UKAS vs non-UKAS: what accreditation actually buys you

Written from the standards themselves · Editor-reviewed · Checked against the current editions on 25 October 2026

By the iso27001partners.co.uk editorial team · Published 20 September 2026 · Last reviewed 25 October 2026 · 9 min read

10 primary sources cited on this page. How we check what is on this site

The distinction in one line Who checked the checker

An accredited certificate comes from a body UKAS has itself assessed and publishes a schedule for. A non-accredited certificate comes from a body nobody has assessed. Both are pieces of paper; only one of them has anyone standing behind it.

This is the question the large international compliance platforms cannot answer for you, because UKAS is a UK institution created by a UK statutory instrument and has no equivalent in the markets those products were built for. It is also the question that decides whether the certificate you are about to buy will survive contact with a procurement team.

Key points

UKAS is the UK’s sole national accreditation body by law. Regulation 3 of The Accreditation Regulations 2009 (SI 2009/3155), regulation 3: “UKAS is appointed for the purposes of Article 4(1) of the EC Regulation as the national accreditation body”.
UKAS does not certify you. It assesses the bodies that do, against ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1 and the ISMS-specific requirements, and publishes what each one is competent to certify.
Check the day count behind a price gap. An accredited body works to the published audit-day table and cannot cut it by more than 30%. A body nobody assesses can audit for as long as it likes.
The asymmetry decides it. If your customer does not check, an accredited certificate still satisfies them. If they do check, only one of the two survives.

What accreditation is, in UK law

The word gets used loosely, so it is worth being exact. United Kingdom Accreditation Service is appointed under The Accreditation Regulations 2009 (SI 2009/3155), regulation 3. Regulation 3 provides that “UKAS is appointed for the purposes of Article 4(1) of the EC Regulation as the national accreditation body”. There is one, it is named in secondary legislation, and no other organisation in the United Kingdom holds that position however it describes itself.

A framed certificate on an office wall photographed at an angle — Two certificates can look identical on a wall and mean different things to the customer who asks for one.

UKAS sits one level up from you. It never audits your management system and never issues you a certificate — which is why “we are UKAS accredited” describes the wrong party. What it does is assess certification bodies: whether they are competent, whether their auditors are, and whether they follow the rules they are supposed to follow — including the impartiality requirements and the audit-time rule that sets how long your audit has to be.

The body that audits you is barred from selling you the help to get ready. That is a requirement of the standard its accreditation is granted against, not a market convention.

The same diagram as a table

Who does what, and what each one is barred from doing
Role	Does	Cannot do
Accreditation body (UKAS)	Assesses certification bodies against ISO/IEC 17021-1 and ISO/IEC 27006-1	Issue you a certificate
Certification body	Stage 1, Stage 2, annual surveillance, issues the certificate	Provide management system consultancy to you (clause 5.2.5)
Consultancy	Gap analysis, risk assessment, Statement of Applicability, internal audit support	Issue or influence a certificate
This site	Publishes the rules and the cost arithmetic; accepts only a fixed fee per enquiry	Audit, certify, accredit or advise

What the accredited body is being held to

This is the concrete part, and it is why accreditation is worth something rather than being a badge. A body accredited to certify ISO 27001 has been assessed against ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1, which contains clauses like these — quoted rather than paraphrased, so you can see how little room they leave:

Clause 5.2.5. “The certification body and any part of the same legal entity and any entity under the organizational control of the certification body [see 9.5.1.2, bullet b)] shall not offer or provide management system consultancy.”

Clause 5.2.9. “The certification body’s activities shall not be marketed or offered as linked with the activities of an organization that provides management system consultancy. … A certification body shall not state or imply that certification would be simpler, easier, faster or less expensive if a specified consultancy organization were used.”

And against the ISMS-specific requirements, which is where the audit-day table lives. An accredited body's audit length is not a commercial decision it makes freely. It starts from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21), is adjustable by up to 30% for genuine complexity, and is never reduced by more than 30%.

A body without accreditation may follow all of that voluntarily. Several do. The point is that nobody is checking, and you have no way to find out that they stopped.

