A customer emails your quality team: "Please send the Certificate of Conformity for this shipment before we release payment." For many manufacturers, that single request sets off hours of searching through folders, chasing suppliers, and rebuilding documentation that should already be on hand.

A Certificate of Conformity (CoC) is a supplier-issued statement confirming that a delivered product, batch, or lot meets the specified requirements agreed with the customer. Responding to these requests quickly and accurately is now a core part of winning and keeping enterprise accounts, passing customer audits, and avoiding shipment holds.

This guide explains exactly what a Certificate of Conformity confirms, what a valid one must contain, how to respond to a customer request step by step, and how to keep every certificate audit-ready as volume grows. For foundational definitions, Certivo's Certificate of Conformance complete guide is a useful companion resource.

If customer CoC requests are creating bottlenecks, you can book a compliance risk assessment to see where your documentation gaps sit across products and suppliers.

Key Takeaways

📄 A Certificate of Conformity attests that a specific product or batch meets the customer's specified requirements, drawings, standards, or applicable regulations.

⚠️ A CoC is not the same as an EU or UK Declaration of Conformity, a Certificate of Analysis, or a mill test report, and confusing them creates audit exposure.

📌 A valid CoC must identify the issuer, the product, the batch or order reference, the requirements met, and an authorized signatory.

🔗 Many customer CoC requests actually ask for framework-specific statements such as RoHS, REACH, country of origin, or conflict minerals conformity.

🤖 AI-native compliance automation lets teams generate accurate, evidence-backed certificates on demand instead of rebuilding them manually.

What a Certificate of Conformity Actually Confirms

A Certificate of Conformity is a declaration by the responsible party, usually the manufacturer or supplier, that an object meets stated requirements. The international basis for this type of statement is ISO/IEC 17050-1, which sets general requirements for a supplier's declaration of conformity across any sector.

Under that standard, the object of a declaration can be a product, process, management system, person, or body. In manufacturing, the object is almost always a product, part, sub-assembly, or shipped batch, and the "specified requirements" are the customer purchase order, drawing revision, industry standard, or regulation that applies.

Because the term is used loosely, the first task in any response is identifying what the customer is really asking for. Clarifying scope early prevents reissued certificates and protects your audit readiness across frameworks.

Certificate of Conformity vs Declaration of Conformity

These two documents are frequently confused, but they are not interchangeable. A Declaration of Conformity (DoC) is a specific, legally defined regulatory document. In the EU, the manufacturer draws up an EU Declaration of Conformity as part of CE marking, stating which EU harmonisation legislation the product meets. In Great Britain, the equivalent sits under UKCA marking.

An EU Declaration of Conformity is typically retained for at least 10 years under most product directives and is tied to a technical file. A general Certificate of Conformity, by contrast, is a broader commercial and quality document that can cover a shipment or batch against a customer specification, with or without a regulatory marking in scope.

Certificate of Conformity vs Certificate of Analysis and Mill Test Reports

Customers in chemicals, metals, and food-contact sectors sometimes use "CoC" when they mean a test-based record. A Certificate of Analysis (CoA) reports measured values from testing a specific lot. A mill test report, often an EN 10204 3.1 certificate, documents the chemical and mechanical properties of a metal product. If a customer expects measured data and you send a conformity statement, the request stays open. Certivo's guide on how to read a mill test report explains that distinction in detail.

Certificate of Conformity compared with declaration of conformity and test reports

Click on image to view full

Why Customers Request a Certificate of Conformity

Understanding the driver behind the request helps you respond with the right evidence the first time. Common triggers include:

• 📌 Incoming inspection and goods receipt. Many OEM and Tier 1 quality systems require a CoC before accepting a delivery into stock.

• ⚠️ Customer and certification audits. Buyers verify that their suppliers can produce conformity evidence on demand during supplier audits and ISO 9001 or IATF 16949 assessments.

• 🏭 Regulated and safety-critical sectors. Aerospace, automotive, medical devices, and electronics buyers treat conformity documentation as a release condition.

• 🔗 Contractual and payment terms. Some contracts tie payment or shipment release directly to receipt of a valid certificate.

Enterprise buyers increasingly expect fast, consistent responses. Treating CoC fulfilment as a repeatable workflow rather than a scramble supports your ability to respond faster to customer RFQs and strengthens the commercial relationship.

