Who Certifies Functional Safety Equipment, and Who Accepts It

Last updated July 5, 2026

Engineering runs on a mix of organizations, certificates, and marks. Who does what, when, and which document proves it is rarely obvious. A Safety Integrity Level (SIL) certificate sitting on an instrument datasheet is the everyday version of that question: who confirms the rating is real, and who on your site has to accept it? The certificate is a global document tied to the part type, while the manufacturer’s own Declaration of Conformity rides along in the part’s paperwork. The certification body that issues the certificate sits inside a chain that runs up through an accreditation body to a single global body at the top, and that chain is separate from the regulatory authority that decides whether your installation is legal. It is easiest to untangle from the narrow end, the certificate in your hand, and work up.

The manufacturer and its own documents

The manufacturer designs and builds the device, so it is where the paperwork chain starts, but it cannot independently certify its own product. What it can do is issue its own documents. The SIL Declaration of Conformity is the manufacturer’s own statement that the device conforms. The Product Safety Manual carries the constraints you have to honor in service: the proof test, the proof test interval (TI), and the useful life. Both usually arrive with the physical item, in the box or the shipping package. And both are self-issued by the party with an interest in selling the device, which is exactly why the rating that carries real weight has to come from somewhere independent.

The certification body that issues the certificate

A certification body (CB) is the independent organization a manufacturer hires to assess the device against IEC 61508 and issue the SIL certificate. That certificate is the independent artifact: it states the device meets IEC 61508 to a stated SIL or systematic capability (SC), and it carries the failure-rate data and assumptions that later feed a probability of failure on demand (PFDavg) calculation. It generally covers a product group or family rather than an individual unit by serial number, so it applies to the model, not the specific item in your hand. Names you will see include TÜV Rheinland, Exida, and UL. None of this is legal permission to sell or install anything. A SIL certificate is third-party evidence that the device is capable, sought to satisfy customers and specifications rather than because any law demands it.

What a certification body checks

The CB performs or reviews the failure modes, effects and diagnostic analysis (FMEDA), the systematic-capability case, and the failure-rate numbers, then issues the certificate to a stated SIL or SC for a defined instrument and its safe-state assumptions. It also assesses the manufacturer’s functional safety management system and re-audits it on a cycle, so the certificate reflects an ongoing capability rather than a one-time test. How much of this applies depends on the route taken and the part’s history: a device with real field history can go a proven-in-use route, while a clean-sheet design gets the full assessment.

Why one certifier’s certificate is trusted

A certificate is only as good as the body that signed it, and a body earns that standing by being accredited. An unaccredited certificate is a logo with no chain behind it. The body that grants that standing is the accreditation body.

The accreditation body behind the certifier

An accreditation body (AB) does not certify products. It assesses and authorizes the certification bodies themselves, confirming they are competent to certify against standards like IEC 61508. The ABs work to ISO/IEC 17011 while the CBs work to ISO/IEC 17065, and the same certification body is often accredited by more than one.

Regional accreditation bodies

Accreditation bodies are regional. ANAB is the dominant one in the United States, DAkkS the largest in Europe, with UKAS in the United Kingdom and the Standards Council of Canada (SCC) in Canada, plus COFRAC, ENAC, INAB, SWEDAC, and DANAK across other European countries. The Middle East generally leans on US and European bodies. Which one sits behind a given certificate is usually a matter of market, tradition, or law rather than any technical difference.

What accreditation proves and what it does not

Accreditation confirms the certifier is competent and consistent. It does not confirm that any single certified device is the right choice for your application. That judgment stays with you, at selection and during verification.

Global ACI at the top of the chain

One tier sits above the accreditation bodies: the Global Accreditation Cooperation Incorporated, which operates as Global ACI and began on 1 January 2026, after the former IAF (which covered certification) and ILAC (testing, calibration, and inspection) merged into it. Global ACI does not accredit certification bodies directly. It runs the mutual-recognition arrangements among the accreditation bodies and peer-evaluates them, which is what lets a SIL certificate from an accredited body in one country be honored in another. It is the cap on the chain that ultimately stands behind the rating on the datasheet.

The United States product-listing route: the NRTL

A Nationally Recognized Testing Laboratory (NRTL) is a lab that the US Occupational Safety and Health Administration (OSHA) recognizes to test and list products against US safety standards. UL, FM, and Intertek are examples. The listing is usually to the specific product-family standard that applies, a dedicated standard for molded-case circuit breakers, say, rather than to one generic safety standard. This is product-level conformity work that sits alongside the certification body, but it covers product and electrical safety, not functional safety. An NRTL-listed device is not SIL-certified by virtue of that listing, and the two say nothing about each other.

