ISO 27001 Recognition by Country: Accreditation Bodies Compared (2026)

Executive Summary: ISO 27001 Recognition by Country at a Glance

A buyer in Munich, Riyadh or Singapore reads your security pack and asks one question: "Is your ISO 27001 certificate recognized here?" The sharper question is not about the country. It is about who accredited the auditor who signed your certificate.

No country keeps a list of "recognized" ISO 27001 certificates. ISO does not certify anyone. A certificate travels because the certification body behind it is accredited by a national accreditation body that belongs to a mutual recognition arrangement, now run by Global ACI. Whether a particular buyer accepts it is still the buyer's call.

By the end, you will be able to read any ISO 27001 certificate, find its accreditation body, check that body's international recognition and answer a buyer in one email.

Here's what I'll cover:

• What "recognized" really means for an ISO 27001 certificate
• How accreditation bodies make a certificate travel, and what changed on 1 January 2026
• A map of ISO 27001 recognition by country, built from the Global ACI registry
• National schemes in Japan and Germany, and where governments name accredited certification in law
• How to check a certificate and choose a certification body your buyers accept

Is ISO 27001 Recognized Internationally? What "Recognized" Really Means

The ISO/IEC 27001 standard is international, but a certificate is only as portable as the accreditation behind the body that issued it. So "which countries accept ISO 27001" really asks a different question: whose accreditation does a buyer in that country trust?

ISO Writes the Standard but Does Not Certify Anyone

ISO says it plainly: it "does not perform certification or issue certificates," and a company cannot be certified by ISO. Certification is performed by external certification bodies.

Accreditation sits one level above those bodies. ISO describes it as "independent confirmation of competence," then adds a counterweight: "accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable."

That is the honest version of what vendors often shorten to "only accredited certificates count." Buyers still ask for accreditation, because it is the one check they can run without auditing the auditor themselves.

ISO 27001 Recognition by Country Depends on the Certificate, Not the Standard

Keep three layers apart:

• The standard: ISO/IEC 27001, the same everywhere.
• The certificate: issued by a named body, to a named legal entity, for a named scope, against a named edition.
• The accreditation: the layer a buyer's country actually checks.

A practitioner states the cross-border consequence bluntly. An ISO 27001 and ISO 42001 auditor wrote in a Hacker News thread in November 2025 that "any accredited certification body the world can audit you."

How ISO 27001 Accreditation Bodies Make a Certificate Travel

The mechanism is a chain of audits. In a Hacker News thread from the same week, one commenter called it "a web of trust model": a certification body is audited by a national accreditation body, which is in turn checked by a peer group.

Here is the chain in plain language:

1. ISO/IEC 27001 sets the requirements for the management system.
2. ISO/IEC 17021-1 and ISO/IEC 27006-1 set how certification bodies must operate when they audit against it.
3. The certification body audits you and issues the certificate.
4. The national accreditation body assesses the certification body.
5. The mutual recognition arrangement peer-evaluates the accreditation bodies, so each recognizes the others' accreditations as equivalent.

Main Scope vs Sub-Scope: Where the ISO 27001 Line Sits in the MRA

The Global ACI arrangement has five levels. Levels 2 and 3 form the main scope, and levels 4 and 5 are sub-scopes.

This matters because an accreditation body can be a full signatory for management systems certification and still show no ISO 27001 entry. On the Global ACI pages, DANAK (Denmark), CGCRE (Brazil), HKAS (Hong Kong), INN (Chile) and OAA (Argentina) show dates for management systems certification but no date beside ISO/IEC 27001 (ISMS).

That does not make ISO 27001 "unrecognized" in those economies. A certification body there can be accredited by a body that does hold the entry.

The IAF MLA and the Global ACI MRA: What Changed on 1 January 2026

For years the answer to this question was the IAF MLA. IAF and ILAC ceased operations on 1 January 2026. Global Accreditation Cooperation Incorporated (Global ACI) took over their roles and runs a single Multilateral Recognition Arrangement, the Global ACI MRA.

What stayed the same is the part buyers care about. Singapore's SAC, in a 13 January 2026 release, says existing accreditations remain valid and recognized, and that existing IAF and ILAC marks stay valid until the new mark is fully adopted. ISO's certification page still points to IAF CertSearch for verification.

What the arrangement commits signatories to is specific. They "commit to recognising other signatories' accreditation programmes and competence as equivalent," except where regulation or law prohibits it. The arrangement relies on six recognized regional cooperation bodies: African Accreditation Cooperation, Asia Pacific Accreditation Cooperation, Arab Accreditation Cooperation, European co-operation for Accreditation, Inter American Accreditation Cooperation and SADC Cooperation in Accreditation.

For scale, the IAF's own legacy page listed 85 accreditation bodies representing 101 economies in 2023. Global ACI's member pages now list 129 full members.

ISO 27001 Recognition by Country: The Accreditation Body Map

ISO 27001 certification by country is a registry question, and the answer is a list of accreditation bodies, not a list of countries. As of October 2026, 55 of the 129 Global ACI full members show an ISO/IEC 27001 (ISMS) date on their member page. The other 74 show the entry with no date.

