UAE
Qatar
Pakistan
KSA
Oman
Kuwait
Bahrain
China is tightening oversight of ISO 9001 certification after concerns about certificates that do not reflect a credible audit. In a November 2025 report, Oxebridge described two distinct problems: outright fake certificates and certificates issued by recognised bodies after allegedly inadequate audits. Its allegations about the scale of those problems are the author’s assessment; the official Chinese announcement does not quantify them.
What the official announcement does confirm is a new set of controls for quality management system (QMS) certification. China’s National Certification and Accreditation Administration (CNCA) says it revised the rules to strengthen confidence in certification, hold certification bodies accountable and improve audit effectiveness. The revised rule, CNCA-QMS-01:2025, took effect on 1 January 2026. It applies to QMS certification activities within China; it does not change the ISO 9001 standard or UAE certification law.
Where the rule targets weak or unreliable certification
Auditor capacity and competence. A certification body needs at least two suitably qualified QMS auditors in every professional field in which it offers certification. Every audit team must include a full-time auditor from that body who participates throughout the QMS audit. An individual auditor’s combined on-site work across management-system audits is limited to 180 days per cycle year. The rule also caps the total valid management-system certificates matched to each QMS auditor at 50 per cycle year. That 50-certificate figure covers management-system certificates beyond QMS alone.
Evidence that an audit actually took place. The revised rule requires certification bodies to check the authenticity of application information and retain audit records. It calls for direct interviews with senior management and evidence of their involvement in the QMS. If false application information is found during Stage 1, the certification activity must end. These requirements address the risk of issuing a certificate without a meaningful review of the organisation’s real system.
Time for initial and ongoing audits. Stage 1 and Stage 2 of an initial QMS certification audit must be separated by at least five days, with a maximum interval of six months; beyond that, Stage 1 must be repeated. The first surveillance audit must take place within 12 months of the certificate’s issue date, and later surveillance audits must be no more than 12 months apart. The requirements make it harder to compress the process or leave a certificate without timely follow-up, although the existence of a rule alone does not prove how consistently it is enforced.
Money and conflicts of interest. The client seeking certification must pay the certification body directly. The certification decision must be made by personnel separate from the audit team and cannot be outsourced. When a certification body provides QMS technical support, it cannot write the organisation’s system documents or carry out its internal audit or management review on its behalf. The rule expressly prohibits helping to fabricate QMS documents or operating records. Someone who provided that support must not be assigned to certification activities for the same organisation for two years.
Does this stop fake ISO certificates?
The CNCA rule is directed at bodies conducting QMS certification in China and at the integrity of their certification process. Oxebridge’s separate concern about documents produced by certificate mills is broader. These measures do not, by themselves, show that every fake certificate will be detected or that the alleged misconduct has ended. Their real effect depends on supervision and enforcement. The rule authorises the relevant regulators to supervise QMS certification activities and act on violations under applicable law.
There are also conditions on applying again after a certificate problem. The one-year condition in the rule applies when a certificate was suspended or revoked because of the certified organisation’s own circumstances; it is not a universal ban following every suspension. A separate three-month condition applies if the original issuing body’s QMS certification authorisation was revoked by CNCA.
What should UAE businesses check?
If a UAE business receives an ISO 9001 certificate from a supplier or partner in China, it should verify the issuing certification body, the certificate’s status, the named organisation and sites, its stated scope and any claimed accreditation. These checks are useful because a convincing-looking document alone is not proof of a valid certification process. This is a due-diligence takeaway from the story, not a claim that China’s rules govern audits in the UAE.
For UAE organisations preparing for an independent audit, Qdot provides ISO 9001 certification-readiness support. The certification body conducts the external audit and makes the certification decision.
Sources: CNCA Announcement No. 16 of 2025 and its attached QMS certification rule; Oxebridge’s original report by Christopher Paris, 17 November 2025.