Side by side

Accredited against non-accredited ISO 27001 certification
	UKAS-accredited certification body	Non-accredited body
Who assessed the body that issued it	UKAS, against ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1 and ISO/IEC 27006-1:2024	Nobody, or a body that is not a recognised national accreditation body
Published evidence you can check	A schedule of accreditation naming the scopes the body may certify, on the UKAS register	Whatever the body says about itself on its own website
The impartiality rules apply	Yes, and are audited. The body cannot consult for you, cannot do your internal audits, and cannot imply that using a particular consultancy makes certification easier	The body may assert the same things. No accreditation body assesses whether it does
Audit days	Set by the published table and assessed by UKAS	Set by the body, with no one assessing it. Compare day counts when prices differ
What happens when a customer checks	The certificate number resolves on the accreditation register	There is nothing independent to resolve it against
Where a buyer makes UKAS assessment a condition (example: the LAA's test for a Cyber Essentials equivalent)	Can meet it	Cannot meet it

Where the cheaper price comes from

When two quotes for the same scope differ by a factor of two or three, the explanation is almost never efficiency. It is days.

Take a 25-person scope. The published table puts the initial certification audit at 7 days, which at UK day rates is roughly £7,700 to £10,500. A body that audits the same scope in two days can charge a fraction of that and still make a margin, because it has sold you a fraction of the work. The certificate looks the same. What is behind it is not.

The arithmetic on getting this wrong is simple, and you can do it yourself from the figures on this site. If a customer rejects the certificate, you have paid for it and you then buy the accredited certification you needed in the first place — from £7,700 for a scope that size, plus the delay, which in a tender can cost more than the certificate. The saving on the first certificate has to be weighed against losing all of it plus the contract that prompted the exercise.

ISO 27001 accreditation bodies: UKAS and the others

An accreditation body accredits certification bodies; it does not certify you. In the UK there is one: “UKAS is appointed for the purposes of Article 4(1) of the EC Regulation as the national accreditation body” (The Accreditation Regulations 2009 (SI 2009/3155), regulation 3).

Accreditation bodies elsewhere

Other countries have their own, and a certification body accredited by one of them can issue certificates to UK organisations. UKAS's own guidance on certificates from anywhere: “Check that the certificate has been provided by a certification body that is accredited by an internationally recognised accreditation body.” It warns “There is no restriction on who can become an accreditation body”, and its test is mutual recognition: “you must ensure that the accreditation body is a signatory for the sub-scope that relates to the certificate in question.”

The international arrangement now

That recognition was run by the International Accreditation Forum. iaf.nu now says: “As of 01 January 2026, the International Accreditation Forum (IAF) is no longer operational.” It was replaced by the Global Accreditation Cooperation Incorporated, which has replaced IAF and the International Laboratory Accreditation Cooperation (ILAC). iso.org: “The ISO Survey counts the number of certificates issued by certification bodies that have been accredited by members of the Global Accreditation Cooperation Incorporated (Global ACI), uploaded to IAF CertSearch” — see certified companies lists.

Where a buyer writes accreditation into the test

Some buyers make accreditation explicit. The Legal Aid Agency's data security guidance sets the test for a Cyber Essentials equivalent: “A standard will be considered equivalent where it has been assessed by a UKAS accredited assessor and allows organisations to demonstrate compliance with technical controls in the areas of:” and names ISO 27001 only “where that accreditation has been assessed by a UKAS accredited assessor”. A non-accredited ISO 27001 certificate cannot pass that test, however good the audit was. Public sector buyers under PPN 014 look for independent verification too: “To demonstrate that Cyber Essentials Plus requirements have been met, it is required in all cases that verification is provided by a technically competent and independent third party.” See legal aid and Cyber Essentials.

The question to ask your customer first

“Does your requirement specify certification by a body accredited by a national accreditation body?” Ask it in writing, before you buy anything. It costs an email and it is the only thing on this page that settles the question for your situation rather than in general.

How to check a certification body before you engage it

Look the body up on the UKAS register rather than trusting a logo. A symbol on a website is a claim; the register is the record.
Read the schedule of accreditation, not just the listing. A body can be accredited for ISO 9001 and not ISO/IEC 27001, or accredited for ISO/IEC 27001 within a scope that does not cover your sector. The schedule says which.
Ask for the day count before the price. Any accredited body will give you one, because it is derived from a published rule. A reluctance to state it is informative.
Ask what the relationship is with any consultancy you are also talking to. This is the one that catches people. If your consultancy is related to your certification body, the two-year clock can apply to you — so the relationship between the two firms is a question worth asking before you engage either.
Ask for the three-year schedule of charges, including surveillance, recertification, application and certificate fees, and travel.

