ISO 13485, CE and FDA: What a Document Pack Really Proves

A supplier's document pack arrives as a compressed folder: a quality certificate, a declaration of conformity, a registration printout, a sterilisation statement, a certificate of analysis for a lot that shipped months ago. The names are reassuring; what each document proves is another question.

These documents are not interchangeable, and several establish far less than a buyer assumes at a glance. A registration number is not a clearance. A declaration is not a certificate. A certificate of analysis for one batch says nothing about the batch now quoted. Against a tender deadline the pack looks complete; read closely, it may not answer the question a hospital quality department will actually ask.

What follows is a reading guide: what each document establishes, the limits of each, and four questions that separate a maintained technical file from a folder of PDFs. It is not regulatory advice; classification, conformity routes and the acceptability of any document belong to the buyer's regulatory consultant or notified body.

A pack is not a hierarchy

A quality system certificate answers a question about the organisation. A sterilisation validation answers a question about a process. A declaration of conformity or a clearance letter answers a question about a device. A certificate of analysis answers a question about a batch. Buyers get into difficulty by treating these as one kind of question.

Each level is necessary and none substitutes for another. A manufacturer with an impeccable quality certificate can ship a lot whose sterilisation record was signed against the wrong cycle, and a device with a technical file can arrive with a carton label that contradicts the declaration. Auditors work down the levels in order, which is why a pack that is strong at the top and thin at the bottom fails.

It also helps to know what a supplier means by a "file". The phrase often refers to the technical documentation compiled for a regulatory submission, not to anything issued by an authority. That distinction matters when a tender asks for evidence and receives specifications, labels and test reports. The folder can be legitimate and still not be the document asked for. A file that cannot go down a level is a brochure.

ISO 13485 certifies a system, not a product

ISO 13485 is the quality management system standard written for medical device manufacturers. Its subject is the organisation: how design is controlled, how suppliers are approved, how production is documented, how non-conforming product is handled, how complaints and corrective actions are managed. A certificate says an accredited certification body has audited those arrangements for a stated scope and site.

That is valuable and it is limited. The certificate does not certify any product. It does not say a dressing is sterile, that a kit matches its content list, or that a device may be sold in a given market.

Three details matter when reading it. Scope: a certificate naming the product families and processes actually bought says more than a generic statement about medical supplies. Site: if the certificate names a head office while manufacture happens elsewhere, the relevant certificate covers the manufacturing site. Validity: certificates expire and can be suspended, and the certification body's register is where the number and current status are confirmed rather than a PDF that may be a year old.

A buyer can also ask what the last surveillance audit found, not merely what the certificate says. Rich Medical's system, on-site microbiology laboratory and ethylene oxide sterilisation are set out under quality.

Ethylene oxide: what a sterility claim rests on

ISO 11135 covers ethylene oxide sterilisation of medical devices. The method suits heat-sensitive products, and it is not a switch thrown per order: it is a validated process with defined parameters, monitoring and records.

When a product is described as EO sterilised, the useful questions concern the process rather than the label. Was the cycle validated for this product family and this loading pattern? What routine monitoring is performed, and what did the last cycle show? Is sterilisation in house or subcontracted, and if subcontracted, whose certificate accompanies the consignment? Aeration matters as much as the exposure phase, because it is the step that brings residual ethylene oxide and its reaction products down to the level the specification allows.

The document tying this to a delivered carton is the load record. It identifies the cycle, the load and the products in it, the parameters achieved, the indicator results, and the aeration that followed. A statement reading "sterilised by ethylene oxide" is a method, not evidence, and cannot be reconciled to a specific lot.

This is where a supplier's own laboratory becomes relevant: in-house microbiology keeps bioburden and environmental monitoring inside the records system the auditor will examine, and the person answering a technical question reads those records rather than requesting them.

CE marking is a declaration, not a licence

CE marking is the manufacturer's declaration that a device meets the applicable requirements of EU law. It is supported by a technical file, and the route depends on the class of the device. For higher-risk classes a notified body is involved and issues a certificate; for others the manufacturer self-declares and holds the file for inspection.

A declaration of conformity is therefore a signed statement by the manufacturer. It normally names the manufacturer, describes the device or device group, states the class and the legislation applied, and carries a signature and a date. Where a notified body is involved, its number appears on the declaration.

What the declaration does not do is guarantee that the specific article in the carton falls inside the described group, or that the technical file is current: a declaration covering a family of dressings can be genuine and still omit a variant added afterwards. The buyer's protection is to match the device description to the purchase order line.

