How to Use ISO 13485 Certificates for Overseas Registration of POCT Products

How to Use ISO 13485 Certificates for Overseas Registration of POCT Products

For POCT product overseas registration, the ISO 13485 certificate serves as evidence of quality system compliance, but requirements vary significantly across target countries. Companies must first determine whether the product falls under the target country's medical device regulatory scope, then select the registration pathway according to product risk classification (e.g., Class II or III), and ensure the certificate is valid, covers all relevant product components, and is aligned with the registration entity.

Applicable Scenarios and Core Questions

When registering POCT products overseas, the ISO 13485 certificate is a foundational document proving the manufacturer's quality system meets international standards. However, different countries recognize the certificate in different ways:

• The EU CE marking requires ISO 13485 as a system basis, but notified body audits are not mandatory for the certificate itself.
• The US FDA quality system requirements are based on QSR 820, but ISO 13485 may be accepted as alternative evidence.
• Southeast Asian countries such as Thailand and Indonesia typically directly require a valid ISO 13485 certificate.

The core question is whether the certificate is used as one of the registration application documents or as a substitute for a system audit. Companies need to clarify whether the target country's regulations treat the certificate as a precondition for registration or as a basis for simplified review.

Another critical point is the scope of the certificate. POCT products may include instruments, reagents, software, and other components. The certificate must explicitly cover the design, development, production, and service of these components. If the certificate only covers some components, the registration may be considered incomplete. Additionally, the certificate's validity period and the most recent surveillance audit records must be considered, as most countries require the certificate to remain valid throughout the registration process.

Registration Decision Logic

Step 1: Confirm whether the target country includes POCT products in medical device regulatory scope. For example, China's NMPA explicitly classifies POCT as Class II or III medical devices, while some Middle Eastern countries may manage them as medical equipment.

Step 2: Determine the registration path based on product risk class. Low-risk products (e.g., some home-use test strips) may be exempt from registration or eligible for self-declaration in some countries, while high-risk products (e.g., infectious disease testing instruments) usually require full review.

Step 3: Assess whether existing evidence is sufficient to support registration. If the manufacturer already has CE or FDA registration documentation, some technical files can be reused, but national differences (e.g., clinical performance requirements) must be considered.

Step 4: Confirm the quality system evidence: ISO 13485 certificate, MDSAP certificate, or local system audit report.

Step 5: Appoint a local agent or authorized representative to communicate with regulatory authorities.

Step 6: Develop a post-market surveillance plan, including adverse event reporting and product change notifications.

For multi-country registration, a strategy of “core documents + localization conversion” is recommended. For example, risk management reports, performance testing protocols and reports, and stability data can serve as universal documents, while labels, instructions for use, and clinical evaluation reports (if required) must be adapted to meet each country's requirements.

Documentation and Evidence

When using an ISO 13485 certificate for registration, the following documents are typically required:

• Copy of the certificate (in English or the target country's official language).
• Scope statement of the certificate, clearly indicating the types and activities of POCT products covered (e.g., design, production).
• Most recent surveillance or recertification audit report demonstrating continuous system operation.
• List of quality system documents, such as the quality manual and procedure files (at least including document control, records control, internal audit, CAPA, and nonconforming product control).
• Product technical documentation, including product description, intended use, performance characteristics (accuracy, precision, clinical sensitivity/specificity), risk management report (per ISO 14971), and software validation files (if applicable).
• Clinical evidence: clinical evaluation report or clinical trial report (depending on product classification and regulatory requirements); for products already on the market, literature references or comparative testing may be cited.
• Labels and instructions for use: in the target country's official language and compliant with local requirements (e.g., symbols, warnings).
• Local agent authorization letter (required by some countries).
• Post-market surveillance plan, including adverse event reporting procedures.

If the certificate is issued by a recognized certification body (e.g., TÜV SÜD, BSI), its authority is higher. However, some countries do not recognize foreign certification bodies and require review by a local accredited body. For example, Brazil's ANVISA requires manufacturers to hold an INMETRO-accredited system certificate or submit to an ANVISA on-site audit.

Common Errors

• Certificate scope does not cover POCT product: For instance, the certificate only covers reagent production but not instruments or software, leading to a determination of incomplete system during registration.
• Certificate expires during registration: Many countries require the certificate to remain valid throughout the review period; expiration is treated as invalid documentation.
• Certificate version does not align with target country standards: Some countries require ISO 13485:2016, but the company still holds an older version.
• Missing translation or notarization of the certificate: Some countries only accept official language versions; advance preparation is needed.
• Technical documents are disconnected from system documents: For example, the risk management report does not reflect the risk management procedures in the quality system, raising review concerns.
• Improper selection of local agent: The agent must be qualified, authorized, and able to assume legal responsibility.
• Post-market surveillance plan missing or vague: After registration, changes or complaints must be promptly addressed through the system; otherwise, certificate maintenance may be affected.

