ISO/IEC 17025, ISO 9001 and GMP: What Each Label on a Test Report Actually Certifies

The three labels answer three unrelated questions, and only one of them concerns whether a test result is correct. ISO/IEC 17025 accreditation says a specific laboratory has been assessed as technically competent to perform a defined list of methods, and that its reports meet stated content requirements ^[1]. ISO 9001 certification says an organisation — any organisation, in any sector — operates a documented quality management system ^[2]. GMP is a manufacturing regime applied to a facility that makes drug substances or drug products, enforced through inspection rather than sold as a badge ^{[7] [8]}. A laboratory can hold all three, one, or none, and a supplier can display a logo belonging to a company it has never used. None of the three is a property of the material in the container.

This matters because the labels are usually printed where a reader will infer the strongest possible reading. An ISO 9001 logo beside a purity figure invites the conclusion that the figure was verified. It was not: ISO 9001 contains no requirement about measurement uncertainty, method validation, proficiency testing, or what a test report must say ^[2].

Accredited or certified? The two words are not interchangeable

Conformity assessment has its own vocabulary standard, and it defines both words precisely. Under ISO/IEC 17000:2020, certification is third-party attestation related to an object of conformity assessment — a product, process, service, system or person — other than a conformity assessment body itself. Accreditation is third-party attestation related to a conformity assessment body, conveying formal demonstration of its competence to carry out specific conformity assessment tasks ^[3]. In plain terms: things and systems get certified; the bodies that test, inspect and certify get accredited.

There is a structure behind that distinction. An accreditation body assessing a laboratory against ISO/IEC 17025 must itself operate under ISO/IEC 17011, which sets requirements for how accreditation is assessed, granted, maintained and withdrawn, and for how the scope of what has been accredited is defined and made available ^[4]. A certification body issuing ISO 9001 certificates operates under a different standard, ISO/IEC 17021-1, governing the competence, consistency and impartiality of bodies auditing management systems ^[5]. Two oversight standards, two objects of assessment, two words.

What ISO/IEC 17025 accreditation actually covers

ISO/IEC 17025:2017 is the standard against which testing and calibration laboratories are assessed, and its requirements are largely technical rather than administrative. It addresses impartiality and confidentiality; the competence, training and authorisation of personnel; equipment and metrological traceability; the selection, verification and validation of methods; the evaluation of measurement uncertainty; procedures for ensuring the validity of results, including participation in interlaboratory comparisons and proficiency testing; and the content of reports, including how statements of conformity must be made and the decision rule applied to them ^[1]. Each of those is a place where a purity or identity result can go wrong, and each is something an assessor physically checks on site.

The single most important thing to understand about accreditation is that it is never general. It is granted for a defined scope — named methods, named measurands, named matrices, sometimes named ranges — and ISO/IEC 17011 requires the accreditation body to define that scope and make the accreditation status available ^[4]. A laboratory accredited for elemental analysis of drinking water is not thereby accredited for reversed-phase HPLC purity of a synthetic peptide — a separate method, with its own account of what a chromatographic purity percentage does and does not cover. The certificate number is the entry point; the scope document is where the answer actually is.

Accreditations also travel. Accreditation bodies signing the ILAC Mutual Recognition Arrangement agree to conform to ISO/IEC 17011 and to ILAC's evaluation procedures, which is what allows a report from a laboratory accredited in one economy to be accepted in another ^[6]. The register you need is therefore the accreditation body's own public search page, and a certificate number that returns nothing is a finding in itself.

What ISO 9001 certification actually covers

ISO 9001:2015 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to consistently provide products and services meeting customer and applicable regulatory requirements. Those requirements are explicitly generic, intended for any organisation regardless of type, size or sector ^[2] — a logistics broker, a software firm and an analytical laboratory can hold the same certificate. It covers document control, competence management, corrective action, internal audit and continual improvement: real disciplines, none of which is a measurement.

The cleanest proof that ISO 9001 is a subset rather than a substitute is written into ISO/IEC 17025 itself. Clause 8 of the standard offers two routes to its management system requirements: Option A, the free-standing set written into clauses 8.2 to 8.9, or Option B, in which a laboratory that maintains a management system in accordance with ISO 9001 and can demonstrate consistent fulfilment of clauses 4 to 7 is deemed to satisfy at least the intent of 8.2 to 8.9 ^[1]. ISO 9001 discharges the management half of one clause. Clauses 4 through 7 — impartiality, resources, and the process requirements covering methods, uncertainty, traceability and reporting — have no ISO 9001 equivalent at all, and Option B does not exempt a laboratory from any of them.

Note also whose certificate it is. A seller displaying ISO 9001 is describing its own administrative system, not a contract laboratory it commissioned and not any batch. Where the assessed object is a produced material rather than a system, a separate standard applies: reference material producers are assessed against ISO 17034, covering production planning, homogeneity, stability, and assigned property values with their uncertainties ^[12]. If a supplier claims its material functions as a reference standard, that is the standard to ask about.

