How to verify a notified body and a CE certificate

A CE mark on a higher-risk medical device is backed by a notified body — an independent organisation that assessed it — and by a certificate that body issued. Verifying both is a three-step job: read the notified body's number after the CE mark, confirm that body is genuinely designated in NANDO, then check the certificate in EUDAMED. Here is how, and one thing that looks suspicious but is not: many devices carry a CE mark with no number at all.

Step 1 — read the number after the CE mark

Under Article 20 of the MDR (Regulation (EU) 2017/745), "where applicable, the CE marking shall be followed by the identification number of the notified body responsible for the conformity assessment procedures set out in Article 52." That number — conventionally four digits, e.g. 0123 — identifies the body that assessed the device.

The honest caveat: most class I devices are self-certified. For the lowest-risk class, the manufacturer generally declares conformity itself, with no notified body, so the device carries a CE mark with no number. The exceptions are sterile, measuring, and reusable-surgical-instrument class I devices (Is, Im, Ir), where a notified body assesses that one aspect and a number does appear. So a missing number is correct, not a red flag — it usually means a plain class I device, not "fake." A number shows up whenever a notified body was involved (Article 52).

Step 2 — confirm the notified body in NANDO

A number on the label is not proof on its own — you confirm the body is currently designated in the European Commission's NANDO database (New Approach Notified and Designated Organisations), filterable by legislation (European Commission — notified bodies). NANDO is the source of truth for two things: whether the notified body is designated now, and the scope it is designated for — the MDR (or IVDR) designation codes that say which device categories it may assess. A body designated only for one scope cannot validly certify outside it, so the scope check matters as much as the existence check.

Step 3 — check the certificate in EUDAMED

Notified bodies issue certificates; EUDAMED records them — the database never grants a certificate of its own; a notified-body certificate is recorded in EUDAMED, not issued by it. Under Article 56(5) of the MDR, notified bodies must enter certificate information into EUDAMED — certificates issued, suspended, reinstated, withdrawn or refused, plus restrictions — and that information is accessible to the public. So the statuses you will see are the real MDR ones:

• issued — the certificate was granted;
• suspended — paused; importantly, a suspension is reversible, which is why reinstated is its own status;
• withdrawn / refused — ended or denied.

Note what is not a status word: "valid" and "expired" are derived from the certificate's dates, not codes the notified body sets — a certificate has a defined validity period (up to five years under Article 56(2)), and "expired" simply means that period has passed. To verify a specific certificate, cross-check the issuing notified body, the certificate number, the Basic UDI-DI, and the status against the EUDAMED record. (For how to read one, see reading a notified-body certificate in EUDAMED.)

The two databases, kept straight

The reason this takes two lookups is that the facts live in two places:

• NANDO — the notified body's designation and scope (is the assessor licensed, and for what?);
• EUDAMED — the certificate and device data (what did the assessor sign off, and what is its status?).

That split is the same one behind competent authorities and NANDO: NANDO publishes designations, EUDAMED registers and records. Neither the database nor the competent authority "certifies" anything — the notified body does.

Doing the cross-check in MD Atlas

MD Atlas indexes EUDAMED's public data — 1,752,505 devices as of June 2026, an indexed subset of the public data, not the complete database — with the manufacturers and the notified-body certificates recorded against them. You can look up a device and see its certificate and the body behind it, or search a company to check an actor — then confirm the notified body's designation in NANDO. (New to the public side? Start with Is EUDAMED public?.)

The short version: read the number, confirm it in NANDO, check the certificate in EUDAMED. A four-digit number after the CE mark points to the notified body; NANDO says whether that body is designated and for what; EUDAMED holds the certificate it issued — and a CE mark with no number usually just means a self-certified class I device.