CE vs ISO 13485 vs FDA — A Medical Device Importer's Compliance Guide (2026)

Most importers we work with first encounter medical device certification when their customs broker calls and says "we need the CE certificate before we can release the container." This article unpacks what CE, ISO 13485, FDA 510(k), and Free Sales Certificates actually mean, how they relate to each other, and the specific things to check before placing an order.

The four documents you will encounter

Disposable medical device exports involve a small number of overlapping document families. They do different jobs:

• ISO 13485 — quality management system, applies to the factory.
• CE Marking — product-level EU conformity, applies to the device.
• FDA 510(k) — US market clearance, applies to the device.
• Free Sales Certificate (FSC) — government attestation that the product is freely sold in the country of origin, used by importing-country regulators outside the EU/US.

A factory can hold ISO 13485 without ever selling a single CE-marked product. A device can hold CE Marking only if it is produced under an ISO 13485 system. The two are complementary — never substitutes.

ISO 13485:2016 — what it really proves

ISO 13485 is the international quality management system (QMS) standard for medical device manufacturers. The current version is ISO 13485:2016. Holding the certificate means the factory has documented procedures for:

• Design control and risk management (ISO 14971)
• Supplier evaluation and incoming material inspection
• Process validation, including sterilization (EO, gamma, steam)
• Cleanroom environmental monitoring (ISO 14644 Class 7 / 8 typical for syringes)
• Traceability — every batch maps back to raw material lots
• Complaint handling and post-market surveillance
• Internal audits and management review

The certificate is issued by an accredited certification body (BSI, TÜV, SGS, DNV, Intertek, etc.) and is valid for three years with annual surveillance audits. What to check on the certificate: the scope statement should explicitly cover "manufacture" of the relevant product family, the certificate number must be verifiable on the issuing body's website, and the expiry date must be current. A factory whose certificate expired six months ago is technically not certified, even if the original PDF looks impressive.

CE Marking under EU MDR

CE Marking is the conformity declaration that allows a product to be placed on the European Economic Area market. Since May 2021, medical devices fall under the EU Medical Device Regulation (MDR), Regulation 2017/745, which replaced the older Medical Device Directive (MDD).

Devices are grouped into four risk classes:

• Class I — low risk, manufacturer self-certifies (e.g., non-sterile bandages)
• Class Is / Im — Class I sterile or with measuring function (e.g., sterile disposable bed sheets) — needs notified body involvement for the sterile aspect only
• Class IIa — medium risk, notified body required (most disposable syringes, infusion sets, IV cannulas)
• Class IIb — higher risk (e.g., long-term implants of less than 30 days, ventilators)
• Class III — highest risk (e.g., active implants, devices in contact with central circulatory system)

For Class IIa and above, the manufacturer must engage an EU notified body to audit the QMS and review the technical file. The CE certificate the notified body issues includes:

• The notified body's 4-digit identification number (e.g., 0123 = TÜV SÜD, 0197 = TÜV Rheinland, 2797 = BSI Netherlands)
• A unique certificate number
• The exact products / GMDN codes covered
• Issue date and expiry (max 5 years under MDR)
• The legal manufacturer's name and address

How to verify a CE certificate yourself:

1. Look up the 4-digit notified body number on the European Commission's NANDO database and confirm it is accredited for medical devices under MDR (not just MDD).
2. Enter the certificate number on the notified body's own website verification portal (TÜV SÜD, BSI, and TÜV Rheinland all have public lookup tools).
3. Cross-check the manufacturer name on the certificate matches the supplier you are paying.

Forged CE certificates are common. They almost always fail one of those three checks — usually because the certificate number does not exist, or it covers a different product family than what the supplier claims.

The MDR transition — what changed since 2021

EU MDR brought significant changes that some Asian factories have struggled to keep up with. The biggest practical impacts for importers:

• Old MDD certificates expired on 26 May 2024, with limited extensions for "legacy devices" until 2027 / 2028 if the manufacturer has filed an MDR application. Anything sold in 2026 should be on an MDR certificate.
• Stricter clinical evidence — even for low-risk devices, manufacturers must demonstrate clinical performance with data, not just literature.
• Unique Device Identifier (UDI) — every device must carry a UDI in human-readable and barcode form, registered in EUDAMED.
• EU Authorized Representative — non-EU manufacturers must designate an EC REP based in the EU. Their name and address must appear on the device label.
• Person Responsible for Regulatory Compliance (PRRC) — the manufacturer must employ a qualified person who oversees compliance.
• Reclassification — some devices (e.g., software, substances introduced by orifice) moved up a risk class.

