What does a notified-body QMS certificate actually cover?

A notified-body quality-management-system (QMS) certificate attests one thing: that a designated notified body assessed the manufacturer's quality management system — its processes for design, production, and post-market control — and found it conforms to the Medical Device Regulation (Regulation (EU) 2017/745, "MDR"). It certifies the system, aligned with the harmonised standard EN ISO 13485:2016 — not that every device the manufacturer makes was individually assessed. Reading that distinction is the difference between a real compliance check and a box tick.

As of June 2026, MD Atlas has indexed 3,155 notified-body certificates from EUDAMED — an indexed subset of the public data at that date, not an exhaustive count. Of those, 2,510 (about 80%) are quality-management-system certificates. So when you look up a manufacturer, the certificate you are most likely to find is a system certificate — which makes knowing what it does and doesn't cover a practical, everyday skill.

What a QMS certificate attests

The MDR requires every manufacturer to "establish, document, implement, maintain, keep up to date and continually improve a quality management system" — that is the obligation in Article 10(9) of Regulation (EU) 2017/745. For devices above the lowest risk tier, an independent notified body audits that system and, if it conforms, issues a QMS certificate under Annex IX, Chapter I ("Quality management system") of the MDR.

The natural way to build a conforming QMS is to follow EN ISO 13485:2016, the international standard for medical-device quality management. It is a harmonised standard for the MDR: under Article 8, a manufacturer whose processes conform to a harmonised standard whose reference is published in the Official Journal is presumed to conform to the MDR requirements that standard covers — including the quality-management-system requirements. The Commission maintains the list of harmonised standards for the MDR, and EN ISO 13485:2016 is on it. That is why a QMS certificate and an ISO 13485 certificate so often travel together — the second is the common route to the first.

What it does not tell you

Here is the trap. A valid QMS certificate says the manufacturer's system was judged sound. It does not, on its own, say that any particular device's technical documentation — the evidence that that device is safe and performs — was assessed. The MDR keeps these on separate tracks:

• Annex IX, Chapter II — assessment of the technical documentation, performed on specific devices on top of the QMS audit.
• Annex X — type-examination, where a notified body examines a representative device type and issues an EU type-examination certificate.
• Annex XI — product conformity verification (production quality assurance, or product verification).

A manufacturer can hold a perfectly valid QMS certificate while a given product line's technical documentation is still under assessment, or covered by a separate product certificate entirely. For the highest-risk devices the regulation forces both: under Article 52(3), Class III devices undergo the full Annex IX route, and Annex IX, Chapter II requires the notified body to assess the technical documentation per device — so a Class III or implantable device should have a technical-documentation assessment behind it, not just a system certificate.

Two families, very uneven proportions

This split is visible in the data. Across the certificates MD Atlas has indexed, roughly 89% are system-level certificates (quality-management-system plus production quality assurance) and only about 11% are product or technical-documentation certificates tied to named devices. The public certificate record is, in other words, mostly about systems. That is not a flaw — it reflects how conformity assessment is structured — but it means a reviewer who treats "the manufacturer has a certificate" as "this device was assessed" is reading the wrong signal most of the time.

How to read a QMS certificate in EUDAMED

In practice you rarely start from the certificate. You start from the company or the device and work toward it:

1. Find the manufacturer among all indexed actors and note their SRN — the EUDAMED Single Registration Number that ties their records together.
2. Look at the devices linked to that manufacturer and the risk classes they fall into — that tells you what kind of certificate you should expect to see (a Class III device should have a product/technical- documentation assessment, not only a system certificate).
3. Open the certificate record to read its type (QMS or product/technical-documentation), its scope, its validity dates, and its status (valid, suspended, withdrawn or expired — suspension is reversible). Reading the type first reframes everything else.

Every figure here comes from a live MD Atlas query you can re-run against that indexing scope; the certificate data itself is drawn from the public records in EUDAMED and links back to the underlying entry.

A QA/RA lens

For a quality or regulatory-affairs reviewer, the QMS certificate is the entry point, not the verdict. It tells you a notified body stands behind the manufacturer's system — a meaningful signal — but the device-level question (is this product's technical documentation assessed, and current?) lives in a different certificate, or in the device record itself. Mapping a manufacturer's certificates to its devices, and checking that the high-risk products carry a product-side assessment, is exactly the kind of work that benefits from a specialist eye. MD Atlas is building a verified directory of QA/RA professionals — including ISO 13485 and QMS specialists — for teams that need that read done well.

Learn to ask "what type of certificate is this, and what is its scope?" before "does the manufacturer have one?", and the certificate record in EUDAMED stops being a green light and becomes what it actually is: a precise, readable map of who assessed what.