Comparison · Certification Software
Certification Body vs. Notified Body vs. Accreditation Body: What's the Difference?
Clear definitions of certification body, notified body, accreditation body and conformity assessment body, with the legal basis for each and how they relate in the EU conformity assessment system.
By Conformo Editorial Team · Published
Overview
These terms are used interchangeably in general business writing and are not interchangeable in regulatory practice. They describe organisations with different legal bases, different authorities and different oversight relationships. This page defines each precisely and sets out how they relate.
The short answer
A conformity assessment body performs testing, inspection or certification. A certification body is a conformity assessment body that issues certificates. A notified body is a conformity assessment body that has been designated by an EU Member State authority to carry out conformity assessment under a specific piece of EU legislation. An accreditation body does not assess products at all — it assesses and accredits the conformity assessment bodies themselves.
The relationship runs in one direction: accreditation bodies oversee conformity assessment bodies. A single organisation can be both a certification body and a notified body simultaneously. No organisation is both an accreditation body and a certification body — the separation is structural.
What does "certifying body" mean?
A certification body is an independent organisation that assesses whether a product, process, service, system or person conforms to specified requirements, and issues a certificate attesting to that conformity.
"Certifying body," "certificate body" and "certified body" are informal variants that appear in general usage. In regulatory and accreditation documents the correct term is certification body.
The distinction between "certification body" and "certified body" is worth keeping straight, because it reverses the direction of the relationship. A certification body issues certificates to others. A certified body is an organisation that holds a certificate issued by someone else. A manufacturer certified to ISO 13485 is a certified organisation, not a certification body.
Certification bodies operating management system certification are typically accredited against ISO/IEC 17021-1. Those certifying products work to ISO/IEC 17065, and those certifying persons to ISO/IEC 17024.
A certification body's authority derives from its accreditation and from the contractual relationship with its client. It is not, on that basis alone, exercising any public authority.
What is a certification body's role?
A certification body:
- assesses conformity against a defined standard or scheme — ISO 9001, ISO 13485, ISO 14001, ISO/IEC 27001, or a private or sector scheme;
- conducts audits, reviews documentation and evaluates evidence;
- issues, maintains, suspends and withdraws certificates;
- performs surveillance during the certification cycle to confirm continued conformity;
- maintains impartiality, competence and confidentiality as required by the relevant ISO/IEC 17000-series standard.
Certification against ISO 9001 or ISO 13485 is voluntary in the sense that no law compels a manufacturer to hold it — although customers, regulators and market access requirements frequently make it commercially unavoidable, and ISO 13485 certification is a practical prerequisite for medical device market access in most jurisdictions.
What is a notified body?
A notified body is a conformity assessment body that has been designated by a Member State's designating authority and notified to the European Commission to carry out third-party conformity assessment tasks under a specific piece of EU harmonisation legislation.
The defining characteristics:
It is designated, not merely accredited. Designation is a decision by a national authority under a specific regulation or directive, following an assessment of the body's competence, independence and resources. The body is then notified to the Commission and listed in NANDO (New Approach Notified and Designated Organisations), with a unique four-digit identification number.
Its authority is legislation-specific and scope-specific. A body notified under the Medical Device Regulation (EU) 2017/745 is not thereby notified under the In Vitro Diagnostic Regulation (EU) 2017/746, the Machinery Regulation, or the Cyber Resilience Act. Designation is granted for defined scopes — under MDR and IVDR these are expressed as device codes under Commission Implementing Regulation (EU) 2017/2185. A notified body may only assess within its designated scope.
It exercises delegated public authority. This is the substantive difference from voluntary certification. When a notified body issues an EU technical documentation assessment certificate, it is performing a task the legislation reserves to designated bodies, and its certificate is the basis on which a manufacturer may affix the CE marking and place a product on the Union market. The notified body's number appears alongside the CE marking where the notified body was involved in the production control phase.
It is subject to continuing oversight. Designating authorities monitor notified bodies, conduct surveillance and reassessment, and can restrict, suspend or withdraw designation.
Under MDR and IVDR, the requirements a notified body must satisfy are set out in Annex VII of each Regulation, covering organisational and general requirements, quality management, resource requirements, and process requirements. Commission Implementing Regulation (EU) 2026/977, applying from 25 February 2027, adds uniform quality management and procedural requirements — including binding maximum timelines — on top of Annex VII.
What is a conformity assessment body?
A conformity assessment body (CAB) is the umbrella term. It means a body that performs conformity assessment activities: calibration, testing, inspection, certification, or a combination.
Every notified body is a conformity assessment body. Every certification body is a conformity assessment body. Testing laboratories and inspection bodies are conformity assessment bodies that are not certification bodies.
The term matters because EU legislation is drafted using it. The Cyber Resilience Act, for example, governs "notification of conformity assessment bodies" — a body applies as a conformity assessment body and becomes a notified body upon notification to the Commission.
