What documentation to demand from a PPE supplier
A certificate states a conclusion. A test report shows what was tested, by whom, against which clause, and what happened. What to demand from a PPE supplier, in what order, how to check a notified body is real and in scope, and why the edition on the certificate matters more than the certificate.
Every PPE offer arrives with paperwork. Most of it is the wrong paperwork, and a surprising amount of it is not evidence of anything.
The gap that matters is between a document that makes a claim and a document that shows a result. A certificate is a claim. A test report is a result. Buyers routinely file the first and never ask for the second, and the difference only becomes visible when something fails.
This article sets out what to ask for, in what order, and how to check that what arrives is real. It is written for European buyers of gloves, gowns, masks and other disposable protective equipment, and it assumes the products in question are Category III PPE, medical devices, or both at once.
Key takeaways
What is the difference between a certificate and a test report?
A certificate states a conclusion. A test report shows what was tested, by whom, on what date, against which clause, and what the result was. Only the second one lets you check anything.
The distinction is not academic. In a study of 22 commercial single-use isolation gown models from six manufacturers, published by Kilinc-Balci in the American Journal of Infection Control in December 2023, seven of the models did not pass liquid and viral penetration testing to ANSI/AAMI PB70 at the level claimed by the manufacturer. The majority of those failures were at the seam or the tie attachment areas rather than in the fabric.
That last detail is the one to carry into a specification. Barrier classifications are assigned on the critical zone material. A garment can hold at the fabric and leak where two pieces of it are joined, and the classification printed on the box will not tell you, because the joins were very likely never tested.
So the first question to a supplier is not "is it certified". It is "send me the test report, and tell me whether it covers seams and junctions".
What does a Category III certificate actually have to be?
Two documents, not one. Regulation (EU) 2016/425 Article 19(c) requires Category III PPE to undergo EU type-examination, module B, set out in Annex V, and then either module C2, Annex VII, conformity to type based on internal production control plus supervised product checks at random intervals, or module D, Annex VIII, conformity to type based on quality assurance of the production process.
Module B is a one-off. A notified body examines a sample of the type and issues a certificate saying that the type meets the essential health and safety requirements. Nothing about module B says anything about the boxes arriving on your pallet this month.
Module C2 or module D is the part that speaks to production. C2 means a notified body carries out product checks at random intervals. D means the notified body has approved and monitors the quality system behind the production process.
A supplier who sends only the EU type-examination certificate has sent you half the picture, and it is the half that says least about what you are actually buying. Ask which of C2 or D applies, and ask for the evidence of it.
How do you check the notified body is real, and in scope?
Two checks, and both take a couple of minutes. The Commission publishes the register of notified bodies, historically known as NANDO and now reached through the Single Market Compliance Space at webgate.ec.europa.eu/single-market-compliance-space. Look the body up by its number.
Then check the scope. A body is notified under specific legislation, and its designation covers defined products and procedures. A body notified for one regulation cannot certify under another, and a body whose scope does not include the product in front of you cannot certify it either. The letterhead can be entirely genuine and the certificate still worthless.
This is not a hypothetical failure mode. During the 2020 procurement surge the European Safety Federation maintained a public list of suspicious and invalid PPE certificates, and a recurring category was certificates issued by real bodies outside their notified scope, alongside outright forgeries. We wrote a short note about it at the time. The surge ended. The failure mode did not.
The third check is the CE marking itself. Under Article 17, the CE marking on Category III PPE must be followed by the identification number of the notified body involved in the production control procedure. A Category III product with a bare CE mark and no number is telling you something. So, in the other direction, is a Category I product carrying a notified body number it has no business having.
What should the EU declaration of conformity contain?
It should exist, first of all, and a surprising number of suppliers treat it as optional. Article 15 of the Regulation requires the declaration to state that fulfilment of the applicable essential health and safety requirements in Annex II has been demonstrated, following the model structure in Annex IX, and to be kept continuously updated.
It is the manufacturer's own signed statement, not a third-party verification, which is exactly why it is useful. It names the standards applied, it names the notified body and the certificate, and it puts a named legal person behind the claim. If a supplier will not put that in writing, the reason is worth understanding before the tender closes.
Two things to check on it. That the standards it lists are the ones you specified, by edition. And that the legal manufacturer named on it is the entity you think you are buying from.
Which standard editions should the documents name?
The current ones, and this is where more offers fail than anywhere else. A certificate is issued against a standard as it stood on the day, and standards move underneath certificates without anyone reissuing anything.
The most instructive current example is the general requirements standard for protective gloves. EN ISO 21420:2020 superseded EN 420:2003+A1:2009 in 2020, and national standards bodies withdrew conflicting standards by September that year. Yet Commission Implementing Decision (EU) 2026/1279, published in the Official Journal on 16 June 2026, lists EN ISO 21420:2020 together with its amendment A1:2024 in Annex I, and lists EN 420:2003+A1:2009 in Annex II with the presumption of conformity withdrawn on 16 December 2027.
