How to Verify an ISO 27001 Certificate in 2026 (And Why Many Are Out of Date)

The most over-trusted document in third-party review is a vendor’s ISO 27001 certificate. Procurement collects the PDF, files it next to the SOC 2 report, and moves on. That habit was always thinner than it looked, and 2026 is the year it breaks, because the ground under certificates shifted at a layer the certificate itself cannot show: the standards, the accreditation bodies, and the rules that certification bodies live by all changed, in sequence, inside nine months.

How you verify an ISO 27001 certificate in 2026 is therefore a procedure, not a glance. Read the edition line. Check who accredits the certification body and under which standard. Look the certificate up in a registry. Then read the scope as if the service you are paying for has to appear in it. A certificate can pass every casual look and still be void.

Four dates that rewired the checks

On 31 October 2025, the transition period for ISO/IEC 27001:2022 closed. IAF MD 26, the mandatory document that accreditation bodies and certification bodies in the ISMS scheme work to, set client transitions at 36 months from the standard’s publication month, and its instruction at the end of the transition table is stark: “All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period.” The PDFs survive. The certifications do not.

On 1 January 2026, the accreditation house changed. The International Accreditation Forum shut its doors; its own site now reads “IAF ceased operations on 01 January 2026. This website is a legacy site maintained for archival/reference purposes only.” IAF and ILAC were unified into Global Accreditation Cooperation Incorporated, which announced that it “has commenced full operations as of 1 January 2026, including the launch of its own Multilateral Recognition Arrangement (MRA).” Existing recognitions carry over while marks phase, but the organisation the system points to is new, with a new website and a new arrangement.

On 1 April 2026, un-transitioned certifier accreditations began disappearing. IAF MD 29, published in May 2024, required accreditation bodies and their accredited certification bodies in the ISMS scheme to complete the move to a new standard for bodies providing ISMS audit and certification, ISO/IEC 27006-1:2024, by 31 March 2026. Accredia, the Italian accreditation body, recorded the enforcement side in its technical circular: “From 01.04.2026, accreditations that have not yet been updated will be withdrawn.”

And on 3 July 2026, ISO reissued the family’s introduction document as ISO/IEC 27000:2026, the sixth edition of the overview of the 27000-series. It is not certifiable and changes nothing about 27001. It is also why “ISO 27001:2026” now turns up in vendor pitches, a version no standard-setting body has published.

The edition, not the expiry date

The single check that eliminates most broken certificates is the edition line. The certifiable edition today is ISO/IEC 27001:2022, plus Amendment 1:2024, the climate-action amendment that added two sentences to clauses 4.1 and 4.2 in February 2024 and is now part of what gets audited. If the certificate says ISO/IEC 27001:2013, it is dead as a conformity artifact regardless of the date printed on it.

That printed date is the trap. ISO certificates run on three-year cycles that start at the certification decision, so a 2013-edition certificate can carry an expiry date well into 2026 or beyond. The date governs the certification cycle; the edition governs validity. Under accredited certification, MD 26 pulled every 2013-based certification at the same moment, body by body, country by country. SecuriFii, a compliance assurance firm, described the collision in terms buyers should keep: “the rule that closed it is unusually blunt: every certification based on the 2013 edition expires or is withdrawn, whatever the certificate itself says.”

And the residue is real: vendor trust pages still link 2013-edition PDFs nearly a year after the deadline, because a trust center is a marketing-edited page and a certificate uploaded in 2023 looks fine on it.

The mirror-image trap is the vendor who arrives with something “better than 2022”: an upgrade, they will say, to the 2026 version. There is no ISO/IEC 27001:2026. The 2026-dated document in this family is the overview text described above, a reference edition that introduces concepts and terms rather than requirements. A Spanish security research shop described the pitch for what it is: an upgrade to the nonexistent version is, in QuantumSec’s phrase, “selling you snake oil.” A certificate citing ISO/IEC 27001:2026 is either a typo or marketing, and both deserve a question.

Whose accreditation stands behind the certificate

Certification bodies are not licensed by ISO. They are accredited by national accreditation bodies, whose recognition runs through an international arrangement. Until this year that arrangement belonged to IAF, and the accreditation body’s mark on a certificate is the visible end of it. The mark matters because an unaccredited “certificate” is not a certificate in any sense a buyer should weigh: it is a consultancy letter with a border.

Since 1 January 2026, the arrangement belongs to Global Accreditation Cooperation Incorporated (commonly Global ACI), which folded IAF and ILAC into a single organisation with its own MRA. The announcements stress continuity: existing accreditations issued under the IAF MLA and ILAC MRA continue to be recognised while marks phase over. Most buyers need not care. Buyers who verify certificates should, because the lookup layer is where the organisation names still live.

