How to verify an ISO certificate (2026)

Worldwide: IAF CertSearch

IAF CertSearch (iafcertsearch.org) is an online database of accredited management system certificates, drawing on data supplied by accreditation bodies and certification bodies across economies. It is the lookup to start with when the certificate was not issued under a single national scheme you already know.

Free access exists, but it is metered. The free tier is capped at 10 companies per month and 30 per year, and each certificate you verify stays accessible to you for 7 days. Watchlists and real-time status-change alerts are not in the free tier — they sit in the paid Basic plan at $42 per month. Plan a bulk supplier check around those limits, or budget for the paid tier.

A lookup reaches three layers at once: the certificate, the certification body's accreditation, and the accreditation body's standing in the mutual recognition arrangement. Read that third layer with care — the platform's own descriptions still frame it in terms of the IAF MLA, an arrangement that no longer operates. Confirm the accreditation body yourself against Global ACI's current Recognised ABs list, in Step 2.

Two boundaries to respect: management systems only — CertSearch holds accredited management system certifications, not a register of laboratories, inspection bodies, product certificates or personnel certificates. And it is a fed database, not a primary register — its data flows from the umbrella organisation to accreditation bodies, from accreditation bodies to certification bodies, and from certification bodies to certificate records. A certificate you cannot find is not, on its own, evidence of forgery. It is a reason to go one layer up: ask the supplier for the certificate number and the issuing body, then check that body in the accreditation register.

United Kingdom: UKAS CertCheck

For certificates issued under UK accreditation, UKAS CertCheck (certcheck.ukas.com) is the direct route. It searches by company name or certificate number. We could not re-check its access conditions on this round — whether a login or a fee applies is not verified here, so open the site and read its own terms before planning a bulk check around it.

The UK operates three distinct public registers, and they answer three different questions. These do not substitute for one another. UKMCAB in particular is about regulated product conformity (UKCA/CE territory), not about ISO management system certificates.

Scheme certificates widen the check

For scheme certificates that ride on ISO standards, the check widens, and each scheme states its own separate checks. This library's verified rule for FSSC 22000: "Check three things separately: the certification body's scheme licence, its accreditation, and whether that accreditation covers your food chain category." For IATF 16949: "Confirm the OEM or customer requirement, and separately confirm the certification body's IATF recognition." GLOBALG.A.P. requires the body's authorisation for the specific country and scope. A body can hold one of these and be marketed as holding all of them.

Two precision points when reading recognition claims

Membership is not signatory status. The former ILAC structure had full members (the MRA signatories), associates and stakeholders. Only signatory status carries mutual recognition. "Member of…" on its own proves nothing either way — the published lists are what carry recognition, so check them.

Regional signatory status is not global signatory status. A body can be a signatory of the European regional arrangement (EA MLA) without appearing on the global signatory list. That is a difference in the recognition chain, not evidence of a problem — but it means a "signatory" claim should always name the arrangement, the list it appears on, and the date it was read.

Reading an "IAF MLA signatory" claim after 1 January 2026

Seeing "IAF MLA signatory" on an accreditation body's page or on a certificate does not, by itself, mean the document is out of date. IAF ceased operations on 1 January 2026; its website now carries only an archival notice. Its functions passed to the Global Accreditation Cooperation Incorporated (Global ACI), launched the same day following a decision by IAF and ILAC to establish a single international accreditation organisation. Global ACI states it "has assumed the former roles" of both.

The mark itself is mid-transition. Global ACI's own MRA Mark has not yet been authorised for use by any Full Member, and — per Global ACI's FAQ — will not be before a decision expected in October 2026. In the meantime, any accreditation body that was authorised to use the IAF MLA Mark and/or the ILAC MRA Mark as of 31 December 2025, and was not suspended or withdrawn at that time, may keep using it, under the conditions set out in Global ACI's own document MRA-006 (Annex 1). Once the Global ACI MRA Mark becomes legally available in a given economy and Global ACI's Secretariat gives notice, continuing to use the old mark on new, renewed, reissued, amended or administratively replaced accreditation documents becomes a nonconformance from that point forward — but documents already issued before that point keep their validity. Reading an "IAF MLA" reference therefore takes two facts, not one: when the document was issued, and whether the new mark has already gone live, with notice, in that economy.

Where the underlying registration obligation comes from. The duty to upload accredited management-system certifications to what is now CertSearch is not a CertSearch policy — it is IAF's own mandatory document, IAF MD 28:2023 ("IAF Mandatory Document for the Upload and Maintenance of Data on IAF Database", issued 26 October 2023, applied from 26 October 2024). Global ACI has republished this document unchanged on its own document server, alongside a cross-reference table (version 11.0, dated 2 September 2026) that maps which IAF/ILAC documents Global ACI has already replaced and which are still pending replacement — MD 28 itself is listed there as "in process," meaning the old document stays authoritative until its Global ACI successor is finished.

