Adding to Simon's answer, the GDPR is more about processes than IT systems if you look at it in more detail. Sure, there are some technical things in there (mostly encryption and pseudonymization) but for the bigger part it dictates what you are allowed to do with data at all. Keep in mind for everything following, that I'm not a lawyer—just someone who's some experience making his stuff GDPR ready.
TL;DR: Devices itself cannot be compliant or non-compliant on themselves. Cameras can be tricky though. Regarding your certification question, the answer seems to be not yet.
Some general things about GDPR
First of all it defines a specific opt-in mechanism for customer's data. This means as data processing legal entity you'll need to keep a record of the customer giving that consent and that consent has to specify which data you'll use and what purposes you are using it for. See Wiki sections 2.4 & 2.5.
Secondly it gives the user the expressed right to get all the data that the company has stored about him or her. That means every data in every system that can be tied to the specific user has to be provided. You can imagine that in bigger companies where all sorts of systems hold data that's somehow connected to a user that is kind of a hassle. I guess Netflix has some fun with that if you look at their systems:
Source (Slide 12)
The following articles go on to give the right to rectify incorrect data and erase it completely—of course only if no other law requires you to keep the data (e.g. tax or auditing laws for bills).
Of course, there are tons of pitfalls in the other forty-something articles of the first fifty that define your responsibilities and consumer rights that I haven't even mentioned. Like not being able to put the data anywhere where the EU standards aren't met—which if you read the thing seems to be everywhere, certainly not the US.
Another interesting thing that might affect a device is article 32—"security of processing"—which is a bit fuzzy but if your camera is in front of a medical building it might be argued that you need end-to-end encryption with encryption of all data at rest on the camera too.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
(a) the pseudonymisation and encryption of personal data;
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Since after EU law the picture of a person is (thankfully) considered personal data you are likely required to either pseudonymize or encrypt the pictures or video.
I haven't been able to find any that are based on the regulation itself. There's of course a bunch of people who sell you GDPR-sounding "certifications" but none (that I could find) seem to fulfill the requirements of the regulation as of today.