ISO 17025 vs GMP vs ISO 9001: What Lab and Supplier Certifications Mean

ISO 17025 vs GMP vs ISO 9001: three different questions

The quickest way to keep the three apart is to ask, for each, what it is evidence of, who decided, and where you would check. Two are international standards published by ISO and used through certification or accreditation. The third is regulation, enforced through inspection.

ISO 9001: certifying a quality management system

ISO 9001 sets requirements for an organization’s quality management system, and it has just been revised: ISO announced the launch of ISO 9001:2026 on 16 September 2026. A certificate that still cites the 2015 edition is not automatically suspect; ask the certification body when it moves to the new one.

ISO itself certifies no one. Its certification page says ISO “does not perform certification or issue certificates” and that “a company or organization cannot be certified by ISO.” Certificates come from independent certification bodies, which may be accredited, though “accreditation is not compulsory”. ISO also “does not permit anyone to use the ISO logo in connection with certification”, so an “ISO 9001 certified” badge built around ISO’s own logo is a reason to look closer.

Nor can an ISO 9001 certificate vouch for a product or for a laboratory’s measurements; it records that a management system was audited against requirements. ILAC is direct about laboratories: ISO 9001 certification of a laboratory’s quality system “does not specifically evaluate the technical competence of a laboratory”.

ISO/IEC 17025: accrediting a laboratory for a listed scope

ISO/IEC 17025:2017, General requirements for the competence of testing and calibration laboratories, is the standard laboratories are accredited against. ISO says it “sets out requirements for the competence, impartiality, and consistent operation of laboratories”; the 2017 edition was last reviewed and confirmed in 2023 and remains current. ISO/IEC 17025 accreditation is what a laboratory holds once an accreditation body has assessed it against those requirements.

The word that matters is scope. ILAC describes accreditation as “evaluating the competence of laboratories to perform specific types of testing, measurement and calibration”, and each accredited laboratory has a scope of accreditation listing those activities. A laboratory might be accredited for trace metals in drinking water and pesticide residues in food, yet offer other analyses its accreditation does not cover. Where an accreditation body allows out-of-scope work on an accredited report at all, ILAC’s policy requires it to be “clearly identified by a disclaimer”.

So “ISO 17025 accredited” tells you little until you know for what. With a report in hand, ask whether the specific analysis on it — HPLC purity, say, or identity by mass spectrometry — carries the accreditation. Our guide to what a test report should contain covers the rest of the page.

GMP: a regulatory requirement for making drugs

Good manufacturing practice for drugs is neither an ISO standard nor something a business buys; it is regulation. Health Canada’s definition is short: GMP “ensure drugs meet the appropriate quality standards for their intended use before they are sold.” It checks compliance by inspecting drug establishments, and calls that inspection “a requirement for issuing a drug establishment licence.” So the ISO 17025 vs GMP distinction is one of kind: an accreditation body assesses a laboratory for a stated scope, while a regulator inspects a drug establishment. GMP vs ISO 9001 is a similar mismatch: both concern quality systems, but one is a regulatory requirement and the other a certifiable standard.

A named authority, a named site and an inspection date are what make a GMP claim checkable. Health Canada publishes its drug inspections, with each establishment’s rating, in its Drug and health product inspections database. In the EU, “EU competent authorities issue a GMP certificate or a non-compliance statement” after inspection, recorded in EudraGMDP, which the European Medicines Agency calls “a publicly accessible EU database”. A GMP claim that cannot name the authority, site and date is a claim, not a credential. The record-keeping side of GMP is covered in our explainer on batch records and traceability.

Two cautions. The letters GMP also appear outside drug regulation: ISO 22716, for instance, “gives guidelines for the production, control, storage and shipment of cosmetic products”, so a “GMP certified” badge does not say whose GMP, or who checked. And these are drug and pharmaceutical frameworks; we cite them to explain the term, not to suggest they govern laboratory reagents, and this article makes no claim about which rules apply to a given reagent. For “GMP grade” as a listing label, see our companion piece on research grade vs pharmaceutical grade.

Certification vs accreditation, and who checks the checkers

ISO’s own definitions are the clearest. Certification is “the provision by an independent body of written assurance (a certificate) that the product, service or system in question meets specific requirements.” Accreditation is “the formal recognition by an independent body, generally known as an accreditation body, that a certification body operates according to international standards.” Laboratories are accredited in the same sense, for competence in specific tests. Certification is about the thing checked; accreditation is about the checker.

