You may think, with the UK being a mature economy and safe country, that there are many insurances. But actually, for many small businesses, it’s only employers’ liability insurance that is absolutely mandatory. And even then, that’s only if you’re hiring staff.
This isn’t quite the same as all business certificates though, which are much more industry dependent. If you go without employers’ liability insurance, you might be fined £2,500 for every day it goes uninsured.
Is that a fair picture of the legal side of all business certification? Fortunately, the list is short to find out.
The legal list is short and specific
Commercial property is perhaps where many see the law bite. The minimum energy efficiency standards make it so a landlord can’t grant a new tenancy (on a non-domestic building) rated F or G on its energy performance certificate. E is the floor. It’s somewhat new, since 2018, but long enough that most buildings have now been adapted to adhere to the standards.
Trading Standards enforces it as the penalties grow with time.
10% of rateable value (£5,000 to £50,000) for a property let in breach for under three months.
20% (between £10,000 and £150,000) thereafter.
Misleading info and you can stick another £5,000 on that. A landlord who lets, say, a shop unit rated G for four months is looking at the higher band.
A surprising amount of what you need to trade is actually just permission not a certificate. Food businesses have to register with their local authority 28 days before they start trading or more. That includes food banks and charities, even.
Alcohol needs a premises licence under the Licensing Act 2003. In Romford, there was an example of Meshi Cafe applying for a premises licence from Havering Council to sell alcohol from 10am to 11pm. The application (7 days a week, 13 hours a day) opens a 28-day consultation, and the council weighs it against four licensing objectives. (think, public nuisance, protection of children, and so on). None of that produces a framed certificate for the wall. It still decides whether the cafe can pour a drink.
Buyers write the rest of the rulebook
The customer usually sets the requirement outside the statutory minimums. Think of PPN 09/23, the procurement policy note on Cyber Essentials. Central government departments, executive agencies, non-departmental public bodies and NHS bodies all require suppliers on higher-risk contracts to prove they hold Cyber Essentials or Cyber Essentials Plus (or comparable controls) before the contract is handed. A startup IT supplier bidding for an NHS contract has no statute forcing the badge on it.
It’s groundhog day with the ISO management system standards too actually, like ISO 9001 covering quality and ISO/IEC 27001 covering information security, while ISO 14001 and ISO 22000 deal with environmental management and food safety respectively. None are required by law. A company that wants one ought to expect an audit by a certification body. The certificate records that its management system met that standard.
Something’s afoot with the newer standards, too. ISO/IEC 42001 covers AI management systems, and Zertia, which lists offices from Madrid to Miami, certifies against it alongside ISO 27001, ISO 27701 and ISO 22301. For a firm putting AI into the products it sells, 42001 is the one standard that names the very thing directly. It’s about reputability.
A certificate is only as good as the body behind it
Certification and accreditation are should be viewed slightly differently, even if people colloquially use them interchangeably. A certification body audits the company. UKAS, the UK’s National Accreditation Body, assesses the certification body and describes itself as “the only accreditation body recognised by government” to do so.
You might then think accreditation is blanket. It’s not. A certification body is accredited only for the activities listed on its accreditation schedule. A body accredited for ISO 9001 work isn’t automatically accredited for ISO/IEC 27001.
CQI | IRCA has reported that the UK issues more than 40,000 ISO 9001 certificates a year, and that more than 20,000 certificates are thought to be in circulation from certification bodies without UKAS accreditation. Buyers have rejected certificates again and again that lack the UKAS symbol.
That is to say, a company can pay for the audit, frame the certificate, put the logo on its tender documents. It can still lose the contract. The penalty for the other side of the trade is stern: falsely claiming accreditation has been reported to carry up to two years in prison or a fine under the 2008 misleading marketing regulations.
Checking a body isn’t a call for a consultant per se. Look for accreditation backed by an International Accreditation Forum (IAF) signatory like UKAS in the UK or ANAB in the US. Verification is rapid. Search the relevant accreditation register, confirm the certification body is listed, and check their scope of accreditation for the exact standard.