Three checks repay the time: the signatory's name and role, since a declaration signed without authority has no owner; the revision date against the delivery; and, where a notified body number is quoted, confirmation that the body is still notified and the number matches the certificate shown.

Whether an article falls in a class, and which conformity route applies, is settled by the buyer's regulatory consultant or notified body. Classification is not a purchasing decision, and the supplier's opinion is not the answer.

FDA: three different things wearing one acronym

Establishment registration is the registration of a facility with the Food and Drug Administration for the activities performed there. Device listing records the devices a facility commercially distributes. Neither is a clearance, an approval or an endorsement of performance. A quotation stating "FDA registered" describes a facility, not a device.

510(k) premarket notification applies to specific device types and results in a clearance letter naming the applicant and the device. Some device types are exempt, which is why a manufacturer can legitimately sell a device in the US without holding a clearance for it. A clearance attaches to its holder and to the device described; it cannot be lent to another manufacturer's similar product.

Verification is public. The establishment registration database shows whether a facility is registered for the declared activities and whether the owner or operator number matches the manufacturing address on the offer. The 510(k) database allows a letter to be checked against device name, product code and applicant. Where the name on the letter is neither the manufacturer nor a party the manufacturer can explain, ask before the order is placed.

A phrase worth noticing is "CE/FDA file". In a document pack it usually means the technical documentation compiled to support both markets: test reports, labelling, risk analysis. It is often the most useful item in the folder and is not a certificate, so treat it as a file to be read rather than a badge to be filed.

Reading the table: what each document proves

Most disputes over documentation are not about forgery. They are about documents read for more than they say.

Two habits follow. Keep batch-level documents attached to the batch, because a certificate of analysis without its lot number is an advertisement rather than a record. And check that the product description on any product-level document matches the order wording: a declaration covering sterile dressing packs does not automatically cover a pack whose contents changed for a tender. Where a document is missing, ask not whether the supplier has it but whether it can be produced for this consignment.

Four questions that separate a file from a folder

Documents can be assembled. Records cannot be assembled retrospectively without leaving marks of it. Four questions reach the difference quickly, and all four can be asked before an order rather than after a complaint.

First, can you show the batch record for a lot you shipped? A batch record is the manufacturing history: materials, quantities, in-process checks, who performed each step, what was rejected and why, and who released the lot. It is the document an auditor asks for first.

Second, can you show the sterilisation load record for that lot? This establishes that the lot went through a validated cycle with indicator results recorded, and exposes the case where a third party sterilises the product.

Third, can you show label reconciliation? Labels are controlled documents. A reconciliation shows how many were issued, used and destroyed, and how the difference was accounted for. It is the control that stops a carton of one product carrying the label of another, and one of the first things a serious audit tests.

Fourth, who signs release, and against what? A named person releasing against a defined checklist is a system; a signature on a packing list is not.

A supplier who answers all four from a system will usually offer more than was asked. That is the practical test: not the weight of the folder, but whether it extends downwards to a batch.

What to confirm before ordering

• The document set required, listed by name, and whether each item ships with the goods or on request.
• That the ISO 13485 scope names the product families and the site that will manufacture the order.
• The certificate's current status, checked on the certification body's register; and whether sterilisation is in house or subcontracted.
• That a load record can be produced for the lot supplied, not only a validation report.
• The FDA status that applies, stated as registration, listing or clearance rather than a general claim.
• The revision date and signatory of any declaration of conformity, and the device description on it.
• Whether certificates of analysis are issued per batch, with methods and results reported.
• Whether OEM or private label work changes any document, and who then holds the technical file; see custom design.

Does an ISO 13485 certificate cover the products I buy?

No. It covers the manufacturer's quality management system for a stated scope and site: evidence that the processes behind a product are controlled, not that the product conforms or may be sold in a particular market. Product conformity is shown by a declaration, a technical file or a clearance; batch conformity by a certificate of analysis and the release record. Read the certificate for scope, site and validity, then ask for the next level down.

Is CE marking the same as a certificate?

No. CE marking is the manufacturer's declaration of conformity with applicable EU requirements, supported by a technical file. Where a notified body is involved it issues a certificate for its part of the assessment, a different document from the declaration. A declaration alone is a manufacturer's statement, which is why signatory, date and device description deserve as much attention as the mark.

Can a supplier send an FDA clearance letter for a similar product?

Only the holder can rely on a clearance, and only for the device it describes. A letter naming another applicant, or describing a different device, does not transfer. The useful request is the exact status applying to the product on the order, with the registration details of the manufacturing site, both checkable in the public databases.

The documents described here are supplied on request and can be discussed through contact. The range is set out in the 2025 catalogue, worth reading alongside the quality page when a tender pack is assembled.