When importing, check the supplier's documentation refers to Regulation (EU) 2017/745 — not the old Directive 93/42/EEC. If the supplier still cites MDD, they have not transitioned and their goods may be refused at the EU border.

FDA 510(k) — the US gateway

For US imports, the certification regime is entirely different. The FDA classifies medical devices into three classes:

• Class I — most are 510(k)-exempt but still require Establishment Registration and Device Listing.
• Class II — typically require a 510(k) Premarket Notification, demonstrating "substantial equivalence" to a legally marketed predicate device. Most disposable syringes, infusion sets, and catheters are Class II.
• Class III — require a Premarket Approval (PMA), much more rigorous and expensive.

A 510(k) clearance is owned by the manufacturer (or their FDA-registered importer of record). If you are buying generic disposable syringes, the Chinese factory itself may not hold the 510(k) — the US importer often holds it. Confirm in writing who is the legal 510(k) holder. Verify on the FDA 510(k) database by searching applicant name or K-number.

All medical devices imported into the US, regardless of 510(k) status, require:

• FDA Establishment Registration of the foreign manufacturer
• Device Listing
• A US Agent designated for the foreign manufacturer
• Prior Notice filing through the FDA Industry Systems for each shipment

Free Sales Certificate — the rest of the world

For most non-EU, non-US markets — Latin America, Middle East, Africa, parts of Asia — the importing regulator will demand a Free Sales Certificate (FSC). The FSC is issued by the manufacturer's home authority and confirms the product is freely sold in the country of origin.

For Chinese manufacturers the FSC chain typically runs: NMPA medical device registration → application to the local Chamber of Commerce (CCPIT) → FSC issued → notarization → embassy legalization in Beijing. Allow 2-4 weeks for issuance and 1-2 weeks for embassy legalization. Typical destinations that demand FSC:

• Saudi Arabia (SFDA), UAE (MOHAP), Egypt, Iraq, Kuwait
• Brazil (ANVISA), Mexico (COFEPRIS), Argentina, Colombia, Chile
• South Africa (SAHPRA), Nigeria (NAFDAC), Kenya (PPB)
• Pakistan (DRAP), Bangladesh (DGDA), Vietnam (DAV), Indonesia (Kemenkes)
• Russia and EAEU member states (additional Roszdravnadzor registration)

Country-specific registrations to budget for

Beyond CE / FDA / FSC, several markets require their own product registration on top of supplier certificates. These are the importer's responsibility, not the factory's, and the costs and timelines should be planned at procurement time:

• Saudi Arabia — SFDA Medical Device Marketing Authorization, ~6-9 months
• Brazil — ANVISA registration, typically 12-24 months for new devices, faster for risk Class I
• Mexico — COFEPRIS registration with Mexican Authorized Representative, 6-12 months
• India — CDSCO Import License, ~3-6 months, requires prior CE or FDA
• South Korea — MFDS approval, varies by class
• Australia — TGA inclusion in Australian Register of Therapeutic Goods (ARTG)

Documentation checklist before placing an order

Before sending the deposit, request and verify:

1. ISO 13485:2016 certificate — covers manufacture, current expiry, verifiable on issuer site
2. CE certificate under MDR — for the specific product family, notified body verifiable on NANDO
3. EC Declaration of Conformity for each SKU
4. FDA 510(k) clearance letter (if importing to US) — verify K-number
5. Free Sales Certificate (if required by destination) — original, with embassy legalization where required
6. Business license with medical device manufacturing scope
7. Sterilization validation report (EO residue test, biological indicator test)
8. Biocompatibility report (ISO 10993)
9. Recent third-party test reports (e.g., ISO 7886-1 for syringes)

A serious factory will have a regulatory affairs team that produces these on the same day you ask. If the request is met with delays or excuses, that is your answer.

Frequently Asked Questions