kangshida The short answer. Almost every documentation delay in a contact lens export deal traces back to four things: the free sale certificate and the legalisation chain bolted onto it, the EU Unique Device Identification (UDI) system, the label rules that decide whether a UDI is actually compliant, and the routine request for a “GMP certificate” — which is usually a request for something that does not exist. The first is a paperwork problem, solved in days once the right issuing authority is identified. The other three are design decisions, settled at artwork approval. Get them wrong and the goods are not delayed at the border; they are rejected there.
Why documentation blocks more deals than price
Buyers assemble a document list from three sources: a competitor’s registration file, a template from their distributor, and a tender specification. Each source is a copy of a copy. By the time the list reaches a manufacturer it mixes three completely different categories of paper:
- documents the manufacturer must issue, because its own quality system generates them
- documents a government authority must issue, on the manufacturer’s application
- documents nobody issues, because the requester has the wrong name for what they need
Sorting a request list into those three groups resolves most compliance disputes before they start. What follows is the working version of that sort, for the four items that come up in almost every deal.
1. The four third-party documents, and what each one proves
| Document | What it actually proves | Who issues it | Typically needed for | What it does not do |
|---|---|---|---|---|
| Free Sale Certificate (FSC) | The device is legally registered or filed in the manufacturing country and may be freely sold there | The competent authority of the manufacturing country — in China, typically the provincial medical products administration where the device is registered | Distributor registration files, tenders, some customs entries | Grant market access in the destination country, or replace the importer’s own registration |
| Apostille | The signature and seal on a public document are genuine | The designated authority of the issuing state — in China, the Ministry of Foreign Affairs or an authorised local Foreign Affairs Office | Any Hague Convention destination | Validate the content of the document it is attached to |
| CCPIT authentication | A commercial document — invoice, price list, certificate of origin, packing list — is authentic | China Council for the Promotion of International Trade | Customs clearance, registration dossiers, letter-of-credit packages | Certify the product itself |
| Consular legalisation | The document chain is authenticated for a destination that is not a Hague Convention Contracting Party | The destination country’s embassy or consulate, after domestic authentication | Non-Hague markets, including several in the Middle East and North Africa | Shorten the process — it is the longest of the four |
The apostille change that buyers still miss
China has been a Contracting Party to the 1961 Hague Apostille Convention since 7 November 2023. For the 130 Contracting Parties listed in the HCCH status table, that replaced the embassy step with a single apostille. Buyers who built their document templates before 2023 are often still asking for consular legalisation on shipments that no longer need it — which adds weeks for no regulatory benefit.
The reverse error is more expensive. Full consular legalisation is still required where the destination is not a Contracting Party. As of the HCCH status table update of 30 June 2026, that includes markets such as Iraq, Kuwait, Libya, Egypt, Lebanon, Jordan and the United Arab Emirates. Verify the destination against the current status table rather than against a template: Thailand’s accession takes effect in February 2027 and Viet Nam’s in September 2026, and the list changes every year.
Two clarifications worth putting in writing, because they prevent arguments later:
An apostille authenticates a signature, not a claim. It confirms that the notary or official who signed the certificate was who they said they were. It says nothing about whether the product is any good, or whether the certificate’s content is true. Buyers occasionally treat an apostilled document as a higher grade of evidence. It is not.
An FSC is a home-market statement. It says the device may be sold in the country of manufacture. It does not register the device anywhere else, and it does not substitute for a CE mark, an FDA clearance or a local registration. A distributor who asks for an FSC “so we can sell it” is describing a step, not a permission.
Who pays, and why it belongs in the quotation
Third-party certificates are issued by authorities that charge for them, and the charge is a pass-through cost, not a product. Whichever way it is allocated — buyer, seller, or split — it belongs in the quotation as a named line, not in an email three weeks after the purchase order. Deals stall on exactly this: an invoice for a certificate nobody budgeted for, arriving while the goods wait in a warehouse.
