How to verify a supplier’s ISO certificate

A supplier sends a PDF with a familiar logo and the words “ISO 9001”. That document tells you that a certificate was produced. It does not tell you that the certificate is genuine, that it is still in force, or that it covers the company and the site you buy from.

Checking takes a few minutes per certificate once you know where to look. This guide covers the steps, the details to match and the changes in 2026 that affect certificates already in your files.

The short version

1. Read the certificate. Note the certification body, the certified organisation, the sites, the scope, the standard and its edition, the certificate number and the dates.
2. Search a register. Look the certificate up in IAF CertSearch by company name or certificate number. For UKAS-accredited certificates you can also use UKAS CertCheck.
3. Check the certification body. Confirm that it is accredited for that standard by a recognised accreditation body, such as UKAS in the UK.
4. Ask if you cannot find it. Email the certification body with the certificate number and ask it to confirm the status, scope and expiry in writing.
5. Record what you checked. Keep the register entry or the written confirmation, with the date you checked.

Who issues an ISO certificate

ISO writes the standards. It does not certify organisations or accredit certification bodies, and says so in its own guidance. A certificate is issued by a certification body: a company that audits organisations against the standard.

Certification bodies can themselves be accredited. An accreditation body, such as the United Kingdom Accreditation Service (UKAS), assesses whether a certification body is competent to certify against a given standard. Accreditation bodies recognise each other’s work through an international arrangement. Until the end of 2025 that arrangement for management-system certification was run by the International Accreditation Forum (IAF). On 1 January 2026 the IAF and the International Laboratory Accreditation Cooperation (ILAC) were replaced by a single body, the Global Accreditation Cooperation Incorporated (Global ACI), whose arrangement is called the Global ACI MRA.

Certificates from certification bodies that are not accredited are not necessarily fake. But nobody independent has checked the certifier, and some “certificates” come from consultancies or websites that sell them. Decide whether your requirement accepts only accredited certification, and say so in the requirement.

Where to check a certificate

IAF CertSearch is the global database of accredited management-system certificates. It was set up by the IAF, is still available at iafcertsearch.org and is linked from Global ACI’s own site. Search by company name or certificate number. A match shows that the certification is valid, that the certification body is accredited, and that its accreditation body belongs to the international arrangement. ISO points buyers to it, and notes that it includes only accredited certificates.

Since October 2024 an IAF mandatory document, MD 28, has required accredited certification bodies to upload their certificate data to the database and keep it up to date. An accredited certificate you cannot find is therefore worth a question, though not an automatic rejection: the data may lag, or the name on the certificate may differ from the one you searched for.

UKAS CertCheck is a free UK database of UKAS-accredited certification. Search by certificate number or by the certified organisation’s name. An entry shows the scope, the date issued, the locations covered and the certification body.

The certification body itself. Most certification bodies run their own lookup or will confirm a certificate by email. This is also the way to check a certificate that is not accredited.

The details to match

A register entry that exists is not the same as one that matches. Compare the certificate with the entry field by field.

How long a certificate lasts

Accredited management-system certificates normally run on a three-year cycle under ISO/IEC 17021-1, the standard that certification bodies work to. Surveillance audits take place in between, at least once each calendar year, and a recertification audit is due before the certificate expires.

Two practical consequences follow. First, an expiry date more than three years after the issue date is unusual and worth a question. Second, a certificate can be suspended or withdrawn part-way through its cycle, for example after a missed surveillance audit. The PDF in your file will not show that; the register will. That is why the check is worth repeating at each re-review, not only at onboarding.

What changed in 2026

ISO 9001:2026. The new edition of ISO 9001 was published on 16 September 2026. Organisations certified to ISO 9001:2015 have until 30 September 2029 to move to it. Until then, a 2015 certificate that is in date and has not been suspended or withdrawn remains valid; after that date it does not. For suppliers whose certificate expires close to the deadline, ask about their transition plan at the next re-review.

ISO 14001:2026. The new edition of ISO 14001 was published in April 2026, with a three-year transition that ends in April 2029. If a decision depends on the exact date, confirm it with the certification body.

Global ACI. The IAF and ILAC merged into Global ACI on 1 January 2026. For a buyer, the verification route is unchanged: CertSearch is still where accredited certificates are checked, and Global ACI’s site links to it.

Red flags

• The certificate names ISO as the issuer, or names no certification body at all.
• The supplier describes itself as “ISO compliant” or “working to ISO 9001” rather than certified. Those are claims, not certification.
• The scope reads “all activities”, with no description of what the organisation does.
• The certificate cannot be found, and the certification body does not reply.
• The accreditation mark belongs to an organisation that is not a recognised accreditation body.
• Any detail on the PDF differs from the register entry.

Where DataStruct fits

DataStruct reads a supplier file against your requirements. For a certification requirement, it finds the certificate passages that support it, links each one to the file and page it came from, shows the dates those passages state, and says so when no certificate is on file.

It does not query IAF CertSearch or UKAS CertCheck, and it does not decide whether a certificate is valid. Where an old and a new certificate are both on file, both can be returned. The register check above, and the decision, stay with your reviewer. The wider process is in how to review supplier compliance evidence.