How to check an ISO 9001 certificate is real and current

An ISO 9001 certificate is only as reliable as the body that issued it and the scope it covers. A PDF on its own proves little: the check that matters takes about five minutes and uses free public registers. Here is how to do it, and what to look for while you are there.

Who actually issues an ISO 9001 certificate?

ISO writes the standard, but it does not certify anyone. ISO’s own help pages say it is “not involved in certification” and does “not issue certificates”. Certificates come from independent certification bodies, which audit a company’s quality management system against ISO 9001.

A certification body can itself be accredited: assessed by a national accreditation body for competence and impartiality. UKAS puts it neatly: if certification bodies are the checkers, the accreditation body checks the checkers. Accredited certification is what most buyers mean when they ask for an ISO 9001 certificate.

Internationally, accreditation bodies recognise each other’s work through a multilateral arrangement. Since 1 January 2026 that system is run by Global ACI (Global Accreditation Cooperation Incorporated), which took over the former roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC).

How do you check the certificate itself?

1. Read the certificate. ANAB’s guidance lists what a management system certificate should show: the certified organisation’s name and location, the certification body’s name and mark, the standard and its version, the scope, the issue and expiry dates, and a unique certificate number.
2. Find it in a register. Search IAF CertSearch by company name or certificate number. For UKAS-accredited certificates, UKAS CertCheck shows the scope, issue date, locations and the certification body. In Australia and New Zealand, use the JAS-ANZ register.
3. If you cannot find it, ask the certification body. Not every valid certificate appears in every database. Certification bodies working to ISO/IEC 17021-1 must confirm the status of a certification on request, so email the body named on the certificate, using contact details from its own website rather than the PDF.
4. Confirm the certification body is accredited for ISO 9001. Check the accreditation body’s directory: a body accredited for one standard is not automatically accredited for another.
5. Compare the entity and site. The certified legal entity and addresses should match the supplier you contract with and the site that makes your product.
6. Compare the scope with what you buy, then check the dates (see below).

What does the scope need to cover?

The scope statement says which activities, products and sites the quality management system covers. It is the part most often skipped and the part most often wrong for your purpose. A certificate for “design and sale of electronic assemblies” at a head office says nothing about the machining plant that actually ships your parts.

• The activities in the scope include the goods or services you buy.
• The site that supplies you is listed, or the scope clearly covers it.
• The certified entity is your supplier, not only a parent company or a sister business.
• Any exclusions do not remove something you depend on.

How long is an ISO 9001 certificate valid?

Accredited certification normally runs on a three-year cycle. Under ISO/IEC 17021-1, the standard that accredited certification bodies follow, the certification body carries out surveillance audits at least once a year between recertification audits, and a recertification audit is needed before the certificate expires to start a new cycle. A certificate whose expiry date is more than three years after its issue date deserves a question.

The expiry date printed on the certificate is not the whole story. Between audits, a certificate can be suspended or withdrawn if the supplier stops meeting the requirements, and the PDF in your files will not change when that happens. That is why a register check, repeated at renewal or before a significant order, is worth more than the PDF.

What changes with ISO 9001:2026?

ISO published ISO 9001:2026 on 16 September 2026. Global ACI’s transition requirements set the timetable for accredited certification:

For buyers, the practical message is simple: an accredited ISO 9001:2015 certificate is still valid today. Ask key suppliers when they plan to transition, and diary 30 September 2029, the end of the transition period.

Which warning signs mean you should not rely on a certificate?

• No certification body is named, or you cannot find the named body anywhere outside the certificate.
• There is no accreditation mark, or the accreditation body is not one you can identify and look up.
• The certificate is in no register and the certification body will not confirm it.
• The certified entity, address or scope does not match your supplier or what you buy.
• The dates are inconsistent, for example an expiry date more than three years after the issue date.
• The PDF has been edited, cropped or re-typed rather than issued by the certification body.

None of these checks proves a supplier’s quality on its own. Certification tells you a management system was audited; your own supplier evaluation still decides whether the supplier is right for you.

How does Vendarity help with ISO certificates?

In Vendarity, a reviewer records the issuer, standard and version, scope, site, certificate number and dates of each certificate beside the file, and Vendarity flags an entity or site that does not match the supplier relationship. With AI switched on, a reviewer can ask for these fields to be proposed with page citations, and ambiguous dates are left for a person. Renewal follow-ups then start before the expiry date.

Vendarity does not verify issuers or accreditation for you. The register checks above remain your team’s job, and the review records that a person made them. See how the review works.