Is an ISO certificate valid without accreditation?

Certification and accreditation are not the same

ISO develops international standards but does not conduct audits or issue certificates itself.

Certification involves an external party assessing whether a management system meets a standard's requirements. Accreditation then assesses the certification body itself. In the Netherlands, this is usually performed by the Dutch Accreditation Council (Raad voor Accreditatie, RvA).

Accreditation therefore provides an additional layer of assurance about matters including:

• the certification body's expertise;
• independence and impartiality;
• the audit methodology used;
• auditors' qualifications;
• the certification decision;
• oversight of issued certificates.

ISO explicitly states that accreditation is not mandatory and that a lack of accreditation does not automatically mean a certification body is unreliable. Accreditation does, however, provide independent confirmation of the certification body's competence. Read ISO's explanation →

“A certification body issuing ISO 9001 certificates is therefore not required to obtain accreditation.”

Dutch Accreditation Council, Explanation of the Accreditation Policy Rule

This explanation appears in the RvA's official accreditation policy. Read the RvA's policy explanation →

What does an unaccredited certificate demonstrate?

An unaccredited certificate can demonstrate that an organisation has been assessed by an external party and that its management system was found during the audit to conform to the specified ISO standard.

The requirements of ISO 9001 or ISO/IEC 27001 do not change. The main difference lies in oversight of the party conducting the audit and issuing the certificate.

When assessing an unaccredited certificate, relevant questions therefore include:

• Is there evidence that the entire standard has been assessed?
• Is the certification scope clearly defined?
• Does the auditor have demonstrable knowledge and experience?
• Was a documented audit methodology used?
• Were nonconformities recorded and demonstrably resolved?
• Was the certification decision made carefully and independently?
• Is it clear who issued the certificate?
• Can the certificate's validity be verified?
• Are periodic surveillance audits carried out?
• Is it clearly stated that the certificate was not issued under accreditation?

An unaccredited certificate can therefore have substantial evidential value. The recipient ultimately decides whether that evidence is sufficient for their purpose.

What does case law say?

There is little Dutch case law dealing directly with unaccredited certification of an ISO 9001 or ISO/IEC 27001 management system. However, clear principles can be drawn from the available judgments.

Accreditation is not always a statutory condition

In 2015, the Higher Regional Court of Cologne (Oberlandesgericht Köln) considered a case involving a DIN EN ISO/IEC 17024 certificate issued after the certification provider's accreditation had expired.

The court ruled that the certificate's legal validity did not automatically depend on accreditation. No statutory provision made accreditation mandatory for that particular certification. The claim for damages was therefore dismissed.

This German judgment concerns certification of persons and is not binding on Dutch courts. Nevertheless, it illustrates an important principle: where legislation or a contract does not require accreditation, a certificate is not invalid solely because accreditation is absent. OLG Köln, 30 September 2015, 26 U 9/15 →

Contractual requirements can be decisive

A customer may require in an agreement or tender that a certificate be issued under accreditation. If this is clearly stated as a condition, an unaccredited certificate may be insufficient.

In February 2026, the Rotterdam District Court ruled on a tender in which an ISO 9001 certificate was a suitability requirement. The selected tenderer did not hold the required certificate. The court concluded that the tenderer did not meet the suitability requirement and that its tender should have been declared invalid. Rotterdam District Court, 13 February 2026, ECLI:NL:RBROT:2026:1466 →

Equivalent measures are not always sufficient

Article 2.96 of the Dutch Public Procurement Act allows other evidence of equivalent quality measures under certain conditions. Among other things, the tenderer must demonstrate that it could not obtain the required certificate in time for reasons not attributable to it.

In a 2024 judgment, a tenderer did not hold the required ISO 9001 certificate and had not yet applied for certification. The court did not accept the alternative evidence. Merely stating that certification takes a long time was insufficient. Limburg District Court, 28 March 2024, ECLI:NL:RBLIM:2024:1434 →

The Limburg District Court confirmed this approach in June 2026. A quality manual did not have to be assessed substantively as an equivalent alternative because it had not been demonstrated that the absence of the ISO 9001 certificate was not attributable to the tenderer. Limburg District Court, 4 June 2026, ECLI:NL:RBLIM:2026:5449 →

An organisation can have a substantively sound management system and still be excluded if it does not hold the formally required certificate.

When can an unaccredited certificate be appropriate?

An unaccredited certificate can be a practical choice when:

• an organisation wants an independent assessment of the maturity of its management system;
• customers request demonstrable application of ISO 9001 or ISO/IEC 27001 but do not require accreditation;
• the organisation first wants to gain experience with certification;
• a certificate is used as an intermediate step towards accredited certification;
• a customer accepts the certificate after a transparent explanation;
• the cost and scope of accredited certification are not proportionate to the intended purpose at that time.

The certificate can then show which standard, scope and Statement of Applicability were assessed and when the audit took place.

When is accredited certification the more appropriate option?

Accredited certification is more appropriate when:

• a tender explicitly requires it;
• a customer contract requires an accredited certificate;
• international recognition is important;
• major customers accept only certificates from a recognised accreditation system;
• sector-specific legislation or regulations impose particular requirements;
• the certificate must be verifiable through an international certificate register;
• the organisation wants to minimise discussion about the certificate's status.

Always check the precise customer, contractual or tender requirement first.

Transparency prevents mistaken expectations

An organisation with an unaccredited certificate should communicate its status clearly. Disclosing that the certificate was not issued under accreditation only when asked is less transparent than making this information available from the outset.

An organisation receiving an unaccredited certificate from DCA could, for example, use this wording:

Our management system has been assessed and certified by De Compliance Afdeling against ISO/IEC 27001:2022. The certificate was not issued under accreditation by the Dutch Accreditation Council.

Avoid using logos or statements that suggest ISO itself, the RvA or another accreditation body has issued or approved the certificate.

ISO also does not permit its own logo to be used to communicate certification. An organisation is therefore not “certified by ISO”. Read ISO's explanation of certification →

De Compliance Afdeling's approach

Certification of our own organisation

De Compliance Afdeling's own information security management system has been certified by EIK Certificering B.V. to ISO/IEC 27001:2022, under EIK's RvA accreditation C669. View our own certificate, its scope and validity. This concerns our ISMS and does not automatically certify customers or the Compliance Tool as a standalone product.

Support and audits for customers

De Compliance Afdeling conducts audits assessing an organisation's management system against the requirements of standards such as ISO 9001 or ISO/IEC 27001.

Does an organisation need a certificate issued under accreditation for a tender, customer contract or international recognition? We can support the organisation on the route to an accredited certification body. We work with EIK Certificering, among others, which is registered with the Dutch Accreditation Council under number C669. Check EIK's RvA registration →

Separate unaccredited service

When sufficient objective evidence is obtained during the audit and any deficiencies have been resolved, De Compliance Afdeling may issue a certificate. This certificate is not issued under accreditation.

We are transparent about this in advance. Organisations must also communicate this status clearly to their own customers and clients. A DCA certificate is not intended to be presented as an accredited certificate.

Conclusion

An ISO certificate without accreditation is not automatically invalid. ISO and the Dutch Accreditation Council confirm that accreditation is not mandatory in every situation.

The main difference lies in the additional assurance and market acceptance. With accredited certification, the certification body itself has also been independently assessed. With an unaccredited certificate, the recipient must assess how much confidence to place in the auditor, audit methodology and certification provider.

For many organisations, carefully performed and transparently presented unaccredited certification can provide valuable confirmation of their management system. Where a customer or tender specifically requires an accredited certificate, that route must be chosen.