How do you read a notified-body certificate in EUDAMED?

A CE mark on a higher-risk medical device is easy to read as proof the device itself is compliant. It isn't quite that. It first carries the manufacturer's own declaration of conformity — and above general Class I (and for Class I devices that are sterile, have a measuring function, or are reusable surgical instruments), that declaration rests on a notified-body certificate: documentary evidence that an independent, designated body assessed the manufacturer's conformity demonstration — a quality-management system, or a device's technical documentation, depending on the certificate type. EUDAMED is where those certificates surface — the notified body, the manufacturer, the evaluation type, the validity period, and the status — data that used to be hard to find. Reading one well is a core skill for anyone in regulatory affairs, quality, or procurement.

As of June 2026, MD Atlas has indexed 1,553 notified-body certificates from EUDAMED — an indexed subset of the public data at that date, not an exhaustive count of EUDAMED. It is enough to illustrate every concept below and to cross-check the manufacturers and devices those certificates cover. Every figure here comes from a live MD Atlas query you can re-run, read against that indexing scope.

What a certificate records

Under the Medical Device Regulation (EU) 2017/745 and the IVDR (Regulation (EU) 2017/746), a notified body issues a certificate once a conformity-assessment procedure within its remit concludes favourably. Annex XII of the MDR sets out the minimum content of an MDR certificate (the IVDR carries its own equivalent annex); the EUDAMED record lets you verify several things:

• The notified body that issued it, identified by its four-digit number.
• The manufacturer it was issued to, identified by their SRN.
• The certificate type — for example a quality-management-system certificate or a technical-documentation / type-examination certificate.
• The validity dates — when it was issued and when it expires.
• The status — valid, suspended, withdrawn, or expired.

Each of those is a question a reviewer should be able to answer in seconds, and together they tell you whether a device's compliance basis is currently sound.

Why the certificate type matters

Not every certificate means the same thing. A quality-management-system certificate attests that the manufacturer's QMS was evaluated favourably against the applicable requirements — not that every device was assessed individually; a technical-documentation or type-examination certificate covers a specific device, family, or technical scope. A manufacturer can hold a valid QMS certificate while a particular product line's technical documentation is still under assessment. Reading the type — not just the presence — of a certificate is what separates a meaningful check from a box-ticking one.

This is also where the MDR's transition rules bite. Under Article 120 of the MDR — its transitional provisions, as amended by Regulation (EU) 2023/607 — many devices may still be marketed under legacy certificates carried over from the previous directives, and the conditions attached to those certificates differ from a fresh MDR certificate. When you read a certificate, always anchor it to the regulation it was issued under, and check the conditions for its validity.

What the status tells you

The status field is the fastest signal — but read it against the certificate's scope: a suspension or withdrawal can affect only part of what a certificate covers.

• Valid — in force, within its scope and validity period.
• Suspended — temporarily halted by the notified body, usually pending corrective action; check the scope before drawing a market conclusion.
• Withdrawn — revoked by the notified body; check which devices and scope the withdrawal covers.
• Expired — reached its end date; look for a renewed or MDR certificate, or a transitional situation.

A suspended or withdrawn certificate on a device you are about to buy, specify, or distribute is exactly the finding worth verifying directly in EUDAMED — its scope, the device, the framework, and whether a renewal exists.

How to check a certificate in practice

The official portal lets you look up a certificate if you already know what you are looking for. In practice, a quality, regulatory-affairs, or procurement reviewer usually starts from the manufacturer or the device and works toward the certificate:

1. Find the manufacturer among all indexed actors and note their SRN.
2. Review the devices linked to that manufacturer and the risk classes they fall into.
3. Open the certificates view to read the issuing notified body, the certificate type, its scope, its validity dates, and its status. You can follow the dedicated certificate search as that surface comes online.

Working in this direction — manufacturer, device, certificate — mirrors how compliance actually hangs together, and it surfaces situations worth verifying: a high-risk device with no live certificate, a certificate whose scope doesn't seem to match the device, or one issued under an earlier regulatory framework — things a single point lookup would miss.

A quality-and-vigilance lens

For quality, regulatory-affairs, and vigilance teams, a certificate isn't a static checkbox. Its status can change — through surveillance audits, non-conformities, suspensions, withdrawals, or renewals — and those changes ripple into post-market obligations. Treated as a living signal rather than a one-time check, the certificate data recorded in EUDAMED can contribute to regulatory surveillance, supply-risk analysis, and continued conformity — read alongside the certificate's scope and what the manufacturer holds.

A notified-body certificate isn't an absolute guarantee to read in isolation. It is a useful entry point: who evaluated the manufacturer or device, on what scope, under which framework, and whether that evaluation still stands today. Learn to read it well, and a great deal of regulatory uncertainty collapses into a few seconds of checking.