-market maintenance, rather than having one department compile documents temporarily. This allows early identification of gaps and ensures consistent understanding of target country requirements across sales, R&D, quality, and regulatory teams. If the company plans to enter multiple markets simultaneously, it is advisable to first create a unified core technical file, then supplement with authorized representative details, labels, languages, forms, and local agent documents for each country. The efficiency of multi-country registration often depends on the uniformity of the initial document framework, not the speed of submission to a single country.

Key execution steps:

• Confirm whether the product falls under the target country's medical device regulatory scope.
• Determine risk class, registration pathway, and applicant.
• Verify that technical files, quality system documents, and clinical evidence are mutually supportive.
• Clarify local agent, authorized representative, and certificate control.
• Establish mechanisms for post-market changes, recertification, and vigilance event handling.

When addressing the issue of inconsistent quality system certificates for EU registration, enterprises should manage regulatory judgment, documentation, applicant, time to market, and post-market responsibilities on a single project timeline. This prevents the regulatory team from focusing only on documents, the sales team from focusing only on market launch, and the quality team from being unaware of target market requirements, ultimately avoiding misalignment between registration pathway and document preparation.

If the target market is a GHWP member or highly aligned with international rules such as IMDRF, ISO 13485, ISO 14971, or UDI, enterprises should prioritize identifying reusable documents, then decide which content needs localization, translation, supplementary declarations, retesting, or local agent signatures. This order is more reliable than simply collecting documents per country and helps control costs. During project execution, maintain records of product classification basis, technical file versions, label/instruction versions, test report coverage, clinical evidence sources, local agent communication, and correction feedback. These records are critical for future recertification, changes, unannounced audits, or post-market events to quickly demonstrate compliance.

Published: 2026-07-25 08:44 | Updated: 2026-07-25 08:44

Content compiled from AIMEILI registration practice database, medical device international registration knowledge base, and public regulatory information. Specific projects should rely on the latest requirements of target country regulatory authorities and product data.