What GMP means in the US and Canada, and who issues what

GMP is not a laboratory standard and not a product grade. It is a regulatory framework for how a manufacturing facility is operated, staffed, cleaned, documented and released. In the United States, current good manufacturing practice for finished pharmaceuticals is codified in 21 CFR Part 211, which covers organisation and personnel, buildings and facilities, equipment, control of components, production and process controls, laboratory controls, records and reports ^[7]. For active pharmaceutical ingredients, FDA has adopted ICH Q7 as guidance, which sets out where GMP obligations begin in a synthetic route and what quality unit responsibilities apply thereafter ^[8].

Two things follow that are worth stating plainly for a US or Canadian reader. First, FDA establishes GMP compliance by inspecting a facility; it does not hand a domestic manufacturer a GMP certificate to forward to customers. The certificate FDA does issue for drugs is the Certificate of Pharmaceutical Product, an export instrument for products that meet defined legal criteria — a different document answering a different question ^[9]. Second, in Canada, GMP requirements sit in Part C, Division 2 of the Food and Drug Regulations, interpreted in Health Canada's GUI-0001, and establishments that fabricate, package, label, test, import or distribute drugs generally require a Drug Establishment Licence rather than a certificate ^[10]. So when a supplier in North America offers a "GMP certificate", the sensible question is: issued by whom, against which document, for which site, and on what date?

Europe shows what a verifiable version looks like: a national competent authority issues a GMP certificate after inspection, and both certificates and statements of non-compliance are published in the EudraGMDP database for anyone to search ^[11]. No equivalent public register exists for US domestic GMP status, which is why "GMP certified" on a North American supplier page most often traces back to a private third-party audit the supplier paid for. Such an audit may be perfectly rigorous. It is simply not a regulator's finding, and should not be read as one.

How to check a claim in under five minutes

This is a documentary exercise, not a technical one, and it resolves most claims quickly.

1. Read the verb. Accredited applies to a testing body; certified applies to a system, product or person ^[3]. A mismatch means the claim was copied rather than checked.
2. Identify the accreditation body and certificate number, then search that body's public register. Cross-border recognition runs through the ILAC arrangement, so the issuing body should be traceable to it ^[6].
3. Open the scope of accreditation and find the actual method on your report — chromatographic purity, mass spectrometric identity, water content — and confirm it is listed. Scope is definitional, not decorative ^[4].
4. Check validity dates and the site address. Accreditation and certification are both site-specific and time-limited.
5. For an ISO 9001 claim, establish whose system is certified — the laboratory's, the manufacturer's or the reseller's — and treat it as evidence about administration only ^[2].
6. For a GMP claim, ask which regime. In the EU and EEA, search EudraGMDP directly ^[11]; in the US and Canada, ask for inspection or licence evidence instead, since no public certificate exists for a US domestic site ^{[9] [10]}.
7. Record body, number, scope and dates in your own log, against the lot rather than the product.

Where these labels get misused

• The accreditation belongs to a contract laboratory used once, years ago, but the logo sits permanently on the seller's site.
• The accreditation is genuine and current, but its scope excludes the method that produced the number you are reading ^[4].
• "GMP grade" is used as a product adjective — a grade word of the same kind as research grade, a term with no defining body behind it — or an ISO 9001 certificate held by a trading company that neither manufactures nor tests is offered as evidence of material quality ^{[2] [8]}.
• A certificate names one site of a multi-site company while the material came from another, or it has simply lapsed and no one checked the dates ^[6].
• A statement of conformity — "passes", "conforms" — appears with no decision rule, when ISO/IEC 17025 requires the decision rule to be documented and reported ^[1].

The honest limits of all three labels

None of these frameworks certifies the container on your bench. ISO/IEC 17025 accreditation establishes that a laboratory can competently run a method and report it correctly; it says nothing about whether the sample that reached the instrument was drawn from your lot, handled correctly in transit, or representative of the batch ^[1]. GMP concerns the site that made the material, not the parcel that arrived; ISO 9001 concerns paperwork discipline. The chain from a real analysis to a real container is made of sampling, labelling and custody records, which no label supplies and which have to be built as a batch-traceability record on the receiving side.

It is also worth being direct about how thin the evidence usually is in this category. Most analysis reported for research compounds is not performed by a laboratory accredited for the specific method involved, and claiming otherwise would be inaccurate. That does not make an unaccredited result worthless — a named laboratory, a named method, stated acceptance limits and a signature are far more accountable than an anonymous percentage — but the realistic best case is traceability and internal consistency, not accreditation. Regulated supply chains handle that residual uncertainty by not relying on supplier paperwork alone: under 21 CFR Part 211, a supplier's report of analysis may substitute for full testing only where the receiving party performs at least one specific identity test itself and validates the supplier's results at appropriate intervals ^[7].

The habit worth forming is small: whenever a standard number appears next to a result, ask what object it was applied to and who applied it. A laboratory, a management system and a factory are three different objects. Separate them and most of the ambiguity in supplier documentation disappears, leaving a short list of things you can actually look up.