Accreditation bodies are checked in turn. Until the end of 2025 that ran through two arrangements: ILAC’s, for laboratories and inspection bodies, and IAF’s, for certification bodies. On 1 January 2026 both organizations were replaced by Global Accreditation Cooperation Incorporated, whose single arrangement now covers the scopes the two recognized. Its launch announcement describes “rigorous, standards-based peer evaluation (ISO/IEC 17011)” of accreditation bodies, says accreditations issued under the ILAC and IAF arrangements “will continue to be recognised”, and says the old marks “will remain valid for as long as required” — so expect the old names on certificates for a while.

In Canada, the Standards Council of Canada, a Canadian Crown corporation, runs accreditation programs that include testing and calibration laboratories (ISO/IEC 17025) and management system certification bodies (ISO/IEC 17021-1), and describes itself as “a signatory to ILAC and IAF international agreements”. The Canadian Association for Laboratory Accreditation (CALA) accredits laboratories to ISO/IEC 17025. Both appear on the international signatory list for testing.

How to verify a claim in five minutes

1. Get the specifics. The organization’s registered name and site, the standard and edition, the certificate or accreditation number, the issuing body, the expiry date and, for a laboratory, the scope. A badge without these is decoration.
2. For ISO 9001, look up the certificate. IAF CertSearch, by its own description “the exclusive global database for accredited management system certifications”, can be searched by company name or certificate details, and confirms whether a certification is valid, whether the certification body is accredited and whether its accreditation body is a signatory. If it is not listed, ask the issuing body.
3. For ISO/IEC 17025, read the directory entry and the scope. SCC’s directory shows each organization’s status, including suspensions, and links its scope of accreditation; CALA’s lists accredited laboratories and “the specific tests, registered with CALA, for which they have been found competent”. For a laboratory abroad, use its national accreditation body’s directory; ILAC’s signatory search, still online, shows whether that body is a signatory.
4. For GMP, ask who inspected what: the authority, the site, the activities and the date. Then look the site up in that regulator’s database.
5. Read the report itself. ILAC’s policy says an accreditation symbol must not be “affixed to an item or product” or used to imply that a product is certified, so an accreditation logo on a product label or listing image is not evidence about that product.

The same checks apply to any supplier’s testing claims, including ours: start with our Lab Testing page.

What none of these can prove about one vial

Each credential is evidence about an organization or a laboratory, not about a particular container of material — and the standards say so themselves.

• An accredited report covers the item tested. ISO/IEC 17025 requires reports to state that results relate only to the items tested; European Accreditation explains that the statement is “needed in all test reports” because the results “cannot be extended to other items” and cannot be read as “lot approval, product certification or inspection activities”.
• An ISO 9001 certificate covers a management system, not the composition of anything it produces or sells.
• A GMP inspection covers a named site and the activities inspected. It does not follow material into supply chains it did not cover.
• None establishes identity, purity or content for your batch. That takes a report carrying your batch number, ideally from a laboratory whose scope covers the test. Our guide on how to spot fake or underdosed peptides covers the ways documentation goes wrong.
• None makes a research reagent suitable for human use. Credentials describe how organizations work, not what a material is for.

What’s established and what isn’t

Using these checks when choosing a Canadian supplier

For a Canadian buyer, the checks collapse into a short routine.

• If a supplier cites ISO 9001, look the certificate up and check which organization and site it covers. A certificate held by another company or site says little about the business you are buying from.
• If it cites a laboratory’s accreditation, ask whether the analysis on your certificate is within that laboratory’s scope, then check the accreditation body’s directory: SCC or CALA in Canada, the national body abroad.
• If it cites GMP, ask which authority inspected which site, for which products and when, and check the regulator’s database.
• Whatever the badges, ask for the report for the batch you will receive and match its batch number to the vial.
• Read the answers as information. A supplier that can answer specifically is telling you something; so is one that cannot.

Our guide to choosing a Canadian peptide supplier turns this into a fuller checklist. We are a supplier ourselves, so apply every one of these checks to us as well.

Research peptides with published test reports

Janoshik test reports for the research peptides below are listed on our Lab Testing page, so you can see which laboratory tested each one and compare its batch number with your vial.

BPC-15715-amino-acid research peptideView product GHK-CuCopper tripeptideView product TB-500Thymosin beta-4 research peptideView product EpithalonLyophilized tetrapeptideView product

Frequently asked questions