To verify an ISO 13485 certificate, match the supplier’s exact legal identity and covered site to the certificate, confirm the standard edition, scope, issue and expiry dates, identify the external certification body, and verify certification and accreditation status through IAF CertSearch or directly with the named bodies. Then record what the certificate does—and does not—support in the supplier file.
This is a procurement and quality-document check, not proof that every product is approved, registered, sterile, reusable or suitable for a particular procedure. Product conformity, market authorization and technical evidence must be reviewed separately for the exact device and destination.
First, understand what an ISO 13485 certificate represents
ISO 13485 is a quality-management-system standard for organizations involved in medical devices and related services. The current official record is ISO 13485:2016, which ISO reviewed and confirmed in 2025. A certificate may provide evidence that an external certification body assessed a defined organization, site and scope against that standard.
ISO itself does not certify organizations or issue certificates. ISO explicitly states that certification is performed by external certification bodies and that an organization should not be described as “certified by ISO.” That distinction is a useful first quality gate: the document should identify the actual certification body and provide enough information for independent verification.
Check eight fields before accepting the certificate
| Field | What to compare | Why it matters |
|---|---|---|
| 1. Legal entity | Exact organization name and any company identifier on the certificate versus the contracting supplier | A similar trading name may belong to a different legal entity |
| 2. Covered site | Address or listed sites versus the location performing the quoted activity | A certificate for one office or factory should not be silently extended to another |
| 3. Standard | ISO 13485:2016 and any stated national adoption | Confirms which edition the certificate references |
| 4. Scope | Products, processes or services named in the certification scope | A broad company relationship does not prove the quoted activity is covered |
| 5. Certificate identity | Certificate number and any verification code | Provides the key for issuer or database checks |
| 6. Dates and status | Issue, effective, expiry, suspension or withdrawal information | A legible document can still be expired or no longer active |
| 7. Certification body | Name and contact route for the body that issued the certificate | ISO does not issue the certificate; the external body must be identifiable |
| 8. Accreditation | Accreditation body, mark and current status where applicable | Supports verification of the certification body’s recognized accreditation scope |
Match the legal entity and manufacturing site
Begin with the quotation, contract and supplier master record. The certificate name should match the legal entity whose quality system is being relied on. If the supplier uses a brand, parent company, export office or related manufacturer, document the relationship instead of treating similar names as equivalent.
Next compare the site. Ask which location designs, manufactures, finishes, packages, labels, stores or releases the quoted device, as applicable. Check whether that location appears on the certificate or an attached multi-site schedule. If a relevant site is missing, request an explanation and supporting evidence; do not edit the scope in your own record to make it fit.
Read the scope literally
The scope is more important than a logo on the page. Record the exact wording and determine whether it covers the activity on which the buyer intends to rely. A certificate referring to distribution, for example, should not automatically be treated as manufacturing certification. Likewise, a scope for one device family or service should not be generalized to unrelated products.
Where wording is broad or ambiguous, ask the certification body or supplier for clarification. Keep the original certificate and any schedule together. The conclusion in the qualification record should be bounded: “certificate identity and status verified for the stated entity, sites and scope,” not “all products approved.”
Verify the issuer and current status independently
ISO recommends using the International Accreditation Forum’s IAF CertSearch database or contacting the relevant certification or accreditation body directly. Search using the certificate number and legal entity where available. Compare the database result with the supplied copy, including status, scope, sites and dates.
A missing public result is a reason to investigate, not an automatic fraud finding. Some records may require direct confirmation. Use contact details obtained independently from the certification or accreditation body’s official website rather than relying only on an email or link printed on the document.
- Save the verification date, route and result.
- Retain a copy or reference permitted by the verification service.
- Record discrepancies and the evidence used to close them.
- Set a review reminder before expiry or surveillance milestones relevant to your procedure.
Do not confuse QMS certification with product authorization
An ISO 13485 certificate addresses a defined quality-management-system scope. It does not alone establish that a particular device is cleared, approved, registered or lawfully placed on every market. Review product classification, conformity or premarket evidence, labels, economic-operator roles and registrations separately for the destination.
This distinction is especially important in the United States. The FDA’s Quality Management System Regulation became effective on 2 February 2026 and incorporates ISO 13485:2016 by reference, with additional US legal requirements controlling where applicable. That regulatory alignment does not turn a third-party ISO 13485 certificate into FDA approval or prove that a specific device satisfies its applicable US premarket requirements.
For the European Union, determine whether notified-body involvement applies to the exact device and route. Where it does, verify the body and certificate through official European Commission resources, including NANDO or the applicable EUDAMED module. Do not assume that every product requires the same route or that a QMS certificate replaces product conformity evidence.
Use a bounded supplier-qualification conclusion
A strong review separates three conclusions:
- Document authenticity and status: the certificate identity, issuer and current status were verified through a documented route.
- Relevance: the named entity, site and scope match the activities relevant to the proposed supply.
- Remaining product review: product-specific, market-specific and commercial evidence is still required.
This structure prevents a valid certificate from becoming an all-purpose approval stamp. It also makes the supplier file easier to update when a site, scope, certificate number or status changes.
Certificate red flags that require clarification
- The document says the organization is “certified by ISO” or uses the ISO logo as a certification mark.
- The legal name or site differs from the supplier or manufacturing location without a documented relationship.
- The scope is missing, unreadable or unrelated to the quoted activity.
- The certificate number, issuer, issue date or expiry date is absent.
- The status cannot be confirmed and the issuer cannot be reached through independently obtained details.
- Editing, inconsistent fonts, missing pages or conflicting dates suggest the copy may be incomplete or altered.
- The supplier presents the QMS certificate as proof of FDA approval, EU product conformity or authorization in every market.
A red flag should trigger a documented follow-up. It should not be converted into a public allegation without verified evidence.
Questions to send the supplier
- Please provide a complete, legible certificate and every site or scope schedule.
- Which legal entity and facility will perform each activity for the quoted products?
- What is the certificate number, certification body and independent verification route?
- Does the stated scope cover the proposed manufacturing or supply activity?
- Have there been any scope, site, status or certification-body changes since issue?
- Which separate product and destination-market documents apply to the exact references quoted?
Frequently asked questions
Can a company be certified by ISO?
No. ISO develops standards but states that it does not perform certification or issue certificates. External certification bodies perform certification. Use the name of the actual certification body and verify its role independently.
Is ISO 13485:2016 still current?
Yes. ISO’s official standard record says the 2016 edition was reviewed and confirmed in 2025 and remains current. Certificate validity still depends on its own entity, scope, sites, dates and status.
Does ISO 13485 certification mean a device is FDA approved?
No. FDA market requirements depend on the device and applicable pathway. The QMSR incorporates ISO 13485:2016 by reference, but a third-party QMS certificate does not itself establish FDA clearance, approval, exemption, listing or lawful importation for a particular device.
What if a certificate is not found in IAF CertSearch?
Contact the named certification body and, where relevant, its accreditation body using independently sourced contact information. Record the response. Absence from one search result should be investigated rather than treated as conclusive proof by itself.
Does one certified site cover every related factory?
Not automatically. Compare the certificate and any multi-site schedule with the facility performing the relevant work. Ask for evidence explaining any corporate or outsourced relationship and document the conclusion.
Connect certificate review to the wider supplier file
Use the US, EU and Great Britain documentation checklist for destination-market questions and the sample evaluation guide for product-specific review. To request a specification-based quotation, contact SurgiValley with exact instrument references, quantities, destination and required documents. Any certificate or product claim should be evaluated from the current evidence supplied for that request.