The other half of the principle is less often stated. Documents a manufacturer generates as part of running its own quality system — the EU Declaration of Conformity the manufacturer is legally obliged to issue, technical file extracts, the ISO 13485 certificate copy, product datasheets and specification sheets — are outputs of the quality system, not services. Charging separately for them is a signal worth reading.
2. EU UDI: the sequence that cannot be reversed
| Step | Action | Why the order matters |
|---|---|---|
| 1 | Review the outer packaging | Labelling compliance is approved at packaging level first. Until the pack format and label layout pass review, there is no artwork to encode against. |
| 2 | Apply for the UDI code | Label space, data-carrier type and symbol size all follow from the approved artwork. Applying before artwork is approved produces a code that does not fit the pack you end up printing. |
| 3 | Mark on the factory line | The carrier is printed online by the factory’s dedicated UDI printer during production, because the production identifiers change with every run. Outsourced or offline pre-printing cannot carry a batch-specific code. |
What changed in 2026
The EUDAMED UDI/Device registration module became mandatory on 28 May 2026, alongside actor registration, notified body and certificates, and market surveillance. Devices placed on the market from that date must be registered before first placement; devices already on the market have a transition window that closes in late November 2026.
For contact lenses this is not a formality. Most are Class IIa, and the UDI obligations for Class IIa took effect in May 2023 — the 2026 date is when the database became compulsory, not when the label rule started. A supplier who only began preparing in 2026 is three years behind on the label and catching up on the registry.
Which packaging level actually carries the code
This is the question that most often derails an otherwise correct UDI project, and the MDR does answer it — in Annex VI, Part C, section 4.3.
For single-use devices of Class I and IIa that are individually packaged and labelled, the UDI carrier is not required on the individual pack. It may sit on a higher level of packaging, such as the carton holding several unit packs. That concession comes with an exception: where the healthcare provider or end user is not expected to have access to the higher-level packaging — home healthcare being the cited example — the carrier must be on the individual unit pack.
Coloured contact lenses sold at retail, through opticians, or direct to consumers fall on the exception side of that line. The wearer receives a single blister, not a carton. If the UDI is only on the carton, the unit that reaches the consumer carries no UDI at all.
Practical consequence for a buyer comparing quotations: ask which packaging level carries the carrier, and check that the answer matches how the product will actually be distributed in your market. A specification that is compliant for clinic-supplied lenses can be non-compliant for retail.
3. The two label red lines
Red line one: a UDI-DI on its own is not a UDI
Annex VI, Part C, section 3.3 is unambiguous — the UDI consists of two parts, a UDI-DI and a UDI-PI. Section 3.5 then closes the loophole: if a lot number, serial number, software identification or expiry date appears on the label, it must be part of the UDI-PI.
That second sentence is what makes the rule bite for contact lenses. Annex I, section 23.2 requires the lot number and, where applicable, the expiry date to appear on the label of a sterile device. Contact lenses are sterile and single-use, so both appear. Both therefore have to be inside the production identifier.
A label carrying only the device identifier is not a partially compliant label. It is a non-compliant one.
Red line two: the full code changes with every batch
Because the code embeds lot number and expiry date, it cannot exist as a fixed barcode on pre-printed artwork. It has to be generated at the moment of production.
This is not an argument against pre-printed labels. It is an argument for separating the two kinds of data on the artwork:
- Fixed content — brand, device name, manufacturer identification, CE mark, the UDI-DI as human-readable text, IFU symbols — is approved once and printed.
- Variable content — the 2D data carrier holding UDI-DI plus lot and expiry — is left as a reserved zone and filled online by the marking printer.
Artwork that reserves that zone correctly survives every batch. Artwork that bakes a barcode into the print file produces a label that will fail on the first shipment.
The failure this prevents
The expensive version of a UDI error does not look like a UDI error at the time. Artwork is approved. Labels are printed. The batch is manufactured, packed and shipped. The rejection happens at the border, on the grounds that the label carries a fixed code instead of a batch-specific one. At that point the options are rework, relabelling under quarantine, or destruction — and the cost is not the labels but the batch, the freight and the season.
