Certificate & quality document verification (material certificates, CoC)

Every delivery of steel, castings, fasteners, pressure parts or building products comes with certificates that prove what the material is. Quality staff still read each PDF by hand, compare numbers with the order and the standard, and type the heat number into the ERP. Document AI reads the certificate, checks the values against the specification, cross-checks it with the delivery, flags what looks wrong and stores a traceable result. The human inspector decides on release.

Problem & value

• Today: certificates arrive in hundreds of layouts, in several languages, often as scans or photos of stamped paper. Incoming inspection checks heat numbers, grade, chemistry and mechanical values against the order and the product standard. This is slow, so many companies sample only part of the certificates or check only the cover page. Missing or wrong certificates surface late, during customer audits or in claims.
• Why it matters: a mill test report (MTR/MTC) is the traceability evidence for the material. In Europe it is typically issued per EN 10204. Type 3.1 is issued by the manufacturer, type 3.2 also involves an independent inspector (purchaser's representative or one named by official regulations) [1]. Regulated products (pressure equipment, construction products, rail, aerospace, nuclear) require this evidence for the whole life of the product.
• AI value: template-free extraction instead of per-supplier templates, 100 % checking instead of sampling, earlier detection of non-conformity, searchable traceability for audits and recalls.
• Regulatory driver: the revised EU Construction Products Regulation (EU) 2024/3110 applies in its main part from 8 January 2026 and introduces a Digital Product Passport that combines declarations of performance and conformity with other required documents in machine-readable form [2]. More documents will arrive structured, but legacy PDFs and non-EU suppliers will remain for years.
• No reliable public figures on time savings were found for this specific use case; measure your own baseline (see KPIs).

Variants

• Steel/metal trading and manufacturing: mill test reports (EN 10204 3.1/3.2) against EN/ASTM grade limits, heat-number traceability to the coil, bar or plate.
• Pressure equipment, energy, shipbuilding: third-party-witnessed certificates (3.2), notified body documents, welder and procedure qualifications (WPS/PQR).
• Construction: declarations of performance, CE marking and DoP for building products, concrete and rebar certificates; link to site documentation.
• Automotive/aerospace supply chain: PPAP/FAIR documents, CoC, special-process certificates (heat treatment, coating, NADCAP-type accreditation).
• Chemicals, food and pharma: certificates of analysis (CoA) per batch against specification (see DOC-023 for safety data sheets).
• Supplier certificate management: ISO 9001/14001/IATF certificates, expiry tracking and issuer validation via certification-body databases.
• Public sector: procurement evidence for infrastructure and municipal construction projects.
• Not covered: diplomas and academic certificates (identity/credential verification) and identity documents (see DOC-004).

How it works

1. intake (supplier portal, email, scan at goods receipt, photo of delivery)
2. document type classification (MTC 3.1 / 3.2 / CoC / DoP / CoA / management-system cert.)
3. OCR + layout parsing (tables for chemistry and mechanical tests, stamps, signatures)
4. VLM / LLM extraction to schema (heat no., grade, standard, dimensions, values, units, issuer, date)
5. deterministic checks: values vs. standard limits and order spec, units, sums, heat no. vs. delivery, certificate type vs. required type, mandatory tests present, signature/stamp present
6. anomaly and authenticity signals (layout/font inconsistencies, metadata, duplicated heat numbers across suppliers, issuer not matching known mill)
7. decision support: pass / fail / needs review with highlighted source regions
8. inspector releases or rejects; result and certificate linked to batch in ERP/QMS; archive

• Extraction: a vision-language model or document parser returns JSON against a fixed schema; tables of chemical elements and tensile/impact tests are the critical part.
• Rule engine, not LLM, decides compliance: limits per grade are stored as structured data (from the standard or customer spec); the LLM only extracts and explains.
• Authenticity signals are indicators only. Cryptographic proof (qualified signature, digital certificate issued by the mill, QR code resolving to the issuer's system) is far stronger than any image analysis.
• Human-in-the-loop: every fail or low-confidence field goes to a quality inspector; release of material to production stays a human decision. For safety-relevant parts keep four-eyes review.

Data preparation

Certificates (EN 10204 3.1/3.2, CoC, test reports) arrive as PDFs and scans by e-mail, supplier portals or paper with the delivery, and are filed in the ERP, QMS, DMS or on file shares. The reference data is just as important: orders, material specifications, standards and drawings in the ERP and PDM. Typical gaps are poor scans, stamps and handwriting, many supplier layouts and languages, inconsistent material designations, certificates not linked to the order or batch, and specifications that exist only as PDFs.

Preparation steps: - Link certificates to order, batch and supplier in one place, see PREP-005 and PREP-010. - Digitise paper certificates at goods receipt, see PREP-006 and PREP-008. - Turn specifications and limit values into a machine-readable table, see PREP-011 and PREP-012. - Collect 100 certificates across suppliers, including known faulty ones, as an evaluation set, see PREP-018 and PREP-016. - Add synonym lists for material grades, see PREP-015.