UL listing versus the NRTL category

“UL listed” gets used as if it meant “NRTL listed,” but UL is one NRTL among several, not the category itself. UL also writes standards, which doubles the confusion: another lab such as Intertek can certify a product to a UL standard, so “to a UL standard” does not mean “by the company that is UL.” The clean way to say it is that a part is certified to a particular standard by a lab on the NRTL program, and that is the “listed” running through US codes like the National Electrical Code (NEC).

CE marking and market access in Europe

CE marking is the manufacturer’s self-declaration that a product meets every European Union directive that applies to it, backed by a technical file and a signed EU Declaration of Conformity, which lets it move freely across the European Economic Area (EEA). For low-risk products the manufacturer self-assesses; for higher-risk safety equipment under the Machinery Directive or ATEX, a Notified Body has to assess conformity before the mark goes on. But CE marking is about legal access to the EU market, not IEC 61508. A device can be SIL-certified and CE-marked independently, and neither one implies the other.

A near-identical mark, with the two letters set closer together and often called the “China Export” mark, turns up on some imported products; it is easy to mistake for the CE mark but carries no EU conformity meaning.

UKCA and Great Britain

UKCA, the UK Conformity Assessed marking, is the Great Britain counterpart, handled by UK approved bodies accredited by UKAS. As of 2026, Great Britain accepts CE marking indefinitely for most goods, so UKCA is available rather than a hard switchover for general products. Medical devices, construction products, and marine equipment are the live exceptions, and Northern Ireland still follows the EU and CE route.

The accepting authority, region by region

The chain so far tells you a device is capable. A different set of bodies decides whether your specific installation is legal and acceptable, and which body that is depends on where in the world you are. The four cases below are the common ones; the same pattern repeats elsewhere with local marks and authorities, such as the RCM mark in Australia.

Europe: the Notified Body

A Notified Body (NB) is designated by an EU member state to carry out the conformity assessment a directive requires before a product or installation can legally wear the CE mark. On a European project it gets embedded enough that, to the working engineers, it can feel like a member of the project: reviewing and approving specific deliverables, paid by the project, operating at the level of regulatory compliance rather than SIL determination. TÜV Rheinland, for instance, acts as a Notified Body under the Pressure Equipment Directive.

The United States: the authority having jurisdiction (AHJ)

The AHJ enforces the locally adopted codes and accepts the installation. In the US it is often a city or county authority, and occasionally OSHA. It is rarely as involved as a European Notified Body, and it leans on product listings and certificates as evidence rather than producing any of its own. Its functional safety knowledge varies a lot by region: an AHJ somewhere with little oil and gas may know little or nothing about functional safety, while in the refinery-heavy southern states such as Texas, Louisiana, and Mississippi the AHJ is often very fluent in it.

The United Kingdom

For a major-hazard process site, the regulator is the Control of Major Accident Hazards (COMAH) Competent Authority, the Health and Safety Executive (HSE) acting jointly with the relevant environment agency. Unlike a variable US AHJ, this regulator is fluent in functional safety; HSE and CDOIF guidance is built directly on IEC 61508 and IEC 61511. Product conformity runs through UK approved bodies accredited by UKAS, under the UKCA route above.

Canada

In Canada, electrical equipment has to be certified by an SCC-accredited certification body and carry a recognized Canadian mark, with SCC as the national accreditation body. Enforcement is provincial: electrical safety authorities act as the AHJ and look for an SCC-accredited mark rather than a particular brand. The Canadian “c” tells the story. A cUL or cCSAus mark covers Canada, while a US-only UL mark without the c, or a CE mark on its own, does not.

The Ex explosion protection mark used on ATEX-certified equipment

Hazardous areas and the second certification stream

Process functional safety often involves flammable or explosive gases, vapors, and liquids, so the instruments and valves running a safety function frequently sit in a hazardous area and need a second, separate certification for explosion protection. IECEx is the global scheme for that, ATEX is its EU directive counterpart, and North America runs its own route through the NEC and NRTL listings. A field instrument therefore commonly carries two certifications at once: a SIL certificate for its functional safety, and an Ex certificate for the area it lives in.

Behind the Ex certificate sits its own series of standards: internationally that is mainly the IEC 60079 series for explosive atmospheres, with a separate set used in the United States, not covered here. Hazardous-area compliance runs on its own standards and its own paperwork, parallel to the functional safety chain rather than part of it.

Conformity assessment and the conformity assessment body

Everything above is a form of conformity assessment, the umbrella term for showing that a product or system meets a standard through testing, inspection, and certification. Functional safety certification to IEC 61508 is one corner of it.

A conformity assessment body (CAB) is the catch-all name for any organization doing that testing or certifying, so the certification body, the NRTL, and the Ex certification body (ExCB) are all conformity assessment bodies. The accreditation bodies and Global ACI sit above them all, vouching for the assessors rather than assessing products.