Read that carefully, because it cuts both ways. A supplier holding a certificate against EN 420 today is not selling a non-compliant glove. But a framework agreement signed this autumn for three or four years runs past December 2027, and if it cites EN 420 the citation expires inside the contract term. Nobody notices until a renewal audit.
That last row is its own trap. The parts of the EN ISO 374 series carry different dates, so a document citing "EN 374" or "EN 374:2016" as a family reference has not told you which part was tested or against which edition. Our guide to the EN ISO 374 series sets out what each part covers, and the EN 455 series guide does the same for the medical glove standards.
What is usually missing from a test report?
Four things, and you will only get them if you ask by name.
Sample identification. A report that does not say which batch, lot or production run the samples came from cannot be tied to anything you receive.
The date, and the testing laboratory. A ten-year-old report from an unnamed lab is a document, not evidence.
The clause, not just the standard. "Tested to EN 455-2" is not a result. The clause and the measured value are.
Seams and junctions, for anything constructed. Generally only the primary material is tested. For gowns, coveralls and anything with a join, the seam is where the published failures occur, so ask whether the report covers it and treat silence as a no.
For gloves specifically, one more: the AQL and the sampling plan behind it. An AQL is a property of an inspection, not of a glove, and it means nothing without the plan and the lot size. See what AQL actually means before you write a number into a specification.
Who is the legal manufacturer, and does the paperwork agree?
Ask early, because the answer decides who holds everything else. For a medical device, the legal manufacturer is the entity that assigns the UDI and registers the device, and it is the entity holding the technical file. Where a product is sold under a private label with a different company named as the legal manufacturer, the traceability behind it belongs to the manufacturer of record rather than to the brand on the carton.
If those are two different companies, ask which one holds your technical file, and check that the declaration of conformity, the notified body certificate and the labelling all name the same legal person. Our article on MDR 2017/745 and medical gloves covers the device side of this in more detail.
What to ask for, in order
A working sequence, shortest to longest lead time, so nothing waits on anything else.
1. The EU declaration of conformity, current version. 2. The EU type-examination certificate, module B, with the notified body number. 3. Evidence of the module C2 or module D arrangement, and which of the two applies. 4. Test reports by clause, with sample identification, date and testing laboratory named. 5. Confirmation of which standard editions every document was issued against. 6. The name of the legal manufacturer, and confirmation it matches every document above. 7. For constructed items, confirmation that seams and junctions were included in barrier testing.
None of that is unreasonable to ask, and a supplier who can produce it quickly is telling you something useful about how they run. So is one who cannot. Our nitrile examination gloves are specified against the current editions for exactly this reason, and the same list is what we expect to be asked for.
If you are writing the requirement into a tender rather than checking an offer, our guide to writing a glove specification for a public tender sets out how to make each of these an award criterion that can actually be evaluated.
Questions we get asked
A supplier has sent a CE certificate. Is that enough? No, and strictly there is no such thing as a "CE certificate". CE marking is affixed by the manufacturer on its own responsibility. What exists is an EU type-examination certificate from a notified body, plus the module C2 or D arrangement, plus the manufacturer's own declaration of conformity. Ask for all three.
How can I tell a genuine certificate from a purchased one? Check the notified body's number in the Commission's register, then check that the certificate falls inside that body's notified scope, then check the certificate is for the product and procedure in front of you rather than a related one. Most invalid certificates fail on scope rather than on forgery.
Does a Category III product always carry a four-digit number after the CE mark? Yes. Article 17 requires the CE marking on Category III PPE to be followed by the identification number of the notified body involved in the production control procedure. Its absence is a reason to ask questions.
Our supplier says the test report is confidential. Barrier and physical performance results for a product being offered are not commercially sensitive in the way a formulation is. A redacted report that still shows the clause, the method, the sample identification and the result is a reasonable compromise. A refusal to show any result at all is an answer in itself.
How often should documentation be refreshed? Re-check editions at least annually, and always at renewal. The harmonised standards list is amended periodically, and a document that was current when the agreement was signed may not be current when it is renewed.
Sources
Regulation (EU) 2016/425 on personal protective equipment, Articles 15, 17 and 19 and Annexes V, VII, VIII and IX, read on EUR-Lex. Commission Implementing Decision (EU) 2026/1279 on harmonised standards for personal protective equipment, Official Journal 16 June 2026. Kilinc-Balci FS, "Investigation of the Barrier Performance of Disposable Isolation Gowns", American Journal of Infection Control, December 2023, 51(12):1401-1405. Regulation (EU) 2017/745 on medical devices. Standard editions are as recorded in our own standards library, verified against the source documents.
Seventeen years sourcing and supplying medical gloves and PPE to governments, UN agencies, NGOs and healthcare systems. Writes on glove standards, quality management and responsible sourcing for institutional buyers, working from the source standards rather than secondary summaries.
View profile on LinkedIn
