A week ago, I joined a group of volunteers to help source and ship medical supplies from China to Europe so our frontline staff has everything they need to fight the coronavirus.

My work has mainly focused on verifying product certifications and I HAVE THOUGHTS ABOUT THIS

Most governments ensure that imported goods meet their required safety rules through developing standards, requiring manufactures to hire certification organizations to verify their work, and providing a mechanism for validating these certificates.

A strong certification system removes many blockers for (international) trade, as it brings trust into a free market which can’t always rely on reputation.

It reduces the risk that you are buying a faulty product.

This is especially needed during a crisis.

For most medical equipment, these types of certifications are required. In the European Union, this is done through the CE certification process.

Here is how certificate validation works:

Find a supplier

Get their certificate

Figure out who issued it

Use the certifier’s website to validate it

Verify the certifier in the Nando database

This process works, but it could be much better

While it’s amazing that the European Union has defined all these standards and requires a certification process, it failed to standardize the certificates themselves nor the verification process.

Each certificate looks different:

Few have security features

Some don’t list the certifier’s legal entity

Some don’t list the certifier’s website

Each certifier’s website works differently

Few certificates list their Nando number

It makes the process slow

The easy fix is for the EU to standardize the minimum set of information and a layout it should be presented in.

All certificates should have:

Link (and QR code) to the certifier’s copy of the certificate
Link (and QR code) to the Nando listing

The long term fix would be to centralize not only the certification organization listings, but also the certificates themselves.

Why do buyers need to hunt down individual certificates across different databases if Nando could just serve all of them?

In the grand scheme of things, this is an incredibly minor inconvenience and I’m happy that doing this work is contributing in a small way to reducing the pain of this pandemic

I hope that we as a society learn from this crisis in many ways and perhaps streamlining the certification validation process could be one of the small things we improve

To give you an idea:

Validating a certificate can take ~30 minutes if you are having a hard time locating the certifier’s website and navigating it in a foreign language, whereas this really should be 5 minutes of work.

8 hours / 30 minutes = 16
8 hours / 5 minutes = 96

Here’s an example:

We found a new supplier with a seemingly legitimate certificate from a supposedly UK-based certifier.

Certifier doesn’t show in Nando → Hard no
Email certifier to double check → Bounced
Domain registered from China
Server configured in Chinese

Round 2 of this certification thread:

Get ready to discuss how legitimate European certifiers also issue fake certificates

And yes, I’ll be NAMING and SHAMING some of these companies because they are putting the health of people at risk in times of crisis

After verifying dozens of potential Chinese manufacturing leads for medical supplies, I noticed that 3 certification companies tended to show up much more frequently than others.

These are Ente Certificazione Macchine (Italy), ICR Polska (Poland), and Celab (Italy).

I first noticed this when we started receiving Celab’s fake certificates for medical supplies, which made no sense to me because they are only accredited to complete “electromagnetic compatibility” certification

https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=search.nb&refe_cd=NANDO%5FINPUT%5F124828

We then received ICR Polska certificates from potential suppliers, which was confusing because they are accredited for certifying “protective systems intended for use in potentially explosive atmospheres” which sounds like masks but isn’t

https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=search.nb&refe_cd=NANDO%5FINPUT%5F233263

And eventually we got loads of fake certificates by Ente Certificazione Macchine, which was very disconcerting because they are even accredited to certify “medical devices” but that still does not cover “personal protective equipment”

https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=search.nb&refe_cd=EPOS%5F50158

Personal protective equipment, like masks, is required to be CE certified before it can be sold on the European market — as it should be! Faulty products can kill you.

All of these products have to adhere to “Regulation (EU) 2016/425” https://ec.europa.eu/growth/sectors/mechanical-engineering/personal-protective-equipment_en

The Nando database helpful lists which EU-based certification organizations are accredited for certifying products under “Regulation (EU) 2016/425” and you will see that ECM, ICR and Celab are not on it.

https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=155501

And then a couple of days ago, ICR Polska all of the sudden put a warning message on top of all their webpages saying that “assessments carried out so far are of a voluntary nature” and “these certificates do not confirm conformity.”

It seems like something spooked them.

So I started digging into what ICR meant by “voluntary nature” and I can tell you now:

It’s not pretty.

Turns out these companies have two business lines:

Actual regulatory certification
Fake certificates as marketing documents

Both of those look official, come with the same branding, and pass the document validation check.

However, these marketing documents are BULLSHIT.

These certification organizations will sell fake certificates as “voluntary certification” which only has to live up to the certifier’s standards, not the regulatory ones.

Manufactures can essential buy the branding of a legitimate certification organization for marketing.

ECM calls this their “Voluntary Mark for Product Certification” and helpfully describes it as:

“The Mark may only be used for advertising and promotional purposes and can not in any way refer to the product's compliance with regulations.”

http://www.entecerma-it.cn/img/pdf/ECM-Mark-Regulation.pdf

Celab is even more straightforward and says “the voluntary certificate is not for customs purposes or to demonstrate to the supervisory compliance with the requirements of the CE marking of a product.”

https://celab.com/en/ce-marking/voluntary-certificate/

However, the real and the fake certificates both look official, come with the same logos, and show up in the same verification system.

The only difference is that you have to carefully determine whether it’s a “voluntary one.”

I don’t know what the history is behind this, but it feels like a loophole.

Some Chinese manufacturers are clearly abusing it in their effort to dump poor quality medical products onto the European market for a quick buck.

I’m surprised that the European Union allows their accredited certification organisations to run a side-business handing out fake certificates based on the brand value they built within the official system.

It’s unconscionable. Let’s fix it