Choosing a certification body goes through this in more detail, including the questions that cost nothing to ask and the answers that should give you pause.

We do not sell certification, cannot arrange it, and the only payment we will accept is the same fixed fee per enquiry whatever you decide. If the honest answer for your situation is that the certificate can wait and Cyber Essentials cannot, this site is as happy to tell you that.

The other certificate that expires quietly

While you are checking accreditation, check the edition. Certificates issued against ISO/IEC 27001:2013 ceased to be valid on 31 October 2025 under IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022. Certificates issued against the 2013 edition ceased to be valid after that date. Any certificate you are shown today that still names ISO/IEC 27001:2013 is expired, whoever issued it.

It is worth a look at your suppliers' certificates as well as your own. A supplier assurance pack assembled a few years ago and not revisited may contain certificates that expired against a withdrawn edition, and that is the sort of thing an auditor examining your own supplier-relationship controls will find.

Common questions

What are the accreditation bodies for ISO 27001?

In the UK, UKAS: “UKAS is appointed for the purposes of Article 4(1) of the EC Regulation as the national accreditation body”. Other countries have their own national accreditation bodies. Accreditation bodies accredit certification bodies; they do not certify organisations.

Is a non-UKAS ISO 27001 certificate fake?

No, and it is important to be precise here. A non-accredited certificate is not forged and the body issuing it may run a perfectly honest audit. The difference is that nobody has assessed that body. Accreditation is a second layer: UKAS assesses the certification body against ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1 and the ISMS-specific requirements, including the impartiality rules and the audit-day rule, and publishes a schedule saying what it is competent to certify. Without that layer you have a certificate whose only backing is the assertion of the firm that sold it to you.

What is UKAS, exactly?

The United Kingdom Accreditation Service. It is the United Kingdom's sole national accreditation body, and that is not a marketing claim: regulation 3 of The Accreditation Regulations 2009 (SI 2009/3155), regulation 3 provides that “UKAS is appointed for the purposes of Article 4(1) of the EC Regulation as the national accreditation body”. It does not certify organisations. It assesses the bodies that do.

How do I check whether a certification body is accredited?

Look it up on the UKAS register rather than taking the logo on the website as evidence, and check two things: that the body is listed, and that its schedule of accreditation covers ISO/IEC 27001 for the kind of work you do. A body can be accredited for one management system standard and not another, and a UKAS symbol used outside the accredited scope is a misuse of it. If you are checking somebody else's certificate, the certificate itself should carry the accreditation symbol and a number you can resolve.

Does my customer actually care?

Ask them, in writing, before you buy anything. Public-sector frameworks and large enterprise vendor-security teams generally specify accredited certification and increasingly say so explicitly, because they have been shown unaccredited certificates before. A smaller customer may genuinely not distinguish. The asymmetry is what matters: if they do not care, an accredited certificate still satisfies them, so accredited is the only option that cannot be wrong.

How much cheaper is a non-accredited certificate?

Materially, and the saving comes from a shorter audit. An accredited body works to the published day table — 5 days for a company of ten, rising with headcount — and cannot cut it by more than 30%. A body nobody assesses can audit for as long as it likes. When you compare two quotes and one is a fraction of the other, compare the day counts first.

We already bought a non-accredited certificate. What now?

Find out whether it is actually being rejected before doing anything. If a specific customer has refused it, ask them precisely what they require, because it may be accredited certification or it may be something narrower. If you do need to recertify with an accredited body, you start the cycle again: Stage 1 and Stage 2 against the full day count. Work already done on the management system is not wasted — the risk assessment, the Statement of Applicability and the internal audit all still count. The audit fee is what you pay twice.

Can a certification body be accredited by somebody other than UKAS?

Yes. Accreditation bodies in other countries operate under the same international arrangements and their accreditation is recognised across them, so a certificate from a body accredited by another national accreditation body is a properly accredited certificate. What does not follow is that any organisation calling itself an accreditation body qualifies. If the body issuing your certificate names its accreditor, check that the accreditor is itself a recognised national body and not simply another private company.

Sources cited on this page

Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.