Two limits the document states about itself, worth knowing before treating a CertSearch result as final. Scope: the upload mandate applies only to certifications under ISO/IEC 17021-1 main scope, issued by certification bodies accredited by an IAF MLA signatory accreditation body. It was never a universal register of every kind of accredited document. Recognised exemptions exist: an accreditation body or certification body can be excused from uploading for stated reasons (local/national regulatory requirements, data-privacy or data-security law, or — for a government agency — the absence of a mandate to participate). A body with an accepted exclusion is shown in the database as "non-participating," and the document itself says why: "to ensure that users of the IAF Database are aware that to confirm an accreditation they will need to contact the AB directly." A certificate you cannot find in CertSearch is therefore not, by itself, evidence that it is invalid — it can equally mean the issuing body's national regime sits outside the mandate.

Who runs the search tool. IAF CertSearch's own support site states that "IAF CertSearch is owned by IAF Database LLC, which is a wholly owned subsidiary of IAF," and that the system has been operated, since 2018, by QualityTrade, which also built CertCheck for UKAS. Global ACI links to CertSearch from its own site navigation, but nothing in Global ACI's own published pages states that Global ACI has taken over CertSearch's ownership or operation — that step, if it has happened, has not been found in a primary source. The CertSearch site itself remains live and serving requests (confirmed via its own robots.txt and sitemap.xml).

Practical takeaway (unchanged verification order, restated with the above)

1. Read the certificate: issuing body, standard, scope, sites, accreditation reference.
2. Confirm the accreditation body's current international standing on Global ACI's own member registry, by name and date — not by the mark alone.
3. Look the certificate up in CertSearch if it is a management-system certificate under ISO/IEC 17021-1 main scope.
4. If it is not found there, that is a reason to go one layer up — ask the certification body or accreditation body directly — not a verdict.
5. An "IAF MLA" reference on the document is not itself a red flag; check the issue date against the transition timeline above.

The document is not a certificate at all

"Certificate" is one word covering at least seven different record classes: accredited third-party certification, scheme certification, official ecolabel licences, ratings and awards, regulatory conformity markings, permits, and memberships. Each is issued by a different kind of body under a different kind of control.

A rating or award (a green-building score, a coastal award) is not a management system certificate, and presenting one as "our ISO-equivalent certification" is a class mismatch. A membership confirmation — of a scheme, an association, a supplier platform — certifies nothing; it records that a fee-based or registration relationship exists. A conformity marking on a product records a regulatory route, not a certified management system.

None of these document types is worthless in itself. The flag is the mislabel: a document from one class marketed with the vocabulary of another. It also explains a common surprise — the databases in Step 1 will not find these documents, because they hold accredited management system certificates only.

The issuing body is not accredited

Certification and accreditation are two different layers. A certification body audits a company and issues the certificate. An accreditation body is the official body that assesses whether that certification body is competent to do so. A "certificate" from a body that no recognised accreditation body stands behind is a document whose only guarantee is the issuer's own word. Step 2 is the check. Note what the flag is and is not: an unfamiliar accreditation body name is not the flag — absence from the recognised lists is.

Recognition rests on "membership"

Impressive-sounding affiliations are the cheapest thing to print. "Member of ILAC", "member of IAF" or "member of Global ACI" proves, on its own, no recognition of anything, and neither does an unnamed claim of being "internationally recognised". The question to ask is always: signatory of which arrangement, listed where, as of when? The two precision points above — membership versus signatory status, regional versus global — are what this flag tests.

Real accreditation, wrong scope

The subtlest worthless certificate comes from a genuine, accredited, recognised body whose accreditation does not cover what the certificate says. Run the three-layer match in Step 3. For scheme certificates, the separate scheme-level checks are where the gap usually sits: a body can hold its accreditation and be marketed as holding the scheme licence too.

The paperwork cites a framework that no longer operates

Institutional frameworks change, and stale references are a currency check on everything else the seller says. Marketing text written in 2026 or later that presents IAF or the IAF MLA as the currently operating authority — "our accreditor is an IAF MLA signatory", present tense, fresh copy — is out of date at best. The current reference is Global ACI's Recognised ABs list.

A certificate issued before 2026 that references the IAF MLA is entirely normal: recognition carried over to the successor arrangement, and existing accreditations continue to be recognised through the transition. A pre-2026 IAF MLA reference is not a sign of forgery.

A related currency check: a seller claiming a foreign-accredited certificate must be accepted "everywhere, for every purpose" is overstating what the arrangement says. Global ACI's own caveat — "except when prohibited by regulation or law" — is the limit.