The tables below group the 55 rows by region.

ISO 27001 Recognition by Country in Europe: EA Members and the EU Rule

In the EU, the rule comes from law. The European co-operation for Accreditation (EA) says Regulation (EC) No 765/2008 requires national authorities in the EU to "recognize the equivalence of the services delivered" by national accreditation bodies that passed EA peer evaluation, and to accept the attestations issued by the bodies they accredit. A conformity assessment body established in the EEA is accredited by its national accreditation body.

Many European bodies share the same 5 April 2018 date, which is the date shown on each page. Denmark's DANAK and Iceland's ISAC are not in the table because their pages show no ISMS date, which says nothing about whether certificates from bodies they accredit are accepted.

UKAS ISO 27001 Accreditation: The UK Position

UKAS shows an ISO/IEC 27001 (ISMS) date of 5 April 2018 on its Global ACI page. "UKAS-accredited" is the phrase UK buyers use, and in MRA terms it means one named accreditation body on the same recognition ladder as the others.

It is a common buyer request. No UK legal requirement is cited here, so ask which wording the buyer's contract uses.

ISO 27001 Recognition by Country in North America and Latin America

ANAB is the name most US buyers write, but it is not the only US body with the entry. Three US bodies show dates, so a buyer who writes "ANAB ISO 27001 or equivalent" is describing a pattern, not one required body.

Brazil's CGCRE, Argentina's OAA and Chile's INN show management systems certification dates but no ISMS date, so a certification body in those economies would need accreditation from a body that holds the entry to issue a certificate that rides on it.

ISO 27001 Recognition by Country in Asia-Pacific: India, Singapore, China, Japan and Australia

India, Singapore and Australia are real markets for ComplyJet customers, and each has a body with the entry. The table also covers East Asia and Central Asia.

Japan lists two bodies, JAB and ISMS-AC, and the section on national schemes below explains why ISMS-AC matters. JAS-ANZ's single entry covers both Australia and New Zealand.

ISO 27001 Recognition by Country in the Middle East and Africa

Several bodies here joined the arrangement recently, so the dates run from 2014 to 2026.

ARAC and AFRAC are the regional groups that carry the arrangement across these economies, and each shows its own ISMS date on its Global ACI page (ARAC 9 November 2023, AFRAC 23 April 2025).

National Schemes and ISO 27001 Recognition by Country: Japan and Germany

Some countries wrap their own scheme around ISO 27001, and a buyer there may name the scheme instead of the standard. Each below follows the same pattern: what it is, who runs it, how it relates to the standard.

Japan: ISMS-AC and the ISMS Conformity Assessment Scheme

ISMS-AC is the ISMS Accreditation Center, established in April 2018. It accredits bodies that certify management systems (ISMS, ITSMS, BCMS and CSMS) and works toward international mutual recognition. Its scheme grew out of one launched by JIPDEC, which began full operation in April 2002.

ISMS-AC shows an ISO/IEC 27001 (ISMS) date of 27 July 2018 on Global ACI, and JAB shows 21 October 2015.

Verdict: a Japanese ISMS certificate sits on the same standard, so ask whether the buyer wants the national scheme or any accredited ISO/IEC 27001 certificate.

Germany: ISO 27001 on the Basis of IT-Grundschutz

The BSI, Germany's federal cybersecurity agency, runs a certification of ISO 27001 on the basis of IT-Grundschutz. An auditor certified by the BSI examines the organization and writes an audit report. The report goes to the BSI, which decides whether to issue the certificate.

Verdict: this is an ISO 27001 certificate issued through the BSI's own process, not the same instrument as a certificate from an MRA-recognized body, and the BSI page does not say whether it accepts the other kind.

ISO 27001 Recognition by Country in Law: Where Governments Name Accredited Certification

No legal text reviewed for this guide makes a foreign ISO 27001 certificate invalid as such. Where law names ISO 27001, it names the standard and the accreditation, and it applies to one sector.

In Türkiye, the 2017 amendment requires licensees to run corporate IT and industrial control systems in line with TS ISO/IEC 27001 and to prove it to a certification body accredited by the Turkish Accreditation Agency. Refiners had until 31 December 2017. It is a sector rule, not a general Turkish one.

In Germany, the C5GleichwV treats an ISO/IEC 27001 certification as proof of a security level equivalent to a C5 Type 1 or Type 2 attestation for healthcare cloud services, as long as the provider also has an action plan covering the C5 criteria that the standard does not.

The absence of a rule is not a green light. Buyers write their own requirements.

Is an ISO 27001 Certificate From Another Country Accepted?

Usually yes, where the buyer's own rules accept the accreditation behind it. The issuing country is not the test. Three typical cases:

• Your company is in India and your certification body is accredited by a European body.
• Your company is in the US and your buyer is in Germany.
• A group certifies each entity or site separately, which shows up as per-entity or multi-site certificates. That is certificate scope, not recognition.

