Records must prove that every process requirement was met, stay confidential and be kept for at least the current and previous cycle where the scheme re-evaluates.
What applies today
The body must keep records that demonstrate that all certification process requirements, both those in the standard and those in the scheme, have been effectively fulfilled. Records must stay confidential, and must travel, be sent and be handed over in a manner that preserves confidentiality. Where the scheme involves a complete re-evaluation of products within a defined cycle, records must be kept for at least the current and the previous cycle. In other cases the body defines the retention period. The body may take account of legal duties and recognition deals when it sets the period.
Why it matters
Records are how a certification body proves its own process, often years after the people involved have moved on. The clause is not only about storage. It requires the record to show effective fulfilment, which means a complete file, not a collection of signatures. The cycle rule is specific because a re-evaluation scheme needs the previous cycle to understand what changed and what was already checked.
The public FDIS contents lists clause 7.12 as Records. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
This is a process clause. The public record confirms the number and title, and the process as described today is what an assessment uses until publication. A first artefact an assessor commonly asks for here is record list per process step and scheme. The party this touches first is The records owner and every function that creates certification evidence.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Record set | Record list per process step and scheme |
| Retention | Retention schedule with the legal or scheme basis |
| Confidential transit | Rule and example for sending records securely |
| Retrieval test | A complete old certificate file retrieved within the stated time |
| Disposal | Disposal record approved under the schedule |
One common question. ask for the file behind a certificate from the previous cycle. A file that cannot be produced, or that is missing the review, is treated as a process failure.
Common failures
- Records are kept for seven years by habit with no scheme basis
- Files are shared through personal email and cloud links
- The previous cycle was deleted when the new certificate was issued
Prepare before publication
Retrieve one complete file from each scheme and the previous cycle. Note every missing document and restore it if possible.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 7.12 has no separate date.
Cross-references
4.5 Confidentiality · 8.4 Control of records · 7.5 Review · 7.6 Certification decision
Source
Source for 7.12: ISO/IEC 17065:2012, Clause 7.12, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.