Common mistakes

The functional safety team designs the safety functions, a different team rates the hazardous areas, and the two never compare notes. The instrument then shows up without the hazardous-area rating it needed, or wearing an expensive Ex rating it never did.
Reading a device’s SIL certificate as the SIL of the whole loop. A SIL-certified instrument does not make your safety instrumented function (SIF) that SIL. Element capability is one input, and the SIF’s actual SIL comes from its architecture, its PFDavg, and its proof testing.
Treating a CE mark as proof a device is SIL-certified. It says nothing about functional safety.
Taking a China Export mark, the kind with the letters spaced tighter, as a genuine CE mark.
Assuming an NRTL or UL listing covers functional safety, when it covers product and electrical safety.
Accepting a vendor certificate at face value with no accreditation body anywhere behind it.

Summary of bodies and documents

Bodies and organizations

Manufacturer: makes the device and self-declares conformity.
Certification body (CB): independent issuer of the SIL certificate against IEC 61508 (TÜV, Exida, UL, CSA Group).
Accreditation body (AB): authorizes and oversees the certification bodies; regional (ANAB, UKAS, DAkkS, SCC).
Global ACI: single international body over the accreditation bodies, running mutual recognition.
NRTL: OSHA-recognized US lab that tests and lists products for product and electrical safety.
Notified Body (NB): EU-designated body for the conformity assessment behind CE marking, often project-embedded; the UK equivalent is the UK approved body.
Authority having jurisdiction (AHJ): the authority that accepts the installation, local city or county in the US, provincial in Canada, and the COMAH Competent Authority (HSE) for UK major-hazard sites.
ExCB: certification body that issues Ex certificates under IECEx.

Documents in play

SIL certificate: third-party evidence a device meets IEC 61508 to a stated SIL or SC.
SIL Declaration of Conformity: the manufacturer’s own conformity statement.
Product Safety Manual: the manufacturer’s constraints on proof test, TI, and useful life.
EU Declaration of Conformity: the manufacturer’s signed declaration behind a CE mark.
North American listing mark: an NRTL, UL, or Canadian SCC-accredited mark (CSA, cUL, cETL) for product and electrical safety.
Ex certificate: IECEx or ATEX evidence for use in a hazardous area.

Frequently Asked Questions

A supplier sent a SIL certificate with a logo I don’t recognize. How do I tell whether it actually means anything?

Start with whether there’s an accreditation body behind it. A real SIL certificate from a real CB carries the mark of the accreditation body that backs that CB, ANAB, UKAS, DAkkS, and the like, and you can look the CB up with that body. If you cannot find any accreditation behind the logo, treat the certificate as the vendor’s claim, not independent evidence. The logo on its own proves nothing; the chain behind it is the whole point.

The vendor only gave me a Declaration of Conformity, not a third-party certificate. Is that enough to justify the device in my SIF?

Assuming the vendor isn’t being unethical, it’s likely that something just got twisted up somewhere. If a SIL Declaration of Conformity exists, the device is probably SIL certified and there’s a SIL certificate out there; you may simply not have a copy of it. So ask the manufacturer for it, and check their website, since most of them post their certificates. As a last-ditch effort, go to the certification bodies common in your industry and search their databases. The declaration on its own isn’t the independent certificate you want behind a SIF, but its existence usually means the real one isn’t far away.

I’m the design manager for a pressure instrument that’s been in the field for decades, and I want a SIL certificate to widen its market. What’s my first step?

Get help early, because this gets tricky fast, and it’s the kind of work we do at SIL Safe. But the real first move is opening a relationship with a certification body, because the CB is who you ultimately have to prove the requirements to. Your decades of field history are an asset here; they may open a proven-in-use route rather than a full clean-sheet assessment. The CB will tell you which evidence they need, and that shapes everything you do next.

An AHJ told me this breaker can’t be used because it has no UL logo. Is that right?

Assuming this is in the United States, most likely you can still use it. What the code calls for is a listing by an NRTL, and UL is only one lab on that program. If your breaker is listed by FM or Intertek, often to a UL standard at that, it meets the same requirement. It’s a common mix-up, since “UL” and “listed” get treated as the same thing. Show the AHJ the NRTL listing mark and the standard it was tested to, and you’re usually on solid ground.

It is possible this breaker came via a bizarre procurement path, such as for maritime or overseas. In that case, the AHJ may be right.

I need a solenoid valve for an automated final element in a Zone 2 area at SIL 2, for a site in the UK. What do I actually need to line up?

Three things, and they’re separate. For the SIL 2 part, you want a valve with a SIL certificate showing it’s fit for SIL 2, or a prior-use case, and you verify it in the context of the whole SIF, not just the valve on its own. For Zone 2, you need the explosion-protection certification for that area, an ATEX or IECEx Ex certificate, which is a different document from the SIL certificate. And for the UK, you’re under the COMAH Competent Authority rather than a US-style AHJ, so expect a regulator that knows functional safety well, and confirm the conformity marking works for the Great Britain market. None of the three substitutes for the others.

Search site