Your supplier sends a PDF. It has a logo, a serial number, a stamp, and an expiry date, and it proves exactly one thing: somebody can make a PDF.
Learning how to verify a supplier certificate takes minutes per document, because almost every certificate that matters is listed in a public registry run by the body that issued it. You look it up at the source, or you do not really know anything.
Two of the rules below changed in the last two years, and one of them changed this January. If you are working from a checklist written before 2024, part of it is now wrong.
This is for founders and brands buying from overseas manufacturers. If you have not checked that the company itself is real yet, start with how to verify a supplier before you pay. A genuine certificate held by a company that cannot make your product is still a dead end.
Why does the PDF in your inbox prove nothing?
Because nothing about it is hard to fake, and because the honest versions and the invented ones look identical on screen.
It can be expired. It can name a related company with a similar name, cover a product line you are not buying, or come from a body nobody recognizes. None of that shows up in the file itself.
So treat every one of them as a claim with a reference number attached. The number is the useful part, because it is what you type into the registry.
ISO 9001: who accredited the certifier?
This is the question that decides whether an ISO certificate means anything, and most buyers never ask it.
Anyone can set up a company, call it a certification body, and sell certificates. What separates a real ISO 9001 certificate from a decorative one is accreditation. The certifier itself has been checked against ISO/IEC 17021-1 by a recognized national body.
You can check accredited certificates in the CertSearch database at iafcertsearch.org. Search the company name or the certificate number, then compare what comes back against the PDF, line by line.
The part that changed in January 2026
The system behind that database was reorganized, and anyone quoting older guidance will point you at an organization that no longer exists.
The International Accreditation Forum and its laboratory twin merged into one body, Global Accreditation Cooperation. It took over on 1 January 2026 and now runs a single global arrangement, and the old IAF site is kept for reference only.
For you as a buyer, little changes in practice. Older accreditations stay valid through the switch, and the existing marks hold until bodies move to the new one.
So a document naming the old body is not suspect on that basis alone. What it does mean is that anyone citing the old structure as current is working from stale information. That tells you something about the rest of their paperwork.
CE marking: often a self-declaration, and four digits tell you which
CE is the most misunderstood mark in sourcing, because buyers read it as approval by somebody. Frequently nobody has approved anything.
Under EU rules the manufacturer puts the CE marking on the product and carries the responsibility. For many categories the law allows self-assessment: the maker checks the product itself and signs an EU declaration of conformity, with no outside body involved.
Where the law requires third-party testing, a notified body has to do it. That is typical for higher-risk goods such as medical devices, construction products, and machinery.
Here is the tell. When a notified body has been involved, its four-digit identification number appears next to the CE marking. No four digits means no notified body, which means the mark rests on the manufacturer’s own declaration.
That is not a problem by itself, since self-declaration is lawful where the law allows it. It becomes a problem in two cases. Your product sits in a category that requires a notified body and the mark has no number. Or the supplier presents a self-declaration as though an authority had reviewed the product.
Ask for the EU declaration of conformity rather than a certificate. It is the document that actually exists in the regulation, it names the legislation the product is declared against, and it has to be signed.
“FDA registered” is not FDA approved
This one is worth reading twice, because the phrase appears constantly in supplier decks and it is close to meaningless.
The FDA is direct about it. Asked whether “FDA Registered” or “FDA Certified” devices exist, the agency’s published answer is no, and it warns that such wording may be used to mislead buyers. A facility’s presence in the registration database, in the FDA’s words, “does not denote approval, clearance, or authorization” of that facility or its products.
Registration is a notification. A factory tells the FDA it exists and what it makes. Nobody inspects the product and nobody reviews a dossier. The FDA says plainly that it does not issue registration certificates to device facilities at all.
The agency goes further. Show a registration certificate beside a product for sale in the US, in a way that implies the FDA reviewed it, and you have misbranded that product under the Federal Food, Drug, and Cosmetic Act.
So when a supplier offers an “FDA certificate,” what you are usually being shown is proof of paperwork, often produced by a third-party agent who filed the registration. Ask instead which pathway applies to your product. That might be a 510(k) clearance, a drug listing, a cosmetic facility registration, or nothing at all. Then check that pathway in the FDA’s own databases.
USDA Organic: check the database, and the certificate you cannot fix at the border
If you sell anything organic, this section matters more than the rest of the page, because the rules tightened sharply and the failure mode is unusually brutal.
Certified operations are listed in the USDA Organic Integrity Database, which shows the operation, its certifier, its current status, and the scope it is certified for. A supplier claiming organic status that does not appear there with an active listing is not certified, whatever the PDF says.
Then there is the import side. Under the Strengthening Organic Enforcement rule, in force since 19 March 2024, organic shipments entered with US Customs need an NOP Import Certificate. Your supplier’s certifier issues it in the Organic Integrity Database, before the goods leave the country of origin. It carries a 21-character code that is tied to your entry filing.