What fails in practice is usually mundane:

• The certificate names a different legal entity than the one signing the contract.
• The scope does not cover the product the buyer uses.
• The certificate is against ISO/IEC 27001:2013. Under IAF MD 26, certification bodies had to move their clients to the 2022 edition by 31 October 2025.
• The certification body is not accredited for ISO/IEC 27001.

How to Check Accredited ISO 27001 Certification Before You Rely on It

Work from the certificate to the registry:

1. Read the certificate. Note the legal entity, scope, edition, certification body and accreditation mark.
2. Find the certification body in its accreditation body's own directory.
3. Confirm the accreditation body on the Global ACI recognised ABs page, filtered to ISO/IEC 27001 (ISMS).
4. Search IAF CertSearch for the certificate and the body.
5. Compare the scope and the Statement of Applicability version with what the buyer will actually use.

Choosing ISO 27001 Certification Bodies That Buyers in Several Countries Accept

Pick the route that matches your buyers:

• Choose a body accredited by a recognized accreditation body in your largest buyer's region if one region carries most of your pipeline.
• Choose one accredited by UKAS or ANAB if your buyers write that phrase in their questionnaires.
• Choose a body with presence in your delivery region if the audit is on site.
• Otherwise, ask the buyer which accreditation they accept before the audit starts.

Before signing with a certification body, ask four questions:

• Which accreditation body accredits you, and for which scope?
• Does the accreditation cover ISO/IEC 27001:2022?
• Will the certificate carry the accreditation mark?
• Do you also issue national-scheme certificates, such as ISMS-AC or IT-Grundschutz?

For the audit mechanics, see our guide to the ISO 27001 certification process.

Common Mistakes With ISO 27001 Recognition by Country

• Asking "which countries recognize ISO 27001" instead of "which accreditation body".
• Treating any MRA signatory as if it covered ISO 27001.
• Confusing a national scheme with a certificate from an MRA-recognized body.
• Trusting a logo without checking the directory.
• Letting a 2013-edition certificate sit past the transition deadline.
• Certifying the wrong legal entity.
• Promising "recognized in X" before reading the buyer's own clause.

Which ISO 27001 Recognition by Country Route Fits Your Buyer? A Practical Guide

Match what you send to the buyer's wording:

If a buyer accepts either an ISO 27001 certificate or a SOC 2 report, our SOC 2 to ISO 27001 mapping shows how the controls line up.

How ComplyJet Fits When Buyers Ask About ISO 27001 Recognition

ComplyJet is a compliance automation platform. It is not a certification body or an accreditation body, so the certificate comes from an independent certification body and recognition is theirs to confirm.

What we do is get you ready for that audit: policies, evidence and controls on one foundation, with a team that guides you through the process. For ISO 27001, see our framework page and our guide to ISO 27001 for startups.

FAQs

Is ISO 27001 Recognized Worldwide?

The standard is international, but no country keeps a list of recognized certificates. A certificate is recognized where the accreditation behind it is, and each buyer decides what it accepts.

Which Countries Accept ISO 27001 Certification?

Acceptance follows the accreditation body, not the country. As of October 2026, 55 Global ACI full members show an ISO/IEC 27001 (ISMS) date. The map above lists them by region.

Who Accredits ISO 27001 Certification Bodies?

National accreditation bodies such as UKAS, ANAB, DAkkS, COFRAC and NABCB. They are peer-evaluated under the Global ACI MRA, which replaced the IAF MLA on 1 January 2026.

Is an ISO 27001 Certificate From Another Country Valid?

Yes, where the buyer's rules accept the accreditation behind it. Check the entity, scope, edition and accreditation body, not the issuing country.

Is ISO 27001 Mandatory by Law in Any Country?

We did not find a general mandate. The legal texts reviewed show sector rules, such as Türkiye's petroleum licensing amendment and Germany's C5GleichwV for healthcare cloud.

How Do I Verify an ISO 27001 Certificate Is Accredited?

Read the certificate, find the body in its accreditation body's directory, confirm the accreditation body on the Global ACI recognised ABs page and search IAF CertSearch. A missing CertSearch result means ask, not assume.

What Is the Difference Between the IAF MLA and the Global ACI MRA?

The IAF MLA was run by IAF, which ceased operations on 1 January 2026. Global ACI took over and runs a single MRA. Existing accreditations stay recognized, and IAF marks stay valid until the new mark is fully adopted.

Is a Non-Accredited ISO 27001 Certificate Worth Anything?

It is valid as a document and weak as evidence. ISO says accreditation is not compulsory, but buyers ask for it because it is the check they can run quickly.

Do ISO 27001 Certificates Issued Under the 2013 Version Still Count?

Not for new reliance. Under IAF MD 26, certification bodies had to move their clients to ISO/IEC 27001:2022 by 31 October 2025, so ask for a 2022 certificate.

Related Reading

• ISO 27001 vs SOC 2: choosing between the two
• SOC 2 to ISO 27001 mapping: the control crosswalk when a buyer accepts either
• ISO 27001 certification process: the audit steps behind the certificate
• ISO 27001 certification cost: what certification costs by region
• ISO 27001 for startups: ISO 27001 for early-stage teams