Three lookups cover it. IAF CertSearch is still live under the IAF name, and its own description still holds: “the exclusive global database for accredited management system certifications.” Global ACI maintains its own listing of recognised accreditation bodies, the successor view of the same network. And the accreditation body behind your vendor’s certification body maintains a directory of its accredited CABs; UKAS, ANAB, DAkkS, and peers all publish one. If the certification body’s name appears in none of those places, the certificate in your vendor file is an assertion, not evidence.

A scale note: the 2024 ISO Survey counted 96,709 valid ISO/IEC 27001 certificates, nearly double the prior year’s figure (partly methodological, because the survey began drawing on the CertSearch database). There is no public bulk registry behind it; CertSearch handles single-certificate lookups, so verification stays a per-vendor task. That is exactly why it belongs in the checklist rather than being assumed.

The certifier’s own bar moved in March

The second mark to read on the certificate is the accreditation reference, because the standard governing certifiers themselves changed on 31 March 2026. IAF MD 29 required the move to ISO/IEC 27006-1:2024, which sharpens remote-audit requirements, updates audit-time calculations, and aligns the certifier-side control annex with the restructured Annex A. Accredia’s clause quoted above shows what certifiers that miss it lose: the ISMS accreditation.

The practical translation: a certificate issued after 1 April 2026 by a certification body whose ISMS accreditation still references the 2015 version of 27006 is suspect, and worth a question to the accreditation body’s directory before the relationship deepens. Most certifiers transitioned on time; the residue is what slips through review.

Read the certificate like a reviewer

Edition and amendment first, then the certifying body’s name and accreditation reference. Then the section buyers skip and auditors never confuse: the scope statement. A certificate scoped to “the corporate IT function” tells you nothing about the SaaS product you are buying; a certificate that names the product, the services, and the Statement of Applicability revision it corresponds to is the shape you want. For multi-site certificates, check that the site or data center actually processing your data is on the list.

Then the surveillance column. A certificate is valid for three years on paper and lives on surveillance audits at roughly annual intervals; a missed surveillance can invalidate it long before its printed expiry, and nothing on the PDF announces that. This is the second place a registry lookup earns its keep.

Finally, ask what changed in the controls. Annex A was rebuilt from 114 in 14 domains to 93 in four themes, organisational, people, physical, and technological; IAF MD 26’s own count runs 11 new, 24 merged from existing controls, 58 updated. The new controls include threat intelligence, information security for cloud services, data leakage prevention, configuration management, and secure coding, the ones a fintech or SaaS review team would name itself if asked. The document that shows which of the 93 the vendor applies, and which it excluded with justification, is the Statement of Applicability, a reasonable ask that costs the vendor two minutes to share.

The same reading applies as adjacent certificates arrive: an AI vendor’s ISO 42001 certificate gets the edition, accreditation, scope, and surveillance questions too, as the ISO 42001 certification wave piece set out.

What to do when a check fails

A 2013-edition hit is common and recoverable, and the honest path is short: tell the vendor the certificate is void, then ask whether they hold current ISO/IEC 27001:2022 certification or operate the management system with a re-entry audit scheduled. The transition audit that would have papered over the gap no longer exists, so a lapsed vendor faces a fresh initial audit, Stage 1 and Stage 2, under the 2022 edition. A dated plan is acceptable evidence of direction; a fresh 2013 PDF in reply is not.

An unaccredited certifier is a bigger flag than an old edition, because it says the certificate was never anchored in the system that makes certificates work. Ask what stands behind it, and weight the file accordingly, alongside whatever else the vendor produces. One certificate, one audit report, one trust page: each is evidence about a system rather than the system itself, and the gap between the artifact and the operation is where vendor incidents live. The same reading applies to a SOC 2 report, where auditors are testing AI controls no standard text anticipated.

Most certificates fail none of the five checks and cost ten minutes. The point is the residue: nearly 97,000 valid certificates in the last survey count, no bulk registry, a reorganised accreditation layer, and buyer habits built on the 2013 edition. The checks belong in the vendor review as standing items, the same way US bank regulators rewrote the vendor rules to demand evidence over paperwork from supervised firms. And evidence compounds: the file a certificate check builds is the file a renewal underwriter reads when cyber insurance asks for proof.

The program context for keeping this current, from third-party risk through the wider control stack, sits on our cybersecurity risk and compliance page.

Ron Moore runs NTD Consulting, which provides fractional CISO and cybersecurity advisory services to mid-market SaaS, fintech, and digital-asset companies.