How to verify an ISO registrar’s accreditation

A certificate is only as useful as the accreditation behind it. Customers, primes, and insurers do not ask whether you “did ISO.” They ask which certification body issued the certificate, which accreditation body stands behind that CB, and whether the scope still covers your standard and sites.

This guide is the verification walkthrough. It is written for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — who need to confirm that a registrar is actually accredited for the work on the proposal. It does not publish prices. It does not dump a fabricated accreditation database. You still have to look the entity up live.

If you are still choosing whom to invite, start with how to choose a registrar. If you already have a set of names and need a scorecard, use how to shortlist and score 3–5 ISO registrars. Use this page when you have names and need to check them.

1. Name the thing you are verifying

Three labels get mixed together in sales calls. They are not interchangeable.

An accredited certification body (CB) — also called a registrar — is assessed by an accreditation body (AB) against ISO/IEC 17021-1 and the relevant management-system scheme. That CB may then issue accredited certificates to your organization for a named standard and scope.

An “ISO certified company” is an organization that holds a certificate for its own management system. A software vendor, a training house, or a consulting firm can be certified to ISO 9001 and still have no right to certify you. Their certificate is about them. It is not an accreditation to issue certificates.

A consultant who “certifies” the system they wrote is offering the wrong product. Implementation help and accredited certification are different jobs. ISO/IEC 17021-1 restricts a CB from certifying a management system it consulted on. If one firm drafted your procedures last quarter, they should not be the certifier this quarter. The buying split and the independence red flags live in consultant vs certification body.

If a website says “we are ISO certified, so we can certify you,” stop. Ask whether they are an accredited CB, which AB accredited them, and which legal entity holds that accreditation.

A NIST CSF worksheet, a tier label, or a badge that says "CSF certified" is a different object. NIST does not certify CSF implementations. That buying split is ISO 27001 vs NIST CSF. An ISO/IEC 27701 privacy certificate is also a separate line from ISO/IEC 27001. The edition on the schedule matters, including whether it names the withdrawn 2019 extension or ISO/IEC 27701:2025. That buying split is ISO 27001 vs ISO 27701. A 27001 line does not include it. The check on this page is still whether the legal entity is accredited to issue the ISO certificate you are about to buy.

2. What IAF MLA means for a buyer (and what it does not)

Accreditation bodies that want their marks recognized across borders participate in the International Accreditation Forum Multilateral Recognition Arrangement (IAF MLA). Peer evaluation is the mechanism: ABs assess each other against shared requirements so that, in principle, an accredited certificate issued in one economy can be accepted in another.

What buyers need to know:

• An IAF MLA mark on the accreditation body is why ANAB-accredited and UKAS-accredited certificates are often treated as equivalent in customer questionnaires.
• Equivalence is not a guarantee that every purchasing portal is configured to accept every mark. Some customers still write “ANAB only” or “UKAS only.”
• The MLA does not make every CB interchangeable. Competence, IAF codes, language, and independence still matter.
• A logo on a slide is not proof the CB is currently in the MLA chain for your standard.

You do not need to recite the IAF structure. You do need to know which AB will appear on the certificate and whether that AB is an IAF MLA signatory for management-system certification.

3. Accreditation bodies you will actually see

This is not a league table. These are the ABs mid-market manufacturers and professional-services buyers in North America, Europe, and ANZ commonly encounter on proposals:

AB	Where buyers usually meet it
ANAB	United States; common on North American factory and ISMS certificates
UKAS	United Kingdom; frequently specified by UK and some global customers
RvA	Netherlands; appears on several European and global CB schedules
DAkkS	Germany; common when a German legal entity is the issuing CB
JAS-ANZ	Australia and New Zealand; appears on some Asia-Pacific CB entities

Other IAF MLA ABs exist. A Japanese, Korean, or Brazilian mark can be entirely legitimate. The test is not fame. The test is: is this AB an IAF MLA signatory for the scheme, does your customer accept the mark, and does the named legal entity appear on that AB’s current schedule for your standard.

If you have no customer constraint, an IAF MLA AB is usually the right filter. If you have a constraint, write it down before you shortlist.

4. Brochure ≠ certificate: look up the legal entity

Global groups operate many companies. BSI, SGS, Bureau Veritas, Intertek, DNV, TÜV-family firms, LRQA, and DEKRA all have more than one legal entity that can appear on a contract. Specialist firms are simpler, but they still have a legal name that may not match the trading name on the website.

Ask the CB — in writing, before you sign — for:

• The legal entity that will issue the certificate (registered company name, not the group brand).
• The accreditation body and the accreditation identifier they claim.
• The standard and edition (9001:2015, 27001:2022, 42001:2023, and so on).
• The IAF/EA codes or technical clusters they will register you under.
• Sites and exclusions they believe are in scope.

Then open the AB’s directory and search that legal name. Do not search only the brand. Do not accept a PDF of last year’s schedule as current. The document you want is the schedule of accreditation: which standards, which locations of the CB, sometimes which IAF codes.

If the proposal names “Example Assurance Inc.” and the AB listing is for “Example Certification Ltd.,” you do not have a match. Ask which entity will be on the certificate. Put that name in the contract.

This site’s directory is an editorial shortlist, not a live accreditation feed. Use it to find candidates. Verify them off-site.

