ISO/IEC 27566-1 certification: what the audit checks, who it covers and where IEEE 2089.1 fits

ISO/IEC 27566-1 certification is an independent audit of a whole age assurance system. We audit your service against five core characteristics: functionality, privacy, accessibility, security and performance. Then we check whether what you actually do matches what your Age Check Practice Statement (ACPS) promises. Certification is open to age assurance providers, intermediaries, relying parties and hybrid services. Successful applicants receive a Certificate of Conformity and a listing on the ACCS public register.

Most age assurance providers can tell you what their system does. Far fewer can show that it actually does it. An ISO/IEC 27566-1 audit is built to find that gap.

What is ISO/IEC 27566-1?

ISO/IEC 27566-1 (Age Assurance Systems, Part 1: Framework) is an international standard developed through ISO and IEC. It gives a framework for assessing whether an age assurance service is safe, effective, privacy-preserving and interoperable.

It is technology-neutral: document checks, biometric estimation, database lookups or hybrid approaches all qualify if they meet the requirements. And it looks at age assurance as a whole system, online or offline, not a single technology.

The Age Check Practice Statement: your promise

At the centre of ISO/IEC 27566-1 certification is your Age Check Practice Statement (ACPS). This structured document sets out:

• your service’s scope, purpose and role(s)
• your technical architecture and the methods you use to check or estimate age
• your policies for data handling, user rights and consent
• your approach to accessibility, inclusion and user support
• your security and fraud prevention measures.

That’s the promise. The audit checks whether your practice matches it.

What does an ISO/IEC 27566-1 audit check?

The five core characteristics

We audit against five core characteristics:

1. Functionality: does the system assess or verify age at the required assurance level?
2. Privacy: is personal data minimised, protected and used lawfully, with clear user rights?
3. Accessibility: does it work across demographics, abilities and devices?
4. Security: is it resilient to fraud, attacks and misuse?
5. Performance: how do the targets you set compare with the metrics you actually achieve?

How the audit is carried out

The audit has several layers:

• Policy and documentation review: your ACPS, governance and compliance framework.
• Component testing: the effectiveness and accuracy of components such as biometric age estimation or document checks.
• Context-of-use evaluation: real-world performance, including accessibility and user experience.
• Risk and security analysis: vulnerabilities, attack vectors and data protection.

Pass every layer and you receive a Certificate of Conformity, the ACCS certification badge, a listing on the ACCS public register and a detailed audit report.

This isn’t a claim on a slide. It’s evidence that a regulator or procurement team can check.

Who can be certified under ISO/IEC 27566-1?

“Age assurance? That’s our vendor’s job.”

Not under ISO/IEC 27566-1. Certification applies across the whole age assurance ecosystem:

• Age assurance providers: services that verify or estimate age using documents, biometrics or databases.
• Intermediaries: the secure bridge between users, providers and relying parties, so that age proofs can be reused safely across services.
• Relying parties: the platforms, content providers and operators that depend on age assurance to manage access and meet regulation.
• Hybrid services: organisations that take on more than one of these roles.

Why relying parties need to evidence their part

Here’s the uncomfortable part: a certified provider plugged into a poorly governed service is still a poorly governed service. The standard covers the bit you built around the check too.

So the question for relying parties isn’t just “is our vendor certified?” It’s “can we evidence our part?”

Already hold an ACCS certification, such as IEEE 2089.1? Some previous audit evidence can be reused, so you won’t duplicate work (a full ISO/IEC 27566-1 audit is still required).

ISO/IEC 27566-1 vs IEEE 2089.1: which certification do you need?

Your accuracy numbers aren’t your compliance story. They’re one chapter of it.

“IEEE 2089.1 or ISO/IEC 27566-1?” is usually the wrong first question, because the two standards answer different questions.

IEEE 2089.1: technical performance, for a system or a single component

IEEE 2089.1 certification is the technical performance badge, covering accuracy, robustness and fairness. You can certify a full system or a single component, such as a facial age estimation engine or a document checker. Testing takes place through our IEEE-approved laboratory.

ISO/IEC 27566-1: the whole system

ISO/IEC 27566-1 is holistic certification. It audits functionality, privacy, accessibility, security and performance against your Age Check Practice Statement.

The dual pathway

Many providers progress to both: technical credibility plus the global compliance signal regulators increasingly expect.

Neither is “better”. It depends on your readiness, your target markets and whether you need component-level or system-level assurance.

Find your pathway in under two minutes

Take the Certification Pathway Quiz (less than two minutes) to see whether ISO/IEC 27566-1, IEEE 2089.1 or a staged approach suits you. Then use the ISO/IEC 27566-1 Audit Effort Calculator to estimate audit and client effort in days. Both are free.

Ready to evidence your age assurance?

Provider, intermediary or relying party, start by working out what you need to evidence. Read more about ISO/IEC 27566-1 certification, browse our age assurance services or apply for certification.

Email us at sales@accscheme.com to talk through your scope.