ISO 13485 and MDSAP: What These Quality-System Credentials Mean for a Buyer

Table of Contents

• 1. Two Kinds of Evidence, Two Different Questions
• 2. Reading an ISO 13485 Certificate
• 3. What MDSAP Does — and Does Not — Mean
• 4. Combine System Evidence With Product Evidence
• 5. How to Announce a Certification
• 6. Our Own Position, Stated Carefully
• 7. What We Will Provide for Verification
• 8. References & External Links

---

1. Two Kinds of Evidence, Two Different Questions

Most confusion about credentials comes from mixing four questions that feel like one. They are answered by different documents, and none of the documents answers a question it was not designed for.

The Question	What Answers It	What Does Not
Is this model cleared to be marketed here?	The regulatory record for that model and those indications, checked at source.	An ISO 13485 or MDSAP credential — a quality-system audit is not a product authorisation.
Can this supplier keep making it consistently?	Quality-system evidence whose scope covers these processes at this site, plus production records showing it is used.	A test report for a single sample, however good.
Does the device perform as claimed?	Model-specific optical, electrical and material results — and clinical evidence where a health claim is made.	A quality-management certificate, which says nothing about performance.
Who is accountable if something fails?	The contract, the named roles and the complaint process.	Either credential on its own, since neither names a person.

Keeping these four apart is most of the work. Everything that follows is detail on how to read the two credential types that get asked about most.

---

2. Reading an ISO 13485 Certificate

ISO 13485 sets out requirements for a quality management system in the medical-device context. Whether it applies to a particular supplier, or to a particular activity within that supplier, depends entirely on the certificate’s scope and on the organisation’s role in the chain. Five things have to be read before the certificate means anything.

• The issuing body. Who certified it determines what weight the certificate carries, and some buyers have approved lists.
• The certificate holder. The name on the certificate is not always the name on your purchase order.
• Covered sites and activities. A scope can name one site and exclude another, and can cover design while excluding production — or the reverse.
• Validity. The issue date and the expiry date, read together, and checked on the day you rely on it.
• Exclusions. What the certificate explicitly does not cover. This is usually the most informative line on the page.

The logo alone is insufficient, and it is worth saying so plainly because logos travel further than certificates do. A logo on a website, a slide or a carton tells you that someone in the organisation believes the certificate exists. It does not tell you whose name is on it or what it covers.

---

3. What MDSAP Does — and Does Not — Mean

The Medical Device Single Audit Program provides a model for auditing a participating manufacturer’s quality-management system against the applicable requirements of participating regulators. That sentence is deliberately narrow, and every clause in it matters.

It is an audit of a quality-management system, not of a product. It applies to participating manufacturers and participating regulators, which is not the same as all of them. And it produces an audit outcome, whose meaning for your market depends on which regulator is participating and what it does with that outcome.

So it should not be described as a blanket product approval, and a product should never be called “MDSAP approved” — the phrase confuses a system audit with a device authorisation. What a buyer should confirm is narrower and answerable: which organisations, which sites, which activities and which markets are covered, and what the audit outcome actually represents for the market you are entering.

---

4. Combine System Evidence With Product Evidence

A supplier evaluation needs both, and they fail in opposite directions. A quality certificate does not replace optical, electrical or material evaluation of the device. And a single good test result does not show that a supplier can maintain consistency over time — it shows that one unit, on one day, met one criterion.

The practical list is short. Review test reports for the exact device; the specification and its revision; traceability records; risk-management practice; production inspection; nonconformance handling; and change control. The first three tell you about the product. The last four tell you whether the product you approved is the product that keeps arriving.

---

5. How to Announce a Certification

Certification announcements are where the most avoidable compliance problems begin, because they are written by marketing from a document that procurement has not read. Five elements belong in any announcement, and three phrases should never appear.

The five elements: the exact credential and standard; the certificate holder; the issuing body; the scope, stated in the certificate’s own terms; and the validity dates. Add a link to an authoritative explanation of the standard where one exists, so a reader can check rather than trust.

The three phrases to avoid: “MDSAP approved”, which converts a system audit into a product authorisation; “certified, therefore cleared”, which implies certification grants market access; and any suggestion that a scope covers more than the certificate says — including other sites, other activities or other product lines.

One rule covers the whole section: publish what the certificate says, in the certificate’s words, and nothing that the certificate does not say. An announcement that is slightly less exciting and completely defensible is worth more than one that has to be withdrawn.

---

6. Our Own Position, Stated Carefully

This page describes how to read quality-system credentials. It does not assert that Rainbowdo holds an ISO 13485 or an MDSAP certificate, because a claim of that kind should only be published after the current certificate, its holder, its scope and its validity have been verified — and that verification is not something this page can perform on your behalf.

So treat the two credential types separately when you evaluate us, and ask for each explicitly:

• For a product question, ask for the regulatory record covering the model you are buying. FDA’s public records identify the models under K243423 and K253712, and those model lists and decision language should be read on the official records rather than in a summary.
• For a quality-system question, ask for the certificate itself — holder, issuing body, scope, sites, validity and exclusions — and verify it with the issuing body. If a scope has to be explained at length, that is worth listening to rather than skipping.
• For a claim about a newer record, ask for the document. Rainbow reports an SE Letter for hair-cap 510(k) K263313; the public entry had not been independently retrieved when this page was prepared, so the letter is the document to read, and it should not be presented as a searchable database entry until one exists.

The two are not interchangeable in either direction. A product clearance is not evidence that a quality-system certificate is current, and a quality-system credential is not evidence that a different model has a specific clearance. Confirm holder, scope, validity and applicable model on each document you rely on — including ours.

Evaluating a supplier’s quality-system evidence? Visit our
Custom Light Therapy Manufacturing Page.

---

7. What We Will Provide for Verification

Rainbow Technology runs ODM and OEM programmes from our Shenzhen facility. A credential question is a reasonable one to ask any supplier, and these are the items we will put in front of you rather than describe:

• Documents rather than descriptions, so holder, issuing body, scope, sites and validity can be read directly.
• The exclusions stated alongside the scope, because a certificate that is quoted without them is being quoted selectively.
• A controlled-review route for anything that cannot be sent by email, offered at the point of refusal.
• Product records kept separate from system records, so neither is asked to prove something it cannot.
• Sample and small-batch production from 500 units, with a stated capacity of 100,000 units per month; both figures depend on model, configuration, packaging and schedule, and are confirmed in a formal quotation.
• Compliance documentation matched to the exact model for your target market. Where a model holds a 510(k) record we provide the K-number so you can check its scope in the FDA’s public database; clearance is not the same as FDA approval, and the scope differs from model to model.

---

8. References & External Links