What a certificate is
A third-party product certificate records that a certification body has assessed a product against the requirements of a scheme, usually combining an assessment of the evidence with surveillance of factory production control.
Certification is voluntary in the sense that no general law compels it for internal fire doorsets, and effectively mandatory in the sense that most of the UK market asks for it. Both things are true at once, and it is worth being clear which one you are relying on when you answer a customer.
The certificate number is the least interesting part
What matters is the scope: which products, which constructions, which sizes, which hardware, which configurations are actually listed. Scope is usually carried in a schedule that is longer than the certificate and updated more often. A certificate whose scope schedule has not been reconciled against your current product range is a document, not a control.
Then dates. A certificate has an issue date and an expiry or renewal date, and the products under it have their own listing dates. Surveillance can suspend or withdraw a listing between renewals.
The failure modes
A product is quietly re-specified — a different core supplier, a different hinge — and the certified configuration no longer matches what is being made. A certificate lapses and nobody notices because the PDF still sits in the same folder. A claim made in a datasheet is broader than the certified scope. A certificate is cited in a tender for a product that was never listed under it.
Each of these is discoverable in seconds if certificates are records with scope and dates, linked to the claims that rely on them. None of them is discoverable by looking at a folder.
How to keep it under control
Record each certificate as evidence with its issuer, reference, issue date, expiry date and review date. Record its scope explicitly rather than relying on the attached PDF. Link it to the specific claims and configurations that depend on it. Set review dates ahead of expiry, not on it.
When a certificate is withdrawn or its scope narrows, the claims that relied on it need technical review. That is a status you can act on. It is not a statement that anything is unlawful, and a record should not pretend to be one.