ISO 9001, AS9100, and ISO 13485 registrars, formally called certification bodies, are private organizations with only contractual authority. A registrar can write a nonconformance or suspend your certificate, but it cannot fine your company, close your facility, or decide whether you comply with the law. That power belongs to government regulators such as the FDA, and their authority comes directly from Congress. Understanding the difference between a registrar and a regulator tells you who you actually answer to, and for what.

The Real Role of Standards Organizations

Standards organizations, such as the International Organization for Standardization (ISO) and SAE International, write voluntary requirements. These are non-governmental membership bodies. They do not pass legislation or employ federal inspectors. And they certainly cannot enforce laws or regulations.

When ISO publishes ISO 9001, for example, it offers a consensus model for business processes. Your company chooses to adopt it for several direct business reasons:

• A customer requires certification as a condition in a commercial contract.
• Senior leadership wants a structured framework to control process variation.
• Your sales team needs an industry-recognized mark to enter specific supply chains.

If your company drops its ISO 9001 certification tomorrow, no federal marshal steps in to lock the front gates. Instead, you simply lose the certificate, along with any commercial accounts that require it.

What Makes a Regulatory Body Different

Under U.S. federal administrative frameworks (e.g., Executive Order 12866, Paperwork Reduction Act, and Administrative Conference of the United States guidelines), a federal regulatory agency or regulatory body is generally defined as an executive department, independent administrative council, commission, or authority established by Congress that possesses statutory authorization to:

• Promulgate binding rules and regulations published in the Code of Federal Regulations (CFR).

• Adjudicate compliance or enforce administrative sanctions. (Sources: 5 U.S.C. § 601, 44 U.S.C. § 3502, Executive Order 12866)

Therefore, a regulatory agency derives its power directly from statutory law passed by a legislature. Specifically, in the United States, agencies like the Federal Aviation Administration (FAA), the Food and Drug Administration (FDA), and the Occupational Safety and Health Administration (OSHA) operate under Title 14, Title 21, and Title 29 of the Code of Federal Regulations.

These government authorities possess legal tools that private standard organizations lack:

1. They perform unannounced statutory inspections.
2. They issue binding administrative citations and civil penalties.
3. They mandate product recalls and issue stop-work orders.
4. They pull regulatory operating certificates, stopping commercial activity entirely.

You cannot negotiate your way out of federal law by opting out. Compliance is mandatory because you operate within a sovereign jurisdiction.

Where the Lines Blur in Practice

Confusion often occurs when government agencies incorporate voluntary consensus standards directly into public law.

Under federal policies like OMB Circular A-119, government agencies must use private technical standards instead of writing unique government specifications whenever practical.

Consider medical device manufacturing. The FDA sets statutory requirements under 21 CFR Part 820. Meanwhile, the international medical device sector operates under ISO 13485. To eliminate duplicate record-keeping for manufacturers, the FDA updated its rules through the Quality Management System Regulation (QMSR) final rule to align its statutory requirements with ISO 13485.

As a result, that harmonization changes the practical dynamic, but it does not change who holds real power. Granted, the standard itself remains a voluntary document published by a non-governmental body. However, when the FDA incorporates those specific clauses into the Federal Register, those referenced requirements gain the force of law.

Who Holds Enforcement Authority?

This raises a critical question: when a standard is adopted into law, who actually holds jurisdiction to enforce it?

The answer is absolute: only the regulatory body holds legal enforcement authority.

• The Government Regulator (e.g., FDA, FAA, OSHA): Holds sovereign jurisdiction granted by Congress. Federal investigators possess statutory authority to issue Form FDA 483 observations, serve Warning Letters, execute civil seizures, impose criminal fines, or issue federal court injunctions to halt manufacturing. Their jurisdiction covers compliance with the law.
• The Certification Body Auditor (Registrar): Holds zero legal or regulatory jurisdiction. An ISO 9001, AS9100, or ISO 13485 auditor is a commercial contractor evaluating a company against a private standard under a voluntary service contract. Their highest penalty is issuing an audit nonconformance or withholding a paper certificate. They cannot issue legal citations, close your doors, or fine your business. Furthermore, under ISO/IEC 17021-1:2015, Clause 8.4.5, any information a registrar receives about a client from external parties—such as regulators or complainants—must be treated as strictly confidential under the certification body’s policy, reinforcing their role as a private evaluator rather than a public reporting agency.

Core Distinctions

Can an Auditor Determine Legal Compliance?

To be clear, an ISO 9001, AS9100, or ISO 13485 registrar auditor does not have the authority to make a formal determination of compliance with a statutory or regulatory requirement.