Company Preparation Checklist

• Confirm the ISO 13485 certificate is valid and covers all POCT products and activities.
• Collect the certificate copy, audit reports, and certification body recognition information.
• Prepare technical documentation, including performance tests, risk management, clinical evaluation, and stability data.
• Develop labels and instructions for use, including user manuals, packaging labels, and quick reference cards, and translate them into the target country's language.
• Designate a local agent or authorized representative and provide the authorization letter and agent qualification evidence.
• Establish a post-market surveillance system, including adverse event reporting, CAPA, and product change control procedures.
• Check target-country-specific requirements, such as Brazil's MDSAP or ANVISA on-site audit, and China's NMPA system inspection.
• Plan the registration timeline in advance, considering certificate audit cycles and registration review periods.

AIMEILI Regulatory Interpretation and Business Impact

When using ISO 13485 certificates for POCT overseas registration, the most common misjudgment is assuming the certificate is sufficient on its own and overlooking the target country's specific requirements for system evidence. In reality, the certificate is only the foundation. Many countries also require evidence of system operation (e.g., audit reports) or direct on-site inspections. For example, Southeast Asian countries generally accept ISO 13485 certificates but require an English version with attached audit records, while China's NMPA not only requires the certificate but also conducts system verification. At the project planning stage, companies should first confirm the target country's quality system requirements to avoid unnecessary preparation.

With respect to document reuse, core technical documents such as risk management and performance testing can be reused to a large extent, but differences between countries must be reviewed (e.g., clinical evaluation requirements may differ). Control of the local agent and certificate is critical: the certificate must be consistent with the entity applying for registration, and any changes or renewals of the certificate must be promptly communicated to the agent; otherwise, market authorization status could be affected. For multi-country registration, establishing a unified system document library and adjusting localized content (e.g., language, symbols, regulatory references) according to country requirements can significantly reduce the risk of duplicate work and correction requests, improving registration efficiency.

Frequently Asked Questions

Q1: The ISO 13485 certificate is about to expire, but registration is still under review. What should we do?

You must complete the recertification audit and obtain a new certificate as soon as possible, and provide transition evidence (e.g., a recertification confirmation from the certification body) to the reviewing authority. Most countries require the certificate to remain valid during the registration process; if it expires, review may be suspended or resubmission required. It is recommended to start recertification at least six months before expiration.

Q2: The certificate scope covers only reagents, not the POCT instrument. Can we use the same certificate?

No. The certificate scope must explicitly cover all products intended for registration. If the instrument is not included, you must first apply to the certification body for scope extension, including necessary audits (e.g., instrument design and production). Otherwise, the registration will be considered incomplete, leading to corrections or rejection.

Q3: Can an ISO 13485 certificate replace an MDSAP certificate for Brazil?

No. Brazil's ANVISA requires manufacturers to hold an MDSAP certificate or accept an ANVISA on-site audit. The ISO 13485 certificate can serve as the system foundation, but it does not independently satisfy Brazilian requirements. Companies should choose to apply for MDSAP or prepare for an ANVISA inspection. MDSAP can cover multiple countries and is often a more efficient option.

Implementation Recommendations

In practice, companies should break this issue into five tasks—regulatory determination, documentation preparation, evidence reuse, localization conversion, and post-market maintenance—rather than leaving it to a single department to compile documents temporarily. This approach helps identify document gaps earlier and ensures that sales, R&D, quality, and regulatory teams have a consistent understanding of target country requirements.

If a company plans to enter multiple markets simultaneously, it is advisable to first develop a unified core technical document set, then supplement country-specific authorizations, labels, language, forms, and local agent documents. The efficiency of multi-country registration often depends on whether the upfront document framework is unified, rather than the submission speed in any single country.

First confirm whether the product falls within the target country's medical device regulatory scope.

• Then confirm the risk classification, registration path, and applicant entity.
• Verify that technical documents, quality system, and clinical evidence support each other.
• Clarify local agent, authorized representative, and certificate control rights.
• Establish post-market change, renewal, and vigilance event maintenance mechanisms.

For further reading, refer to related topics such as POCT product overseas registration test report reuse, local agent selection, and lifecycle maintenance. All content is based on AIMEILI's regulatory affairs database, international medical device registration knowledge base, and publicly available regulatory information. Specific projects should always follow the latest requirements of the target country's regulatory authority and the actual product documentation.