A CE certificate on a supplier's profile page is not due diligence — it is the starting point. Medical procurement managers routinely approve suppliers based on a document they never actually verify, and the consequences range from regulatory non-compliance to products stranded at customs. These are the five red flags most buyers overlook.

Red Flag 1: The Certificate References MDD, Not MDR

The EU Medical Devices Directive (MDD) has been superseded by the Medical Device Regulation (EU) 2017/745 (MDR). Transition deadlines are staggered — Class III and implantable Class IIb devices must hold MDR certification by 31 December 2027, and all remaining devices by 31 December 2028 (European Commission, Regulation 2023/607).

A supplier still operating under an MDD certificate is not automatically non-compliant — but you must confirm they have a written agreement with a Notified Body for MDR transition and that their device class and deadline allow continued MDD placement. If they cannot demonstrate active MDR transition progress, that is a sourcing risk.

Ask directly: What is your MDR transition status, and can you share your Notified Body engagement agreement? Reluctance to answer is itself a red flag.

Red Flag 2: The Notified Body Number Cannot Be Verified on NANDO

Every CE certificate issued by a Notified Body includes a four-digit identification number printed alongside the CE mark. That number must appear on the European Commission's official NANDO database (ec.europa.eu/growth/tools-databases/nando), and the body's listed scope must cover the device type in question.

Buyers rarely check this. Fraudulent or lapsed certificates sometimes carry valid-looking numbers that belong to bodies whose designation has been suspended or whose scope does not include the relevant device category. Cross-referencing takes under two minutes and eliminates a significant source of supplier fraud.

VERIFICATION STEP

Go to NANDO, search by the four-digit NB number on the certificate, confirm the body is currently designated under MDR, and verify that its scope covers the device classification you are sourcing.

Red Flag 3: The Certificate Scope Does Not Match the Product Being Sold

This is the most commonly missed technical error in CE verification. A certificate scope is a defined coverage statement — it lists specific device families, classification codes, or product descriptions that fall within the certification. Suppliers sometimes present a certificate that covers a related but distinct product line.

A manufacturer certified for Class I reusable surgical instruments cannot rely on that certificate to sell Class IIa powered devices. A certificate covering non-sterile examination gloves does not extend to sterile surgical gloves. The scope must explicitly include the exact device you are procuring.

Request the full certificate document, including the scope annex, not just the front page. If the scope language is vague, generic, or does not map clearly to the product in the order, escalate before proceeding.

Red Flag 4: The Legal Manufacturer on the Certificate Does Not Match the Supplier

The legal manufacturer named on a CE certificate is the entity that holds regulatory responsibility for the device. When you are sourcing from a trading company, distributor, or OEM reseller, their name will not appear on the certificate — the original manufacturer's will.

This is not automatically a problem, but it requires specific verification. The supplier must hold a formal distribution or resale agreement with the legal manufacturer, and they must be able to produce the EU Declaration of Conformity (DoC) signed by that manufacturer. If the company name on the invoice, the certificate, and the product labelling are three different entities with no documented relationship, do not proceed.

Red Flag 5: EUDAMED Registration Is Absent for Devices That Now Require It

From 26 May 2026, EUDAMED registration has become mandatory for new devices entering the EU market, with legacy device registration required by 27 November 2026 (European Commission, EUDAMED mandatory timelines, 2026). For Class III and implantable Class IIb devices, this is not optional.

Buyers sourcing devices in these categories should request the manufacturer's EUDAMED device registration reference. An absence of registration for a higher-risk device class — particularly from a supplier claiming EU market compliance — is a material compliance gap that must be resolved before contract.

A CE certificate proves that a conformity assessment was completed at a point in time. It does not prove the device you are receiving today is the same as the one assessed, that the certificate is still valid, or that the Notified Body that issued it is still designated.

CE verification is a five-minute process per supplier that most procurement teams skip entirely. The five checks above — MDR transition status, NANDO NB verification, scope-to-product match, legal manufacturer identity, and EUDAMED registration — cover the majority of compliance failures found during supplier audits. Manufacturers listed on Suplivia are required to provide current certification documentation as a condition of verification, giving buyers a faster starting point for each of these checks.