What Information a Valid Certificate of Conformity Must Include

A certificate that omits key fields invites rejection or follow-up questions. While formats vary by industry and customer, a defensible CoC built on ISO/IEC 17050-1 principles should contain the elements below.

Linking each certificate to its underlying evidence is what turns a simple statement into defensible proof. This is where BOM-level compliance tracking becomes valuable, because conformity at the product level depends on substance and material data at the component level.

How to Respond to a Customer CoC Request: Step by Step

A consistent process reduces errors, speeds turnaround, and protects you during audits. The following five-step workflow applies to most manufacturing environments.

Step 1: Clarify the scope of the request

Confirm whether the customer wants a general CoC, a regulatory Declaration of Conformity, a test-based certificate, or a framework-specific statement. Identify the product, revision, and batch or order number in scope. One clarifying question here prevents a reissued certificate later.

Step 2: Confirm the applicable requirements

Determine which specification, drawing revision, standard, or regulation the product must meet. For products sold into regulated markets, this may include RoHS or REACH obligations that the customer expects the certificate to reference.

Step 3: Gather the supporting evidence

Collect the inspection records, test reports, and supplier declarations that substantiate the conformity statement. If component-level evidence comes from your supply base, this step often depends on supplier and contractor management processes that keep declarations current and retrievable.

Step 4: Issue the certificate

Populate the certificate with the fields above, confirm the correct requirements are cited, and have an authorized signatory approve it. Accuracy in the "requirements met" field is critical, because an overstated certificate creates liability.

Step 5: Retain and version the record

Store the issued certificate with a time stamp, link it to the batch and evidence, and retain it for the period your contracts and regulations require. Reliable retention is the foundation of product safety and certification evidence during later audits.

Five-step workflow to respond to a customer Certificate of Conformity request

Click on image to view full

Common CoC Request Scenarios and How to Handle Them

Many customer requests labeled "CoC" are really requests for a specific conformity statement. Recognizing the pattern lets you respond with the correct document.

Enterprise customers often combine several of these in one request. Managing them under a single system of record, rather than separate spreadsheets, is central to meeting customer and industry requirements consistently across accounts.

Keeping Certificate of Conformity Documentation Audit-Ready

Responding to one request is a task. Being able to respond to any request, for any batch, at any time, is a capability. Audit readiness is fundamentally a data and evidence problem, and it spans three audit types:

• Internal audits test whether your own quality system retains conformity evidence.

• Customer audits verify that you can produce a certificate and its supporting records on demand.

• Regulatory inspections and market surveillance may require you to demonstrate that marketed products meet applicable requirements.

Strong audit readiness depends on time-stamped declarations, historic state tracking, clear evidence ownership, and an intact chain from finished product back to component data. Teams that streamline supplier documentation reduce the time spent reconstructing evidence when a customer or auditor asks for it. No software makes a company "audit-proof," but centralizing evidence materially reduces surprises and response time.

Mistakes to Avoid When Issuing a Certificate of Conformity

⚠️ Overstating conformity. Only cite requirements you can substantiate with evidence.

⚠️ Confusing document types. Sending a CoC when the customer needs a DoC, CoA, or test report leaves the request unresolved.

📄 Missing traceability fields. Omitting the batch, PO, or revision makes the certificate unverifiable.

📌 Stale supplier data. Relying on expired supplier declarations undermines the certificate.

🔗 No retention policy. Failing to retain and version certificates creates gaps during later audits.

How Certivo Helps Manufacturers Respond to CoC Requests Faster

Manual certificate fulfilment does not scale. As product lines, suppliers, and regulated markets multiply, the time to produce accurate, evidence-backed certificates grows with them.

Certivo serves as a centralized compliance data backbone that links finished products to their component, substance, and supplier evidence. Its AI engine, CORA, provides regulatory intelligence and AI document parsing that extracts and validates data from supplier certificates, test reports, and declarations, reducing manual review. With CORA-driven compliance intelligence connecting BOM-level material mapping to customer-facing requirements, compliance and quality teams can retrieve the right evidence and respond to a CoC request in a fraction of the time.

The result is a shift from reactive, request-by-request scrambling toward continuous, audit-ready documentation. You can explore the Certivo platform to see how automated supplier data collection and certificate validation support faster, more reliable responses.

To understand where your current CoC and documentation gaps sit across products, suppliers, and jurisdictions, book a compliance risk assessment with a Certivo compliance specialist.