Verifying Medical Device OEM Documents Programmatically: FDA, EUDAMED, and NANDO Data Sources

#python #datascience #medicaldevices #api

When you are building tooling for private label medical devices — especially a category like microneedling pens, which sits at the border of cosmetics and regulated medical devices — the hardest part is not manufacturing. It is verifying the paperwork. Certificates arrive as PDFs, scans, and screenshots, and the questions are always the same: is the registration number real, does the notified body exist, and does the device listing actually cover the product you are about to brand?

This post is a developer's field guide to the authoritative data sources you can query to verify OEM documentation without trusting the PDF itself: the FDA establishment registration and device listing database, the FDA GUDID, the EU NANDO database, and EUDAMED.

Why Trust the Database, Not the PDF

A certificate PDF is a claim; the database record is the evidence. When a factory sends an ISO 13485:2016 certificate, the certificate number should resolve on the issuing certification body's own search tool. When it sends an FDA establishment registration number, that number should resolve in the FDA establishment registration and device listing database to the exact legal name, owner/operator, and site address you are auditing.

The legal basis: in the United States, establishment registration and device listing are required under 21 CFR Part 807 (Subpart C), and quality systems under 21 CFR Part 820. In the European Union, EU MDR 2017/745 Article 52 governs conformity assessment, and Article 31 requires economic operators to be registered. Both regimes give you public, queryable databases.

OpenFDA: The Device Listings API

The FDA publishes establishment registration and device listing data through the OpenFDA device API. You can query the registration number, device listing status, owner/operator, and the product codes a facility lists:

Endpoint: https://api.fda.gov/device/registrationlisting.json
Query example: ?search=device.pkg_openfda.registration_number:"3001234567"
Rate limits: 240 requests per minute with an API key, 40 per minute without one

A minimal verification flow checks that the registration is active, the device listing includes the relevant product code, and the site address matches the factory address on the certificate:

import requests

def verify_fda_registration(reg_number, expected_product_code, expected_address):
    resp = requests.get(
        "https://api.fda.gov/device/registrationlisting.json",
        params={"search": f'device.pkg_openfda.registration_number:"{reg_number}"'},
        timeout=20,
    )
    results = resp.json().get("results", [])
    if not results:
        return {"match": False, "reason": "registration number not found"}
    listing = results[0]
    codes = {pc.get("product_code") for pc in listing.get("products", [])}
    return {
        "match": expected_product_code in codes
        and expected_address.lower() in listing.get("address", {}).get("address_1", "").lower(),
        "listing": listing.get("registration_number"),
        "status": listing.get("status"),
    }

GUDID: Checking UDI Records

If the product carries a UDI, the Global Unique Device Identification Database (GUDID) is the authoritative record. Under 21 CFR Part 830, labelers must submit UDI data to the FDA. The GUDID API lets you look up a device identifier (DI) and retrieve the brand name, catalog number, device description, and the submitting company. A factory that cannot produce a DI for its own microneedling pen cartridge is a red flag worth investigating before you put your brand name on the device.

NANDO: Verifying the Notified Body

For CE marking under EU MDR 2017/745, the notified body number printed on the certificate must resolve in the European Commission's NANDO database (new approach notified and designated organisations). NANDO records the organisation's identification number, the legislation it is designated under, and the scope of designation. Two checks matter: the organisation number exists, and the scope covers the device category and the activities listed on the certificate. A certificate citing a notified body whose scope excludes your device category is invalid for that device.

EUDAMED: Where EU Registration Lives

After full activation, EU MDR 2017/745 Article 33 requires economic operators to register in EUDAMED, the European database on medical devices. Actor registration, device registration, and certificate information all live there. Because EUDAMED modules activate progressively, check whether the factory has an EUDAMED actor registration today, and re-check once the certificate module is active. A factory claiming EU distribution that cannot show an EUDAMED actor registration is a compliance risk you do not want to inherit.

Certificate Date Math: Check on the Audit Date, Not the PDF Date

One of the most common audit failures is checking a certificate against records older than the certificate itself. Registrations lapse, addresses change, and scopes narrow. Your verification pipeline should therefore:

Query the database on the date of your audit, not the PDF creation date.
Compare legal name, owner/operator, and site address field by field.
Confirm the product code or device category is actually listed.
Log the query timestamp and result as evidence for your quality file.

Turning Verification Into a Repeatable Check

The output is a small, repeatable verification log: document number, source database, query date, and match status. That log is what an auditor — or a serious private label partner — wants to see, and it is the difference between a factory that emails you a screenshot and one that can hand you a database-backed audit trail. For an example of what a complete evidence package looks like, TBPHP's OEM team maintains a documentation checklist and sample technical file structure for microneedling pen programs; the same databases above are the ones their compliance team queries when verifying certificates on behalf of private label buyers. The checklist itself is also published on the TBPHP OEM Guide at tbphp.shop for reference.

Conclusion

The PDF is a claim; the database is the evidence. Whether you are writing a due-diligence script or just opening the FDA and NANDO search pages, verify the number, the scope, and the date. It takes ten minutes per document, and it is the cheapest insurance a private label brand can buy before signing an OEM agreement.

DEV Community