Worked example: what a certificate actually proves

A vendor sends you a PDF. It carries a logo, a standard number, a scope statement and an expiry date. The question a practitioner has to answer is narrow and practical: what has just been established, and what has not?

The chain that makes a certificate mean anything

A certificate is a statement by a certification body that an organisation's management system conforms to a standard. Its value therefore depends on the certification body, not on the organisation being certified. That is the part buyers skip.

ISO/IEC 42006:2025 sets requirements for bodies that audit and certify AI management systems. It exists because without common requirements on the auditors, two certificates bearing the same standard number can represent wildly different amounts of scrutiny. A certificate issued by a body accredited against those requirements is comparable with another one. A certificate issued by a body that is not accredited is a commercial document whose meaning you would have to establish yourself, one auditor at a time.

So the first question about any certificate is not what it covers. It is who issued it, and whether that issuer is accredited. An unaccredited certificate is not a weaker version of an accredited one; it is a different kind of object, and treating the two as comparable is the error the standard was written to prevent.

The three questions to ask of any certificate

Who issued it, and are they accredited? Accreditation is verifiable with the accreditation body, independently of the vendor. Ask.

What is the scope? A management system certificate covers a defined scope. A vendor certified for "the AI platform development organisation" has told you nothing about the model hosting operation, the professional services team that configures your instance, or the subprocessors.

What did the Statement of Applicability exclude? Exclusions and their justifications are where the interesting information is. A certificate proves the system was audited; the Statement of Applicability tells you what the system was.

What the certificate does not prove

It does not prove any particular AI system is safe, accurate, fair or lawful. A management system standard is about how an organisation governs, not about the properties of its outputs. A certified organisation can ship a badly performing model; the standard asks whether the process that shipped it was operated and recorded, not whether the model was good.

It does not prove EU AI Act conformity. Certification is not conformity assessment, produces no declaration of conformity, and does not create Annex IV technical documentation.

And it does not transfer any obligation to the vendor. The duties that fall on you as deployer fall on you regardless of what your supplier is certified for.

Worked example: three certificates on one procurement

An insurer is procuring an AI governance platform and three shortlisted vendors present certificates.

Vendor A presents a 42001 certificate from an accredited body. Scope: the whole product organisation including hosting. The Statement of Applicability has four exclusions, each with a specific justification tied to a control not applicable to a software-only operation. This is a strong signal about how the vendor is run.

Vendor B presents a 42001 certificate from a body the insurer cannot find accreditation for. Asked directly, the vendor says the body is "an independent international certifier". The insurer cannot compare this document with Vendor A's, and should not try. It is not evidence of less; it is evidence of an unknown quantity, and the correct treatment is to set it aside and assess the vendor's controls directly.

Vendor C presents no certificate and a detailed control description with evidence. This is less convenient and more informative than B.

Two further findings apply to all three, from our own vendor research across seventeen governance platforms. None holds an ISO 42001 certification for the governance product itself, which is worth testing against whatever a salesperson tells you about the organisation's certification. And no platform examined was found to produce a Statement of Applicability, an AI incident report, or a decommissioning record, despite the first being the central document of a management system and the second an explicit AI Act duty. If the platform is meant to carry those artefacts, make producing them a condition of purchase and see one before signature.

The instruction that follows

Write the three questions into the third-party assessment template as fields: issuing body, accreditation verified yes or no, scope statement recorded verbatim, exclusions reviewed yes or no. Recording a certificate number without those four fields creates the appearance of diligence and none of the substance, and it is exactly the record that will be produced later as evidence of what you relied on.

As of 24 September 2026.