"Or equivalent": what EU and UK public buyers must accept

Equivalent certificates from other countries. And other evidence, if the time limit made a certificate impossible for reasons outside your control, and you prove your measures meet the standard. Private buyers have no such duty.

The rules, side by side

What the procurement rules require from the buyer
Duty of the buyer	EU: Directive 2014/24/EU	UK
Refer to certification by accredited bodies	Article 62(1)	PCR 2015 reg. 62(1), for procurements started before 2025-02-24
Accept equivalent certificates from other countries	Article 62(1): bodies in other Member States	PCR 2015 reg. 62(2). Procurement Act 2023 s.22(4)(c): no qualification requirement without equivalents
Accept other evidence if the certificate was impossible in time	Article 62(1): reasons not attributable to you; you prove the measures comply	PCR 2015 reg. 62(3), same wording. Procurement Act 2023 s.56(6): "certification, or other evidence"
Let you rely on another company	Article 63(1)	Procurement Act 2023 s.22(8)-(9): an associated supplier, such as a consortium member or subcontractor

Official texts: Directive 2014/24/EU, PCR 2015 regulation 62, Procurement Act 2023 section 22 and section 56.

When the time-limit rule helps

All 3 conditions must hold:

You could not get the certificate within the time limit.
The reason is not attributable to you. A short tender window helps; a late start of your own work does not.
You prove your measures meet the standard.

Article 62 says "quality assurance standards" and does not name ISO/IEC 27001, so a buyer can argue. Ask in the clarification period, so the answer binds every bidder.

Evidence buyers accept

The Stage 2 report from an accredited certification body, with the recommendation.
An independent audit report against ISO/IEC 27001.
Your Statement of Applicability and the records behind the main controls.
A status letter with the audit dates.

2 Dutch tenders

In 2026, a Dutch regional authority changed "ISO 27001 certificate" to "ISO 27001 certificaat of gelijkwaardig" (or equivalent) after a bidder's question. In 2018, the City of Amsterdam asked for an ISO 27001 certificate or an equivalent, with an audit report that shows the standard is met. Both answers are in published clarification notes.

Questions to send

1. Will you accept evidence of equivalent information security measures instead of an ISO/IEC 27001 certificate, for example the Stage 2 audit report from an accredited certification body together with our Statement of Applicability?
2. Will you accept a certificate from a certification body accredited by another national accreditation body that signs the EA multilateral agreement?
3. May a consortium member or subcontractor that performs the in-scope services meet the ISO/IEC 27001 requirement?
4. On which date must the certificate be valid: at submission, at award or at contract start?

Private customers can insist on a certificate. The same questions often work, because they want assurance, not a document.