The same failure is cheap to prevent at the artwork stage, and impossible to prevent after printing. That asymmetry is the whole reason the three-step sequence exists.
4. When a buyer asks for a “GMP certificate”
GMP is a regulation, not a certificate
Good Manufacturing Practice is a production quality management regulation. In China it is set out in the Medical Device Production Quality Management Specification, announced in 2014, and compliance with it is examined as part of production licensing and regulatory inspection. The system does not issue a standalone GMP certificate for medical devices, because there is no such certificate to issue.
This matters commercially: a supplier who promises to “apply for the GMP certificate” has either misunderstood the request or is planning to send you something else under that name.
GMP is best understood as a floor, not a credential. A factory that does not meet it cannot obtain production qualification, which means it cannot legally manufacture at all. Every legitimate supplier you can buy from already clears this bar — which is why a GMP letter adds less information than buyers expect.
What the request usually means is ISO 13485
In most conversations, the “GMP certificate” being requested is the quality management system certificate. That is ISO 13485 — the standard for quality management systems in medical device design and manufacture.
The confusion is not irrational, and in 2026 it became less of a confusion. On 2 February 2026, the FDA’s Quality Management System Regulation took effect, replacing the old 21 CFR Part 820 CGMP framework and incorporating ISO 13485:2016 by reference. In the US market, the regulatory quality requirement and the international standard are now substantially the same document. A buyer who says “GMP” and a supplier who says “ISO 13485” may be describing the same evidence.
Four things buyers conflate under one word
| What the buyer asked for | What it usually means | What to send | What it proves |
|---|---|---|---|
| “GMP certificate” | ISO 13485 quality management system certificate | ISO 13485:2016 certificate with a verifiable certificate number, issuing body and scope | The QMS is certified by an accredited body, within a stated scope |
| “GMP compliance” | Production authorisation under national GMP rules | Production licence or filing record from the competent authority | The manufacturer is authorised to produce this class of device |
| “CE certificate” | EU Declaration of Conformity plus notified body certificate where applicable | DoC under MDR Annex IV, with the notified body’s certificate number | The device conforms to Regulation (EU) 2017/745 |
| “FDA certificate” | Establishment registration for the facility | Facility registration number (FEI) | The facility is registered — not that the product is cleared |
The last row is where serious mistakes happen. A registered facility and a cleared product are different facts. Both matter; neither substitutes for the other.
The question to put back to the buyer
The productive reply is factual rather than defensive: ask which document the destination authority’s registration checklist actually names, and whether that authority treats GMP as equivalent to ISO 13485 or requires a specific certificate.
Most buyers cannot answer immediately, and that is the point. The answer determines which document is worth paying an authority to produce, and which one is just a familiar word in a template. In the meantime, the full ISO 13485 package — certificate, scope, issuing body, validity — covers the request in the overwhelming majority of files.
5. The document checklist, for both sides of the deal
| Buyer’s request | Document | Issued by | What to check before accepting it |
|---|---|---|---|
| Free sale certificate | FSC | Manufacturing-country authority | That the device named matches the device ordered, and that an FSC is actually required by the destination |
| Legalised documents | Apostille or consular legalisation | MFA / local Foreign Affairs Office, or the destination embassy | That the destination is (or is not) a Hague Contracting Party today |
| Authenticated commercial documents | CCPIT authentication | CCPIT | That the document set matches what customs or the bank asked for |
| UDI | UDI-DI plus UDI-PI on the label, DI registered in EUDAMED | Manufacturer, via an issuing agency | Which packaging level carries the carrier, and that the code is batch-specific |
| “GMP certificate” | ISO 13485 certificate, production licence, DoC | Certification body, competent authority, manufacturer | Scope, certificate number, validity, and which of the three the buyer actually needs |
| Technical documentation | Technical file, DoC, test reports | Manufacturer | That the file covers the configuration you are buying, not a sibling product |
FAQ
Is a free sale certificate the same as a CE certificate? No. An FSC is issued by the manufacturing country’s authority and states that the device may be sold in that country. A CE mark is an EU conformity claim, supported by a Declaration of Conformity and, for Class IIa and above, a notified body certificate. One does not imply the other.
