When are the surveillance audits due, and when does the certificate expire?
The certificate runs 3 years from the certification decision, minus 1 day. Surveillance comes within 12 months, then once a calendar year. Recertification comes a few months before expiry.
Next: First surveillance audit
by 4 Nov 2027
365 days left
The certificate expires on 3 Nov 2029.
Put these audits in your calendar
- A calendar file (.ics) with the 4 dates.
- A reminder 30-60 days before each one.
- An email if a cycle rule changes.
Your 3-year cycle
| Event | Date | Rule |
|---|---|---|
| First surveillance audit | by 4 Nov 2027 | No later than 12 months after the decision. |
| Second surveillance audit | during 2028 | At least once per calendar year. Target about 4 Nov 2028. |
| Recertification audit | 6 Jul 2029 – 5 Aug 2029 | 90-120 days before expiry, so the decision comes before expiry. |
| Certificate expires | 3 Nov 2029 | 3 years after the decision, minus 1 day. |
| Last day to restore after expiry | 3 May 2030 | Only if the open recertification work is finished. After that, a new Stage 2. |
If you miss a date
| Rule | If you miss it |
|---|---|
| The cycle starts on the certification decision and ends 3 years later, minus 1 day. | The certificate expires unless the recertification decision comes first. |
| The first surveillance audit takes place no later than 12 months after the certification decision. | The certificate can be suspended. |
| Later surveillance audits take place at least once per calendar year. | The certificate can be suspended. |
| One body plans the recertification audit 90-120 days before the expiry date. | A late recertification audit can leave a gap between the old and the new certificate. |
| After expiry, the body can restore the certificate within 6 months if the open recertification work is finished. | After 6 months, at least a new Stage 2 is needed. |
A suspended certificate can break a contract that requires it for its full term.
2013 certificates and transfers
Certificates to ISO/IEC 27001:2013 ended with the transition period on 2025-10-31. A 2013 certificate is no longer valid. The holder starts again as a new client.
A transfer to another body keeps your expiry date. Bodies accept only accredited, unsuspended certificates. Transfer between surveillance audits, not just before one.