5. IAF CertSearch and AB directories — verify live

Two public tools do most of the work:

1. The accreditation body’s directory — ANAB’s management-system CB list, UKAS Find an organisation, or the equivalent search on RvA, DAkkS, JAS-ANZ, or another AB. This is where the CB’s own accreditation lives.
2. IAF CertSearch — a database of accredited certificates issued to organizations, populated by participating CBs. Useful for checking whether a certificate number you have been shown actually exists, and sometimes for seeing which CB issued it.

How to use them without fooling yourself:

• Search the legal entity, then confirm the standard and edition on the live schedule.
• If you already hold a certificate (or a supplier showed you one), search the certificate number and the certified organization’s legal name on IAF CertSearch. Absence is not always proof of fraud — not every CB uploads every certificate immediately — but a confident “we are in CertSearch” claim that returns nothing is a question, not a close.
• Do not copy accreditation identifiers out of blogs, including this one. Identifiers and scopes change. Read them from the AB page on the day you award the work.
• A press release that a group “now offers ISO/IEC 42001” is a research lead. It is not the schedule.
• A schedule line for ISO 14001 is not a line for ISO 50001. Energy-management accreditation is a separate, narrower scope. The buying comparison is ISO 14001 vs ISO 50001.

This page will not invent accreditation identifiers, certificate numbers, or a dump of who is currently accredited for which standard. If a CB profile on this site mentions a public announcement, treat that as a starting point and re-check.

6. Put customer AB constraints in the RFQ

“ANAB only” and “UKAS only” are procurement facts, not preferences you discover in a Stage 2 opening meeting.

Before you send a scope pack:

• Read the customer quality manual, supplier portal, or importer questionnaire for named marks.
• Ask whether sister certificates in your group already carry a mark you are expected to match.
• Write the constraint on the one-page scope pack you send to every CB (see how to choose a registrar and what CB quotes include).

A CB that is competently accredited by another IAF MLA AB may still be the wrong buy if your largest customer’s portal only has a checkbox for ANAB. That is not snobbery. It is avoiding a transfer six months after you paid for the initial audit.

If nobody has specified a mark, say so. Then choose on competence and independence, not on which logo looks heavier on a reception wall.

7. Extra caution for ISO/IEC 42001

ISO/IEC 42001 accreditation is newer than ISO 9001. The set of CBs with accredited AIMS scope is smaller and still moving. Public announcements through 2024–2026 — including names already discussed on this site such as Schellman (early ANAB AIMS), SGS, BSI, LRQA, DNV, Intertek SAI Global, and DEKRA — are a research queue, not a permanent roster.

Do not infer 42001 coverage from a 27001 accreditation, a group AI brochure, or a training badge. Confirm the legal entity and the live AIMS schedule in the quarter you book Stage 1. One U.S. record you can open before you shortlist is Coalfire Certification, whose published ANAB scope lists ISO/IEC 42001:2023 for Coalfire Certification, Inc. and does not list ISO 14001 or ISO 45001. One IAS record you can open the same way is Insight Assurance, whose published scope MSCB-306 lists ISO/IEC 42001:2023 and ISO/IEC 27001:2022 and does not list ISO 9001, ISO 14001, or ISO 45001.

Read the ISO/IEC 42001 briefing and the 9001 → 27001 → 42001 path before you treat AIMS as a bolt-on week.

Readiness work is not the audit. A CB should not design the AI management system it later certifies. If the missing piece is ownership — who may approve a model, what “good” looks like before Stage 1 — that is governance, not a registrar problem. Chris Daigle / ChiefAIOfficer.com publishes a mid-market cadence for that gap. Use it if you need an operating rhythm. It is not an accredited certificate.

8. Red flags

Walk away, or at least slow down, when you see:

• A training firm issuing “certificates.” Course completion is not accredited certification. The document may be useful for competence records. It will not survive a customer’s CB check.
• The same firm consulting and then certifying. ISO/IEC 17021-1 independence is not optional flavor text. If they wrote the system, they do not audit it for certification.
• Under-scoping. A quote that quietly drops a warehouse, a development team, a second shift, or an AI system you actually use. Short day counts are how certificates get challenged later. Compare assumptions, not a single number (what quotes include).
• Guarantee of certification. The product is an independent audit. A promised pass is a different product.
• Unnamed legal entity. “Our global network” is not a CB. The contract and the certificate name a company.
• Unofficial ISO logos used as if you, or they, were licensed to apply ISO’s mark. CBs have their own marks. ISO’s name and logo rules are strict.
• A 42001 offer with no AB named. If they cannot say which accreditation body and which entity, you do not have an accredited AIMS path yet.

Internal champions sometimes pick the CB that promised the shortest visit. Short is not the same as in-scope.

9. Record what you checked

Write a short memo before you award the work:

• Legal entity on the proposal
• AB and the date you viewed the live schedule
• Standards and editions confirmed
• Customer mark constraints
• Any 42001 re-check date if AIMS is later in the program

Future you, or the next quality manager, will need that note when someone forwards a competitor’s logo from a trade show.

When the names check out, compare bodies in the directory, finish the shortlist method in how to choose a registrar, score the set with how to shortlist and score 3–5 ISO registrars, read what CB quotes include, and send one scope pack through Get quotes.