Rough share of effort: 30-40 percent, mostly specification tables and linking. Tools: Docling, Tesseract, ERP exports, n8n for intake. See GUIDE-003.

Implementation paths

Which path for whom

• SMB: Path B, because checks must be matched against own purchase orders and specifications in the ERP and no product fits every certificate layout.
• Enterprise: Path B, because quality and supplier data are strategic and the pipeline must integrate with ERP, QMS and supplier portals.
• Developer: Path B, because document-AI APIs and an LLM comparison step are the quickest build.
• Public sector: Path C, because procurement rules and sovereignty favour a self-hosted stack on EU infrastructure.

Path A — Buy (off-the-shelf)

• Document-AI and intelligent-document-processing suites with configurable extraction: ABBYY Vantage, Rossum, Hypatos (Munich), Klippa (NL), Mindee (FR), Docsumo, Nanonets; DMS/ECM vendors such as DocuWare and d.velop (DE) for archive and workflow. EU-hosted options are marked by origin above; verify processing location per contract.
• QMS / supplier-quality software with certificate management: e.g. SAP (QM, Supplier Quality Management), Qualityze, iSolutions; some steel-trading ERPs have MTC modules.
• Choose A when: certificates are a side topic of a broader mailroom or AP project (DOC-008, DOC-001) and you can configure the schema yourself. Specialised MTC-verification products exist but the market is young; test with your own certificates before buying.

Path B — Build on cloud APIs (recommended default)

• Parsing: Azure AI Document Intelligence (custom extraction models, EU regions), Google Document AI (EU location), AWS Textract (Frankfurt), Mistral OCR (EU provider).
• Extraction/reasoning: a multimodal frontier model with structured outputs (Claude, Gemini, GPT, Mistral) reading page images with a JSON schema; use EU data-residency options of the provider.
• Checks: Python/rules service holding standard limit tables; results written to ERP/QMS via API; orchestration with n8n, Power Automate or Camunda.
• Why B: certificate layouts are long-tail and multilingual, volume is moderate, and no large training set is needed. Prompt plus schema plus deterministic rules gets to a pilot in weeks.

Path C — Self-host (open source)

• Parsing: Docling (MIT licence) [3], PaddleOCR / PaddleOCR-VL, MinerU, Marker.
• Extraction with open VLMs: Qwen3-VL (Apache-2.0; 2B/4B/8B/32B dense and MoE variants) [4] served via vLLM (Apache-2.0) [5] or Ollama, with schema-constrained JSON output.
• Stack: self-hosted n8n or Camunda, PostgreSQL for results, an on-prem DMS/QMS. Standards tables stay on your side, which matters when certificates carry customer-confidential project data.
• Hardware: HW2 (one 24–32 GB GPU) with a ~8B VLM is enough for thousands of pages per day; use HW3 for a 32B-class model when tables on poor scans are the bottleneck.
• Choose C when: defence, nuclear or aerospace customers forbid cloud processing, or the certificates are subject to export-control or strict customer NDAs.

Path D — Custom training

Usually not needed for extraction. Fine-tuning a small VLM or table model pays off only at high volume with a stable set of mill layouts (e.g. a steel service centre processing thousands of certificates daily), or to cut inference cost. Reviewer corrections form the training data (a few hundred labelled certificates per layout cluster). A supervised anomaly or forgery classifier needs labelled forged documents, which almost no company has, so rely on rules, reference comparison per mill and cryptographic verification instead.

State of the art (2026)

• VLM-based extraction is the standard approach for long-tail layouts; open VLMs (Qwen3-VL family) and layout parsers such as Docling are good enough for self-hosting [3][4].
• Hard parts: dense chemistry and mechanical tables with merged cells, decimal commas versus points, unit variations (MPa vs. N/mm², ksi), photos of curved or stamped paper, multi-heat certificates for one delivery, and handwritten corrections.
• Digitalisation of the source: machine-readable certificates are growing (CPR Digital Product Passport [2], supplier portals, QR codes pointing to the issuer's database), shifting the work from reading to validating and linking.
• Authenticity checking: image-forensic and layout-comparison methods can show inconsistencies but cannot prove genuineness; a good certificate fraud control combines issuer verification (call-back or portal lookup), cross-checks of heat numbers with deliveries and physical marking (see VIS-018) and, for critical parts, own testing (positive material identification).
• Limits and failure modes: VLMs may hallucinate or normalise values (for example "correcting" a value that is genuinely out of range); never let the model decide pass/fail or fill missing values. Always keep the original image next to the extracted values.

