You can avoid your service falling off the GOV.UK register of digital identity and attribute services by asking your conformity assessment body (CAB) to complete your recertification process up to 60 days early. You won't lose the remaining time on your current certificate if you do this, and it will help you to avoid any unnecessary disruption.
Certificate life cycles can vary
Every service provider has a slightly different cycle for its certification. That cycle might also change whenever we introduce a new version of the trust framework or supplementary codes, as we might set a fixed expiry date for certificates issued against previous versions.
Our advice in this blog post should therefore be taken as a general rule of thumb – not an absolute timetable. You should speak to your CAB for bespoke advice in relation to your service.
You can roll over 60 days from a previous certificate
You might think that the sensible thing to do is to run down the clock on every certificate so that you recertify at the last possible moment; but you shouldn’t do that! That approach will almost certainly lead to gaps in your certification.
The rules in our certification scheme have been deliberately designed to avoid those gaps.
Every time you get a service recertified, you can roll over 60 days from the end of your existing certificate onto your new certificate. You don’t lose time on your certificate by recertifying a little early.
As an illustrative example:
Your service was certified on 1 April 2026 and is due to expire on 31 March 2029.
You get recertified on 30 January 2029; 60 days before your previous certificate would expire.
Your next certificate will be for 3 years, plus the 60 days roll over; so your certificate will expire on 31 March 2032.
Leaving certification too late might mean your service is not registered
The other reason to recertify ahead of your existing certificate expiry is so that it remains published on the GOV.UK register of digital identity and attribute services.
Maintaining your registration will become increasingly important as digital identity services become more widely adopted. Services can only appear on the register if they are certified. The Data (Use and Access) Act 2025 requires that any service that is no longer certified is removed from the register.
If your service is not on the register in future, you won’t be providing compliant services in certain regulated environments and you won’t be able to connect to the GOV.UK Wallet.
Registration and certification are not the same thing. Certification is a pre-requisite but service providers must apply separately if they want to appear on the register. Whilst it’s often very quick, applications can take a little while to process (we’ve explained what happens when you apply to join the register in a separate post). Our general advice is that it can take up to 20 working days for an application to complete.
Aiming to complete your recertification 60 calendar days in advance of your existing certificate expiry will ensure that we at OfDIA have plenty of time to process any application to remain on the register and help to avoid your service temporarily being removed.
Book your recertification evaluations early
There are no downsides to recertifying slightly early. Doing so will help your organisation to ensure there are no gaps in your certification and that your services stay on the register.
Our advice is to engage your CAB early and book your recertification process in as soon as possible. Aim to complete your recertification 60 days in advance of your existing certificate expiry; your CAB will advise on how best to make all this work in practice.
Leave a comment