How to verify a supplier’s IATF 16949 or ISO 9001 certificate

Whether a supplier’s quality certificate is genuine is settled by the records of the bodies behind it, not by the copy you were sent. IATF 16949 is checked in IATF’s own lookup; ISO 9001 with the issuing certification body, in IAF CertSearch and with the accreditation body. Compare three things: the holder, the address and scope, and the status today.

What should you check on the certificate itself?

Ask for a legible copy and note six things: the issuing body, the accreditation mark, the certificate number, the company’s name and address, the scope and the expiry date. The list is ours.

For the mark, European Accreditation (EA) gives two checks. First: “Check that there is an accreditation mark on the report or certificate.” Second, that the mark belongs to an accreditation body that has signed the multilateral agreement. TÜRKAK’s mark, for one, carries the accreditation standard and the certification body’s accreditation number.

Scope is checked twice. The certificate’s scope should cover the work you are buying and the address where your part is made. The certification body’s accreditation should cover the standard on the certificate; EA’s third check points the same way.

How do you verify an IATF 16949 certificate?

An IATF 16949 certificate is verified in the IATF Customer Portal, reached through the “IATF Certificate Validity Check” button on iatfglobaloversight.org. The portal presents itself as the official online platform for verifying IATF 16949 certificates. It searches by IATF certificate number, by IATF Unique Site Identifier (USI) or by site name.

By its screen labels, a result shows the site’s address, the certificate number, the certificate status and the USI; since 5 August 2024 it shows the location status too.

IATF’s September 2022 communiqué describes the USI as a randomly generated six-character code tied to a physical location. A site keeps it through a change of name or certification body and gets a new one only when it moves. Newly issued certificates are meant to show it.

Check the certification body too: IATF lists the bodies under contract with it and says these are the ones authorised to carry out IATF 16949 certification; terminated contracts are listed separately.

How do you check that an ISO 9001 certificate is valid?

An ISO 9001 certificate can be checked in three places: with the certification body that issued it, in the IAF CertSearch database and with the accreditation body. Global ACI, which took over the role of the International Accreditation Forum (IAF) on 1 January 2026, gives the order:

“Purchasers wishing to confirm the validity of an accredited certificate, report or statement should refer in the first instance to the conformity assessment body (CAB) shown on the document.”

Global ACI, Frequently asked questions

IAF CertSearch (iafcertsearch.org) describes itself as a worldwide database of accredited certifications. Enter the full certificate number or the company name; the entry shows the standard, status, scope, issuing certification body and accreditation body. The user guide asks for an account; according to the plans page, a free account opens 30 company profiles a year.

In Turkey there is one more check. Management system certification bodies accredited by TÜRKAK, the national accreditation body, enter each certificate in TBDS, its document verification system (tbds.turkak.org.tr). The system generates a QR code and an alphanumeric code, and TÜRKAK’s published obligations say no accredited certificate may be issued without them.

TÜRKAK wrote, when extending the system to calibration certificates, that the practice would prevent forged documents. The issuing body can be looked up on TÜRKAK’s search page for accredited bodies.

What is a non-accredited certificate?

A non-accredited certificate is one issued outside the oversight of an accreditation body: either the certification body is not accredited, or the certificate falls outside its accredited scope. Global ACI notes that “in most countries, accreditation is voluntary”. The accreditation mark, as TÜRKAK describes its own, may be used only on documents within the accredited scope.

Whose mark it is matters as well. A TÜRKAK public notice of 2 March 2026 says some conformity assessment bodies in Turkey have been seen to obtain documents from structures based abroad that have no authority under national legislation. In the agency’s words:

“Documents issued by such unauthorised structures have no legal validity; they also lead to technical barriers in international trade, to losses in export and tender procedures and to product safety risks, and carry a risk of sanctions in market surveillance.”

TÜRKAK, public notice, 2 March 2026 (our translation)

Is a suspended, withdrawn or “in progress” certificate valid?

IAF CertSearch counts a certificate as valid if it appears in the database, its status is Active and it is up to date. Its user guide defines four statuses:

• Active: currently valid.
• Suspended: not active for the time being; it may be under review.
• Withdrawn: cancelled for good by the certification body.
• Expired: past its end date and no longer valid.

IATF’s wording differs. Its September 2022 communiqué counts an issued certificate and a suspended one alike as valid. What we take from that: a suspended IATF certificate has not yet lapsed, but ask the supplier why.

“IATF 16949 compliant” and “certification in progress” are none of these statuses. Our inference: both lookups show issued certificates, and a claim without a certificate number has no record to check. The IATF portal also has separate fields for an “IATF Letter of conformance”; note which of the two the screen shows.

What if the certificate does not show up in the search?

If the certificate does not show up, find the reason first, then write to the issuing body. The IAF CertSearch guide gives three reasons: the certification is not yet in the database, the company’s name is restricted and confidential, or the certification has been removed. The IATF portal, when a site-name search finds nothing, suggests shortening the name and checking for typos.

If the issuing body’s address is unknown, Global ACI points to the accreditation body whose mark is on the certificate. EA’s list ends the same way: “In case of problems, contact the National Accreditation Body.” Give the certificate number and ask for written confirmation of status, scope and address; that is our suggestion.

In what order should you run the checks?

The order we suggest:

1. Copy. Ask for a legible copy and note the six items above.
2. Lookup. IATF Customer Portal for IATF 16949, IAF CertSearch for ISO 9001, the QR code under TÜRKAK accreditation.
3. Compare. Do the name, address, scope and status match the copy? Is the address the plant where your part is made?
4. Accreditation. Look up the issuing body with the accreditation body whose mark is on the certificate.
5. Confirm. If anything does not match, write to the issuing body.
6. Repeat. Status can change; run the lookup again before you order.

A certificate describes a management system, not a part. Sample approval and batch records are covered in the guide to sourcing from Turkey; delivery terms and minimum order quantity have their own articles.

Screen labels are given as they stood on 13 October 2026.