Shared resources & combinations

• Same stack (ocr-docparse + vlm + llm-general + workflow-automation): DOC-001 invoices, DOC-006 logistics documents (delivery notes carry heat/batch numbers), DOC-008 mailroom classification, DOC-014 table extraction and parsing for RAG. One VLM server (HW2/HW3) serves all of them.
• Neighbours: DOC-013 drawings (spec requirements derived from drawing and material callouts), DOC-018 redaction (before sharing certificates with project data externally), DOC-016 for rule-based compliance checking, KNOW-009 for standards Q&A, VIS-018 industrial OCR for reading heat numbers stamped on the material itself, ANOM-011 for supplier risk and ANOM-014 for forgery-detection techniques.
• Data building blocks: standards limit tables as structured reference data, supplier and mill master data, batch/lot traceability in ERP/QMS, vector index of past certificates for similarity checks (duplicates across suppliers).
• Workflow engine shared with other back-office automations.

Effort, cost & KPIs

• Path A: days to a few weeks for a configured pilot; pricing typically per page or document.
• Path B: 1–3 months for a production pipeline incl. rule tables and ERP/QMS integration; API cost per page is typically small relative to inspector time.
• Path C: 2–4 months; one GPU server plus operations; additional effort for model evaluation.
• KPIs: field-level extraction accuracy (especially chemistry/mechanics), share of certificates checked automatically (coverage), true-positive rate of non-conformities on a seeded test set, inspector time per delivery, time from goods receipt to release, number of audit findings and claims caused by missing or wrong certificates.

People & change

Start with the quality department lead and the incoming-goods staff, who know the failure cases and own the specifications; add purchasing, IT (ERP integration) and management for budget. Suppliers are affected too: tell them early about expected formats, ideally machine-readable certificates. The DPO is involved only if certificates contain personal data such as inspector names; a DPIA is normally not needed, but an AVV with any API provider is.

Works council: depends. The tool checks documents, not people, but if inspections are logged per employee, the system is objectively suited to monitor performance and §87(1) no. 6 BetrVG applies (BAG); §90(1) no. 3 requires timely information in any case where work processes change with AI. Inform the works council during the pilot planning and agree that no individual evaluation is made.

Support AI literacy (Art. 4 AI Act) for inspectors: how extraction errors and forgery hints look and why a missing flag is no proof of authenticity. Communicate that the tool takes over typing and comparison while the quality engineer releases the batch. Pilot with one product group for four weeks, in parallel to manual checks, and use the misses to improve rules. Typical concerns: liability and deskilling; address them by keeping human release and training on unusual cases. Guides: GUIDE-009, GUIDE-008, GUIDE-004.

Risks, regulation & compliance

• EU AI Act: minimal risk in the typical form — the system supports quality staff and is not an Annex III use case [6]. Exceptions: if the verification is itself a safety component of a regulated product under Annex I product legislation, or is used in a notified-body conformity process, assess the classification again. AI literacy duty (Art. 4) applies to staff.
• Product and sector law: EN 10204 inspection-document requirements as specified in orders and product standards [1]; Construction Products Regulation (EU) 2024/3110 (DoP, Digital Product Passport) [2]; Pressure Equipment Directive material requirements; sector rules in aerospace, rail and nuclear. The AI output does not replace the obligation of the manufacturer or the notified body.
• GDPR: certificates normally contain little personal data (inspector names, signatures); apply a data processing agreement when using cloud services; delete or redact personal data not needed.
• Fraud and liability: falsified certificates are a known risk in metals supply chains. Mitigate with issuer verification, heat-number cross-checks, supplier audits and physical testing. A model flagging "no anomaly" is not proof of authenticity.
• Confidentiality: certificates reveal customer projects and supplier recipes; prefer EU hosting or Path C for sensitive projects; log access.
• Mitigations: deterministic compliance rules, confidence thresholds, human release decision, audit log of AI suggestion versus inspector decision, retention per product and contract duties.

Getting started

1. Collect 100–200 real certificates (include bad scans, multiple languages, 3.2 certificates) and a few that were previously rejected; label ground truth for 30 of them.
2. Define the schema (heat no., grade, standard, chemistry, mechanics, issuer, certificate type) and encode the limits for your 5–10 most common grades as structured rules.
3. Prototype extraction with a cloud VLM (Path B) and with Docling plus Qwen3-VL (Path C); compare field accuracy on the labelled set.
4. Run in shadow mode next to incoming inspection for one month; measure disagreements.
5. Connect heat/batch numbers to ERP/QMS and switch to AI-first checking with human review of exceptions.

Sources

1. Wikipedia — Mill test report (EN 10204 types 3.1 and 3.2) — https://en.wikipedia.org/wiki/Mill_test_report
2. European Commission — Construction Products Regulation, CPR 2024 revision (dates, Digital Product Passport) — https://single-market-economy.ec.europa.eu/sectors/construction/construction-products-regulation-cpr/cpr-2024-revision_en
3. Docling project — https://github.com/docling-project/docling
4. Qwen3-VL (Alibaba Qwen team) — https://github.com/QwenLM/Qwen3-VL
5. vLLM project — https://github.com/vllm-project/vllm
6. EU AI Act — Annex III high-risk categories — https://artificialintelligenceact.eu/annex/3/
7. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj