ISO 13485 evidence: validity, scope and certified entity consistency

1. Key takeaways

An ISO 13485 certificate is one of the core pieces of evidence in a listing application, and the official wording is an ISO 13485 certificate or equivalent evidence. Three consistency tests must hold at the same time. Validity must be consistent: the certificate is valid at submission, and if it expires during review an updated certificate must be supplied. Scope must be consistent: the certificate scope covers the design or manufacturing activity of the product applied for. The audited entity must be consistent: the certificate holder is the entity that actually carries out design and manufacturing, not the group parent or another affiliate. If any one of the three fails, a request for further information follows.

The three tests are independent, which is why a file can pass two and still fail. A valid certificate with a broad scope held by the wrong legal entity is as problematic as an expired certificate with perfect scope.

• Validity became a written rule on 1 September 2026. GN-01 now states the submission-date requirement and the replacement obligation during review.
• Scope is the quietest failure point. A generic scope description leaves the reviewer unable to confirm that the applied product is covered.
• Group structures are where entity mismatches cluster. Parent holds the certificate, another plant manufactures, contract manufacturer sits outside the scope.
• MDD can verify directly. Certified copies, checks on the certifier and direct contact with the issuing body are all available to the reviewer.
• A certificate is a live document. It needs an owner, an expiry date in a register and a named person responsible for renewal.

2. Legal basis

The requirement comes from the MDD overview of the listing process, uploaded on 8 October 2025, which lists the ISO 13485 certificate or equivalent evidence among the documents required for an application. The validity and verification rules sit in GN-01, updated and issued on 1 September 2026. GN-02 addresses the quality management system evidence expected in a general device dossier, and GN-08 addresses local manufacturers, including site inspection and the submission of records.

Paragraph 4.10 of GN-08 matters even for applicants who are not local manufacturers, because it shows that the administrative system treats manufacturing evidence as something that can be inspected rather than merely filed. A certificate is the entry ticket; the underlying system is what the certificate represents.

3. Expert insights

The revision of 1 September 2026 turned validity from convention into a clause. Paragraphs 5.6.2–5.6.3 of GN-01 state that a certificate must be valid when the application is submitted, and that if it expires during review the applicant must submit the renewed valid certificate at the request of MDD. Certificate expiry during review is therefore no longer an administrative detail that can be ignored. It is a compliance event with a defined response, and the applicant who has not planned for it will be answering a question under time pressure.

Scope is the most hidden failure point. Many certificates held by manufacturers in the Chinese mainland carry a generic scope description, such as the design and manufacture of medical devices, without naming the specific product categories. The reviewer cannot conclude from that wording whether the applied product is covered, and typically asks for a clarification or a replacement certificate. The remedy is unattractive but simple: extend or reissue the scope before submission, rather than argue about it afterwards.

Entity problems cluster in group structures. Three patterns recur: a parent company in the Chinese mainland holds the certificate while an overseas plant actually manufactures; a contract manufacturer is used but is not included in the certificate scope; and a certificate is held by a sales or holding entity that carries out neither design nor manufacture. Each produces an entity mismatch. The solutions are to document the relationship between the manufacturer and the certificate holder, or to extend the scope, and the first is usually faster.

MDD may require certified copies and may verify directly. The same provisions state that where there is doubt about the authenticity or accuracy of a document, MDD may require a certified copy, check the qualifications of the person who certified it, or verify directly with the issuing body. Applicants should assume that verification may happen and prepare the route in advance, including the official verification channel and contact point of the issuing body.

Scope language should be read against the technical file. The activities named in the certificate have to correspond to what the technical documentation says the manufacturer does. A certificate covering manufacture while the technical file describes in-house design and development creates a gap that is easy to spot and hard to explain.

4. Practical recommendations

• Run a three-item certificate check. Validity, scope and audited entity, each ticked off before the dossier is released.
• Extend the scope before submitting. Where the certificate does not cover the product category applied for, start the scope extension audit first and submit the listing application afterwards.
• Document group relationships. Where the manufacturer and the certificate holder differ, attach the ownership relationship, the manufacturing arrangement and the quality agreement.
• Prepare the verification route. Keep the official verification method and contact channel of the issuing body so that MDD can check without delay.
• Track expiry dates centrally. Give every certificate an owner and a renewal trigger date, and review the position at each review milestone.

5. Verification checklist

• □ The ISO 13485 certificate is valid on the submission date.
• □ Whether it expires during review has been assessed and a renewed certificate is available.
• □ The certificate scope covers the design or manufacturing activity of the product applied for.
• □ The relationship between the certificate holder and the actual manufacturer has been explained.
• □ The verification route of the issuing body has been prepared.
• □ The scanned certificate carries a verifiable electronic signature or a certified copy has been obtained.

Regulatory information verified as at 29 October 2026. The legislation, guidance and effective dates described in this article are limited to the content published by the official sources listed under legal basis on that date; where those sources are updated, the latest published version prevails.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for Hong Kong, China. Our team prepares MDACS-compliant dossiers, coordinates evidence of reference approvals and ISO 13485 certificates, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com