Does an apostille replace consular legalisation? Only for Hague Convention destinations. China has been a Contracting Party since 7 November 2023, so an apostille replaces the embassy step for the 130 Contracting Parties. Non-Contracting Parties — including Iraq, Kuwait, Libya, Egypt, Lebanon, Jordan and the UAE as of mid-2026 — still require full consular legalisation.
Can the UDI be printed as a fixed barcode on the artwork? Not for the unit-level carrier. If the lot number and expiry date appear on the label — which they must for sterile contact lenses — they must be part of the UDI-PI under MDR Annex VI, Part C, section 3.5. Because they change every batch, the carrier has to be produced online.
Does every individual blister need a UDI carrier? It depends on the packaging level and the route to market. For individually packaged single-use Class I and IIa devices, Annex VI, Part C, section 4.3 allows the carrier on a higher level of packaging — unless the end user will not have access to that packaging. For lenses sold at retail or direct to consumers, the unit pack is what the wearer receives, so the carrier belongs there.
Is GMP the same as ISO 13485? Not the same, but closer than it used to be. GMP is a regulation; ISO 13485 is a certifiable standard. In the US the two converged on 2 February 2026, when the FDA’s Quality Management System Regulation incorporated ISO 13485:2016 by reference. In China, GMP compliance is examined through production licensing rather than certified separately.
Is an FDA-registered facility the same as an FDA-cleared product? No. Establishment registration registers the facility. Clearance — a 510(k) or PMA — authorises a specific device to be marketed. A supplier citing an FEI number is proving the first, not the second.
Who should pay for third-party certificates? Whoever benefits from the document, agreed in writing before the order. What matters less than the allocation is that it appears in the quotation as a named line item rather than arriving as an unbudgeted invoice mid-production.
How long does a free sale certificate take? The binding constraint is not processing time but eligibility: an FSC cannot be issued for a device that is not already registered or filed in the manufacturing country. Confirm the registration status first; the processing time only becomes the question after that.
Related terms
Free Sale Certificate · Apostille · Consular legalisation · CCPIT authentication · Unique Device Identification (UDI) · UDI-DI · UDI-PI · Basic UDI-DI · EUDAMED · Declaration of Conformity · Notified Body · ISO 13485 · GMP · Production licence · FDA establishment registration
Sources
European Union
- Regulation (EU) 2017/745 on medical devices (MDR), full text, including Article 27 and Annexes I and VI: https://eur-lex.europa.eu/eli/reg/2017/745/oj/eng
- European Commission, Medical Devices — EUDAMED (first four modules mandatory since 28 May 2026): https://health.ec.europa.eu/medical-devices-eudamed_en
- European Commission, EUDAMED — UDI/Devices registration: https://health.ec.europa.eu/medical-devices-eudamed/udidevice-registration_en
- MDR Annex VI (registration data, UDI system, Part C): https://www.medical-device-regulation.eu/2019/07/25/annex-vi-information-to-be-submitted-upon-the-registration-of-devices-and-economic-operators-in-accordance-with-articles-294-and-31-core-data-elements-to-be-provided-to-the-udi-database-together/
Legalisation
- HCCH, Status table — Convention of 5 October 1961 Abolishing the Requirement of Legalisation for Foreign Public Documents (China in force 7 November 2023; 130 Contracting Parties, status updated 30 June 2026): https://www.hcch.net/en/instruments/conventions/status-table/?cid=41
United States and standards
- FDA, Quality Management System Regulation (QMSR), effective 2 February 2026, incorporating ISO 13485:2016 by reference: https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr
- ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes: https://www.iso.org/standard/59752.html
For the underlying EU and US classification rules that determine which requirements apply to a given lens, see Why Contact Lenses Are Regulated as Medical Devices. For who holds the technical file under each supply model, see OEM vs ODM vs Private Label.
