An ISO certificate entitles you to state that a named management system, at the sites listed on the certificate, is certified to a named standard by a named certification body. It does not entitle you to describe a product as ISO certified, and it does not reach sister companies or locations that were never audited. The certification mark belongs on the material that describes your organization, such as a website, a letterhead or a company profile. It stays off products, packaging and test reports.
Both the rules and their enforcement come from the standard our certification activity is accredited to. ISO/IEC 17021-1 requires us to hold an enforceable agreement with you governing how you refer to your certification and how you use our marks, and to act when that agreement is broken. Clause 8.4 is the one to read. Separately, the accreditation body whose symbol sits alongside ours publishes its own symbol rules, which are specific about proportion, color and what the symbol may appear next to. Both sets of terms arrive with your certificate, and they are worth reading before a designer places the artwork.
Where the mark goes
A management system certificate is evidence about a system: how your organization plans, controls and improves the work named in its scope. It carries no statement about any individual product or batch. That is why ISO/IEC 17021-1 bars a certification body from allowing its mark to be applied to a product, to product packaging, or in any way a reader could take as a declaration that the product itself conforms. Test reports, calibration certificates and inspection reports sit in the same category. A management system mark on one of those reads as product certification, which is a different standard, a different accreditation and a claim we are not making.
Where a marketing team wants the mark near a product image, the version that survives an audit is a sentence. "Manufactured by [organization], whose quality management system is certified to ISO 9001:2015" attaches the claim to the organization, which is where the certificate attaches it. The same logic governs a bid document. The mark on the cover describes the company submitting the bid; it says nothing about the item being quoted.
The wording, and what it has to match
The claim in words is checked against the certificate as closely as the artwork is, and three things have to line up: the standard and its edition, the legal entity, and the sites. "ISO certified" on its own names no standard and no edition, and nobody reading it can check it. A group-wide claim on a corporate website, where one subsidiary holds the certificate, overstates what was audited. So does a claim made for an organization at five locations when the certificate lists two.
One misstatement is worth naming on its own: "IAF certified", or "IAF accredited". The International Accreditation Forum accredits nobody and certifies nobody. It is the arrangement through which accreditation bodies recognize each other's accreditations, and it is the mechanism that makes a certificate issued in Dubai readable elsewhere. Its mark appears on a certificate for that reason, and we set out what it is on our accreditation page. An organization describing itself as IAF certified has described nothing, and an evaluator who understands the arrangement reads that phrase as a sign the certificate was never understood.
The strongest form of the claim carries its own evidence: the standard, the edition, the certification body and the certificate number. ISO/IEC 17021-1 requires us to maintain a publicly accessible directory of the certifications we have granted, which is clause 8.3, and ours publishes every certificate we have issued, searchable by certificate number or organization, with the standard edition, scope, status and validity dates. Putting the number beside the claim lets a reader confirm it in the register instead of taking the artwork on trust.
When the certificate changes
Mark use is audited. Confirming that certification marks are being used correctly is one of the activities at the second annual surveillance, listed with the rest of the cycle on how certification works. Incorrect use is raised in writing like any other finding, graded, with the evidence it rests on and a window to respond. The correction is usually a morning's work for whoever owns the website, and the finding closes on evidence that the page changed.
Two changes require the claims to move faster than that. A suspended certificate is not in force for the period of the suspension, so continuing to publish the mark and the claim through it misrepresents your position, and the register shows the suspension while the website carries on saying otherwise. A withdrawn or expired certificate takes down every reference to itself, including the website footer and the proposal template nobody has opened in a year.
Editions change too. Anyone holding an ISO/IEC 27001 certificate has already been through this: the transition period to the 2022 edition closed on 31 October 2025, and a website still advertising the 2013 edition is advertising something that is no longer valid. The same will apply to ISO 9001:2015 claims once a revised edition is published and organizations transition to it. Whenever we reissue a certificate, after recertification, a scope extension or a transition to a new edition, the wording in your marketing needs the same edit as the certificate. Our register carries the edition on every certificate we have issued, and that is where anyone checking will compare the two.