Conformity assessment body is therefore the status an organisation has by virtue of what it does. Notified body is a status conferred by a Member State under specific legislation.
What is an accreditation body?
An accreditation body is the national body that performs accreditation — the formal attestation that a conformity assessment body is competent to carry out specific conformity assessment tasks.
In the EU this is governed by Regulation (EC) No 765/2008, which establishes that each Member State shall appoint a single national accreditation body, that accreditation is a public authority activity, and that national accreditation bodies shall not compete with conformity assessment bodies or with each other. Examples include DAkkS (Germany), COFRAC (France) and UKAS (United Kingdom, now outside the EU framework).
National accreditation bodies are peer-evaluated through the European co-operation for Accreditation (EA), which operates multilateral agreements underpinning mutual recognition of accredited conformity assessment results across Europe. Internationally, equivalent arrangements operate through ILAC and IAF.
Accreditation bodies assess conformity assessment bodies against the ISO/IEC 17000-series standards — 17025 for testing and calibration laboratories, 17020 for inspection bodies, 17021-1 for management system certification, 17065 for product certification, 17024 for personnel certification.
An accreditation body does not assess products, does not issue product or system certificates to manufacturers, and has no direct relationship with the manufacturers whose certificates its accredited bodies issue.
How do accreditation and designation relate?
This is the point most often confused.
Accreditation is an attestation of technical competence against an international standard, granted by the national accreditation body.
Designation is a legal act by a Member State authority conferring the power to perform conformity assessment under specific EU legislation.
They are distinct, and neither automatically produces the other. In practice, designating authorities frequently rely on accreditation as evidence of competence, and Regulation (EC) No 765/2008 encourages this. But designation involves an assessment against the requirements of the specific legislation — for MDR and IVDR, against Annex VII — which goes beyond what an ISO/IEC 17065 accreditation covers. A body can hold accreditation and be refused designation.
Under MDR and IVDR, designation assessments are conducted jointly by the designating authority and assessors from other Member States and the Commission — a joint assessment process considerably more demanding than accreditation alone.
Can one organisation be more than one of these?
Certification body and notified body: yes, and it is common. Large TIC organisations typically operate voluntary certification services (ISO 9001, ISO 13485) alongside notified body activities under one or more EU regulations. The activities are distinct in legal basis even when performed by the same legal entity, and the body must keep them separated in its quality management system. A single organisation may hold notified body designation under several regulations, each with its own scope and identification arrangements.
Accreditation body and certification body: no. Regulation (EC) No 765/2008 requires the national accreditation body to operate on a non-competitive, not-for-profit basis and to refrain from activities that would compromise its impartiality toward the bodies it accredits.
Quick reference
| Certification body | Notified body | Accreditation body | |
|---|---|---|---|
| What it assesses | Products, systems, processes, persons | Products and quality systems within its designated scope | Conformity assessment bodies |
| Source of authority | Accreditation and contract | Designation by a Member State under specific EU legislation | Regulation (EC) No 765/2008; appointed by the Member State |
| Assessed against | ISO/IEC 17021-1, 17065, 17024 | Annex VII of the relevant Regulation; ISO/IEC 17000-series | Peer evaluation through EA |
| Output | Certificates of conformity | EU certificates enabling CE marking | Accreditation certificates and scopes |
| Public authority? | No | Yes — delegated | Yes |
| How many per country | Many | Many | One |
| Listed in | Accreditation body registers | NANDO | EA members list |
Frequently asked questions
Is a notified body a certification body?
A notified body performs certification activities and in that sense is a certification body. But the term "notified body" specifically denotes designation under EU legislation. Many notified bodies also operate voluntary certification services under accreditation, which are legally distinct from their notified body activities.
Does a certification body need accreditation?
Not as a matter of law in most cases, but accredited certification is what markets and regulators generally recognise. Unaccredited certification exists and carries substantially less weight.
What does "certified body" mean?
It is not a standard term. It usually refers to an organisation that holds a certificate — a certified organisation. The body that issues the certificate is a certification body.
Who accredits the accreditation body?
National accreditation bodies are peer-evaluated by the European co-operation for Accreditation, and internationally through ILAC and IAF. There is no higher accreditation authority; the system rests on mutual peer evaluation.
How do I find out whether a body is genuinely a notified body?
Check the Commission's NANDO database. It lists every notified body, its four-digit identification number, the legislation it is notified under, and its designated scope. A body claiming notified body status that does not appear in NANDO under the relevant legislation is not a notified body for that legislation.
Can a notified body assess anything outside its designated scope?
No. Designation is scope-limited, and under MDR and IVDR scopes are expressed as device codes under Commission Implementing Regulation (EU) 2017/2185. Assessment outside the designated scope is invalid.
Is a conformity assessment body the same as a notified body?
No. Conformity assessment body is the general category. A notified body is a conformity assessment body that a Member State has designated and notified to the Commission under a specific piece of legislation. Most conformity assessment bodies are not notified bodies.