Philippines ISO 13485 Certificate Scope Mismatch and Its Consequences

1. Key takeaways

Yes. CMDR applications for Class B, C and D devices require an ISO 13485 certificate, or equivalent evidence of a quality management system. The more consequential question, however, is not whether a certificate exists but whether its scope covers the declared product. A scope that does not cover the device is one of the most frequent reasons for a Philippine registration to be returned.

GRZAN note: a certificate answers a question about the manufacturer, while the reviewer is asking a question about the product. Where those two questions do not meet, the file fails even though every document is present and valid. The check can be remembered as 3 dimensions of scope — product category, activity type and site — plus 1 validity condition that must be satisfied before anything is filed.

• ISO 13485 certificate, or equivalent quality system evidence, for Class B, C and D;
• Scope must cover the product category being declared;
• Scope must cover the activity being performed, whether design, manufacture or distribution;
• Scope must cover the site where the declared product is actually made.

The reason this receives so much attention is structural. Scope is written by the certification body in general terms, while the dossier describes one specific device made at one specific place. The gap between the two texts is where most returns originate, and it is a gap that can only be closed by re-reading the certificate against the submission rather than by adding another document to the pile.

2. Legal basis

The quality system requirement, its place in the dossier, and the regulatory direction of travel are summarised below. The current position is that quality system evidence forms part of the CSDT, and the emerging position is that the same standard is being repositioned from a documentary requirement into an inspectable manufacturing requirement.

3. Expert insights

Insight 1: scope mismatch takes three forms, and all of them must be resolved before filing. The first is a missing product category: the certificate speaks of medical consumables while the declared product is a passive implant that falls outside that description. The second is a missing activity type: the certificate covers design and development but not manufacture, or the reverse. The third is a missing site: the certificate covers plant A while the declared product is actually made at plant B.

All three lead to the same outcome, and all three require an extension or supplementary audit under ISO 13485 to resolve. That is the part companies underestimate: this is not a matter of amending a document, but of going through a certification process, with the scheduling consequences that follow.

Insight 2: the accreditation status of the certification body is examined as well. The ISO 13485 certificate must be issued by an accredited certification body. When qualifying a supplier, a company should confirm the accreditation status of the issuing body, including whether it is accredited by an accreditation body. A certificate issued by an unaccredited body carries a real risk of being challenged during review, and the challenge is difficult to answer once the file is already under examination, because the only remedy is to obtain a certificate from a body that is accredited, which restarts the certification timeline.

Insight 3: the move to make PNS ISO 13485:2019 a GMP requirement is the significant 2026 development. The FDA has published a draft for comment on adopting PNS ISO 13485:2019 as the GMP guideline for medical devices, with comments closing on 11 November 2026, a proposed 2-year transition period, and an explicit statement that traders are outside the scope. The signal is strong: the Philippines is upgrading ISO 13485 from a dossier requirement into an inspectable GMP requirement. Companies with local manufacturing activity in the Philippines, including contract manufacturers, should prepare in advance; holders on a pure import pathway are not directly affected in the short term.

Insight 4: the certificate must remain valid across the review period. ISO 13485 certificates typically run for 3 years with annual surveillance audits. If the certificate expires while the application is under review, an updated certificate will be requested and the review will be interrupted. The practical check before filing is whether the expiry date falls at least 6 months after the expected grant date; where it does not, complete the recertification first and file afterwards.

4. Practical recommendations

• Run a three-way scope check before filing. Compare the product category, the activity type and the site address stated on the certificate against the declared product; all three must cover it.
• Verify the accreditation status of the issuing body. Use certificates issued by bodies accredited by a recognised accreditation body.
• Confirm that validity covers the review period. Where it does not, recertify before submission rather than during it.
• Benchmark against PNS ISO 13485:2019 where local manufacturing exists. Track the formal publication of the draft and the transition arrangements that accompany it.

None of these four checks requires new documentation; they require that existing documentation be read against the submission rather than filed alongside it. That is a difference of discipline, not of cost, and it is the cheapest way to avoid the most common return reason in the market. The same discipline should be applied whenever a manufacturing site, a supplier or a contract manufacturer changes, because a change that seems commercial in nature is also a change to the certificate scope that the dossier depends on.

5. Verification checklist

• □ Certificate scope covers the declared product category
• □ Certificate scope covers the activity type: design and development, manufacture or distribution
• □ Site address on the certificate matches the actual manufacturing site
• □ Accreditation status of the issuing body verified against the accreditation directory
• □ Certificate expiry at least 6 months after the expected grant date
• □ Manufacturer name consistent across the certificate, the LOA and the CFS

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including the Philippines. Our team prepares CMDN/CMDR dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the FDA Philippines, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com