Two things catch importers out. Importing organic goods is no longer exempt, so you have to be certified yourself by an accredited certifier. That applies to a foreign importer of record too.
And since 1 October 2025, an organic shipment that arrives without a valid import certificate cannot be fixed into compliance. The options at that point are reexport, destruction, or donation. The container sits while that gets decided, and you pay for the wait, which is the subject of customs holds and what they cost you.
Read that again if you are planning an organic launch. This is a document that has to exist before the container sails, obtained by your supplier’s certifier rather than by you, and there is no way to fix its absence after arrival.
What a social audit actually tells you
BSCI, Sedex, and similar social compliance audits are useful and routinely oversold, so it helps to know what they are.
An audit is a snapshot. Someone visited on a particular day, against a particular checklist, and recorded what they saw. It describes that visit rather than guaranteeing conditions on the day your order runs.
Read the report instead of the summary score. The findings section, the corrective actions, and whether those actions were closed out tell you far more about how the factory operates than the grade on the cover.
How to read the scope line
This is the detail that quietly invalidates more certificates than forgery does.
Every real certificate states a scope: which products, which processes, and which site are covered. A certificate for injection molding does not cover assembly. One for a food line does not cover a cosmetic line. One issued to a sister company with a similar name does not cover the entity on your invoice.
Compare three things against the registry entry every time. The legal name, against the name on your proforma invoice. The site address, against the factory you are buying from. And the scope wording, against what you are ordering.
What a valid certificate still does not prove
That the product you receive will match it.
A certificate describes a system or a site at a point in time. It does not promise that your run was made on the certified line, that the certified process was followed on the day, or that the material was the one declared. That gap is what inspection exists to close, and why a certificate check and a pre-shipment inspection are two different jobs.
Treat certification as a filter that removes suppliers who should not be on your list. It is not evidence about the goods in your container.
Who should be doing this for you
None of this is difficult. It is just tedious, time-sensitive, and easy to skip when a supplier seems enthusiastic and the price is good.
That is one of the differences between an operator and a middleman. A middleman forwards you the PDF the factory sent. An operator pulls the registry entry and matches the legal entity and the scope against what you are ordering. It also finds out before the deposit that your supplier’s certifier, not you, has to request the import certificate.
We work with USDA Organic, Vegan Action, CE, and FDA requirements regularly, and we re-verify the company’s own registration at the issuing body rather than trusting the copy in the inbox. It also matters how we are paid: our fee comes from you and we take zero commissions from suppliers, so there is nothing to gain from waving a weak certificate through.
What to keep from this
Four things, if you remember nothing else.
An ISO certificate is only as strong as the body that accredited the certifier, and the system above it changed hands on 1 January 2026. A CE mark without a four-digit number next to it rests on the manufacturer’s own declaration, so ask for the EU declaration of conformity. “FDA registered” means a facility filed a notification, and the FDA itself says that is not approval, clearance, or authorization. And if you import organic goods, the NOP Import Certificate has to exist before the shipment leaves, because since October 2025 a missing one cannot be fixed on arrival.
Let us check the paperwork before you pay
We have launched 18 brands and verified 800+ suppliers, with our own team on the ground in China. We read the certificate, pull the registry entry, match the scope and the legal entity to your order, and tell you which documents have to be obtained before anything ships.
Tell us what you are making and where, and we will tell you straight which of your supplier’s certificates mean something.
Frequently asked questions
How do I check if a supplier’s ISO 9001 certificate is real?
Look it up rather than trusting the PDF. Accredited certifications are listed in the CertSearch database at iafcertsearch.org, where you can search by company or certificate number and compare the result against the document you were sent. Check that the certifier is accredited rather than self-appointed, that the legal entity matches the company on your invoice, and that the scope covers your product and the site making it. Note that the system moved to Global Accreditation Cooperation on 1 January 2026, so older guidance names a body that no longer runs.
Does “FDA registered” mean a product is FDA approved?
No. Registration is a notification that a facility exists and what it makes, and the FDA states that a registration listing does not denote approval, clearance, or authorization of the facility or its products. The FDA also says it does not issue registration certificates to device facilities, and that displaying one next to a product for sale in a way implying FDA review is misbranding. Ask which specific regulatory pathway applies to your product and verify that instead.
What do I need to import organic products into the US?
An NOP Import Certificate for the shipment, and your own organic certification. The rule has been in full force since 19 March 2024. Your supplier’s certifier issues the document in the Organic Integrity Database, before the goods leave the country of origin, and it carries a 21-character code used in your entry filing. Importers are no longer exempt, so you need your own organic certification too, and since 1 October 2025 a shipment that arrives without a valid one cannot be fixed, leaving only reexport, destruction, or donation.
