IAF MD 28 and IAF CertSearch: what you must upload, and how often

What the rule requires

• Who. Certification bodies accredited under ISO/IEC 17021-1 by an accreditation body that signed the IAF MLA, now the Global ACI arrangement.
• How often. At least once a month, so the database always reflects the current state of every certification. If nothing changed in a month, you still log in and confirm the data as current.
• Corrections. Within two weeks of an error or omission being identified.
• Retention. Status information stays on the database for at least three years after the corresponding decision.
• Enforcement. Your accreditation body raises nonconformities under ISO/IEC 17011 and applies sanctions under its own policies if you do not conform.

The 15 mandatory fields

IAF MD 28 lists these as mandatory for each certification. Further fields, such as trading names, logos and certificate links, are optional.

1. 1Certified entity name, as in the official national company register
2. 2Certified entity registered address
3. 3Geographical location of the certified client, or of the headquarters and every site
4. 4Certificate number, unique
5. 5Management system standard and scheme, or other normative document
6. 6IAF sector codes, where applicable
7. 7Scope of certification: activities, products and services
8. 8Certification issue date: the effective date of granting, expanding or reducing scope
9. 9Certification expiry date
10. 10Certification status: active, suspended or withdrawn
11. 11Certification body name and acronym
12. 12Accreditation body name and acronym
13. 13Unique IDs set by the certification body for the certified entity and the certification
14. 14Other legal registration information, as necessary
15. 15Any other information required by the standard or normative document

Four ways to upload

Direct entry in the database, a file upload in Excel or XML, an automated FTP transfer, or an API connection. The method matters less than whether the data comes from your live certificate register or is rebuilt by hand each month.

Checks worth running before each upload

1. 1

   Status matches the decision. Every suspension and withdrawal decided in the month appears with the right status. A certificate still shown as active after suspension misleads anyone who checks it.

2. 2

   Unique IDs are stable. The client ID and certification ID you set must not change at renewal or on a scope change. A new ID creates a second record instead of updating the first.

3. 3

   Every site is listed. For multi-site certifications, the location of the headquarters and each site, matching the certificate.

4. 4

   Scope and IAF codes match the certificate. The same wording and codes the certification decision approved, not a summary.

5. 5

   Issue dates reflect scope changes. Extensions and reductions carry the effective date of that decision.

If you are accredited by Accredia

Italian certification bodies already load certification data directly into Accredia's own certification database. IAF CertSearch allows an accreditation body to upload on a certification body's behalf where the two have an arrangement, so confirm with Accredia whether your data reaches CertSearch that way or whether you upload it yourself. Either way, keeping the data accurate and current is your responsibility.

If you are accredited in India

The monthly upload under IAF MD 28 applies to every certification body accredited by an IAF MLA signatory, whether that is NABCB or another accreditation body. NABCB-accredited bodies also answer NABCB's own call for data on new certificates each quarter, under BCB 201 (MS), so the same certificate register feeds two requests on different cycles. Confirm with NABCB whether it uploads to CertSearch on your behalf or you upload yourself.

CertSearch is also where Indian buyers are being told to look. NABCB's February 2025 advisory asks government, regulators, public sector undertakings and MSMEs to check certificates on IAF CertSearch before relying on them, and NABCB's tender guidelines, BCB-601, accept accreditation by any IAF MLA signatory. A client certificate that is missing from CertSearch, or shows the wrong status, can cost that client a tender.

Certyze for NABCB-accredited certification bodies

How Certyze handles it

In Certyze the fields above are part of the certification record itself: client ID, certificate number, standard and scheme, IAF codes, sites, scope, dates and status, updated by the same decisions that change them. Certyze exports the certificate register in the IAF CertSearch upload format, so the monthly upload comes from the live register rather than a spreadsheet kept alongside it.

What stays with you

The upload itself, and the accuracy of what you certify, remain the certification body's responsibility. The export is a tool for meeting the requirement, not a substitute for it.