Management system standards require your organization to identify and fulfill applicable statutory and regulatory requirements within the scope of your QMS. Because of this, an auditor evaluates whether you have a functioning process to identify and follow those rules.

If an auditor finds a gap where a product or service fails to meet a legal requirement, they write a QMS nonconformance against the relevant clause of the standard (such as ISO 9001:2026 Clause 8.2.2a).

In that moment, the auditor is reporting a contractual gap in your management system, not filing a law enforcement action. They are evaluating your system’s ability to fulfill its own commitments.

Official legal compliance remains strictly between your company and the government agency holding statutory jurisdiction. Treat your regulators as the statutory authority they are, and manage your QMS standards as the commercial tools they were built to be.

Frequently Asked Questions

Is ISO 9001 certification required by law?
No. ISO 9001, AS9100, ISO 13485, and IATF 16949 are voluntary consensus standards. No federal statute requires your company to hold a QMS certification. In practice, the requirement usually comes from your customers. An aerospace prime may require AS9100 in its purchase orders, or a medical device OEM may require ISO 13485 of its suppliers. That is a contractual obligation, not a legal one. Where a regulator has incorporated a standard into its rules, such as FDA’s Quality Management System Regulation (QMSR) incorporating ISO 13485 by reference, you must meet the regulation. Even then, the FDA does not require ISO 13485 certification.

Can an ISO registrar shut down my facility?
No. A registrar has no authority to fine your company, close your facility, stop your shipments, or revoke an operating license. Its most serious action is to suspend or withdraw your certificate. To be clear, that can still carry real commercial consequences. If your customers require certification, losing it can cost you contracts. But that is a business consequence of a private agreement, not an enforcement action by the government.

What is the difference between a registrar and a certification body?
There is no difference. They are the same organization. “Registrar” is an older term, still common in the United States. “Certification body” (CB) is the formal term used in ISO/IEC 17021-1, the standard that governs how these organizations operate. Certification bodies (CBs) are themselves accredited by accreditation bodies (ABs), such as ANAB, IAS (International Accreditation Service) & UAF (United Accreditation Foundation) in the United States, which confirm that the CB audits competently and impartially. Neither the CB nor its accreditation body is a government regulator.

Who enforces 21 CFR Part 820 and the QMSR?
The U.S. Food and Drug Administration. Its authority comes from Congress through the Federal Food, Drug, and Cosmetic Act. FDA investigators can inspect your facility, issue Form FDA 483 observations, serve Warning Letters, and pursue seizures, injunctions, and civil or criminal penalties. Your ISO 13485 registrar has no role in that process. Holding an ISO 13485 certificate does not exempt your company from FDA inspection or substitute for compliance with the regulation.

Can a QMS registrar auditor determine whether my company is legally compliant?
No. A QMS registrar auditor evaluates whether your quality management system conforms to the standard you are certified to. When the auditor finds a gap, the finding is a QMS nonconformance, not a legal violation. Only the government agency with statutory jurisdiction over your products or operations can make a formal determination of regulatory compliance. That relationship remains strict between your company and the regulator.

Sources

Federal Regulatory Definitions & Authority

• Administrative Procedure Act: 5 U.S.C. § 551(1) — Defines the legal criteria and scope of a sovereign Federal Agency under United States Administrative Law.
• Code of Federal Regulations: 14 CFR (Federal Aviation Administration), 21 CFR (Food and Drug Administration), and 29 CFR (Occupational Safety and Health Administration) — Establishes the statutory, non-optional legal requirements governing industrial and commercial operations.

Incorporation of Voluntary Standards by Government Agencies

• National Technology Transfer and Advancement Act of 1995 (NTTAA): Public Law 104-113 — Directs federal regulatory bodies to use voluntary consensus standards developed by private bodies in lieu of creating unique government regulations whenever practical.
• Office of Management and Budget (OMB): Circular A-119, “Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities” — Outlines how federal agencies adopt private technical standards into public policy while maintaining sovereign regulatory authority.
• Food and Drug Administration (FDA): Quality System Regulation Advisory; 21 CFR Part 820 / Quality Management System Regulation (QMSR) Final Rule — Illustrates how a regulatory body incorporates voluntary ISO 13485 concepts directly into statutory federal law.

Structure of Voluntary Standards & Conformity Assessment

• International Organization for Standardization (ISO): “ISO Structure and Governance“ — Confirms ISO’s status as an independent, non-governmental international organisation with no legal authority to enforce compliance or issue statutory penalties.
• ISO/IEC 17021-1: “Conformity assessment — Requirements for bodies providing audit and certification of management systems“ — Defines the commercial, contractual, and non-regulatory scope under which Certification Bodies (Registrars) operate.