The certificate you need before November.
From 29 November every eCoC file has to carry your company's electronic seal, or the VCA reject it at upload. Getting one takes weeks, not days. This page is everything a bodybuilder needs to know, and nothing else.
It's a company stamp, not a signature.
Not a scan of anyone's signature, not a login, not a PDF with a picture on it. It's a certificate issued to your company by a trust service provider — an electronic seal — that software uses to prove a file came from you and hasn't been changed since. Alter one character in the file and the seal no longer matches.
The VCA's guidance says to sign the way EU manufacturers do. In conversation they've told us they expect a qualified seal, the higher of the two grades; we've asked for that in writing and will update this page when it arrives.
Advanced and qualified. Same cryptography, different backing.
ADVANCEDThe standard grade
- Tied to the companyMade with a key the company controls; breaks visibly if the file is altered.
- Any secure key storageThe key can live on a PC, a USB token, or a provider's server.
- You prove it's genuineIf a file is ever disputed, the burden is on you.
- The VCA have said they won't accept thisBy phone, 15 September. We're getting it in writing.
QUALIFIEDThe grade the VCA have indicated
- Everything advanced doesPlus a certificate from a provider on the UK trusted list.
- Key in certified hardwareA tamper-proof module the provider runs. It never leaves.
- The law presumes it's genuineIf disputed, the burden is on the other side.
- About £1 a seal at volumeThe difference from advanced is small, which is why we supply the higher grade the VCA have indicated. Nobody should be told in December that they have the cheaper one.
From a provider on the UK trusted list — through us.
The ICO keeps a short list of organisations whose qualified seals the law recognises. We work with one of them, and we handle the whole thing: we say what's needed, deal with the provider's paperwork, and hold the seal for you in your company's name, so every certificate you buy from us carries it. You never see a certificate, install anything, or renew anything yourself.
The only part that needs you is the provider's verification of your company — a Companies House check, a director confirming they can act for it, sometimes a callback to a published number. That takes the provider weeks, not days, and it's the part that catches people out in November.
What we'll ask you for. Your company number, a director who can spend ten minutes confirming the company's identity, and your type approval certificate. That's it. The rest is ours.
Hundreds a year, not thousands.
Qualified seals are sold in packs by the provider — around a pound per sealed file at volume, and the pack expires after twelve months. For a bodybuilder doing thirty vehicles a month that's a few hundred pounds a year in seals, and with CoC AutoDocs that is inside the price of each certificate you make.
- With CoC AutoDocs the certificate is included: we hold the seals, you never handle a certificate, and the one-off set-up covers getting your company verified with the provider
- Either way, there is no £10,000 IT project in this. That figure comes from software built for factories
Don't wait for the certificate to start.
The VCA currently check that a signature is present, not the certificate behind it. They've said that's interim. But it means you can set up, map your certificate template, and put files through the VCA's test system today with the built-in test key; once the provider has verified you, your files move onto the company seal.
- Set up your company and models now
- Upload to the VCA's test portal with the test key until every file comes back accepted
- Give us your company number and ten minutes of a director's time now, because the provider's verification is the slowest step
- Nobody handles a private key. If your company already holds its own certificate and would rather use it, never paste the key into an email, a chat or a form; it goes straight into the app on the PC that makes the files
The ones we get asked on the phone.
Is this "VCA approved"?
The VCA don't approve software or certificates. They publish what they check — the schema, a signature present, no duplicate VIN and version — and acceptance is always their decision. What we can say is that a file made with CoC AutoDocs has been accepted by the VCA's test portal.
Can we just use the chassis manufacturer's certificate?
No. That's their seal on their stage-1 certificate. From November the VCA need a certificate from you, sealed by you, for your stage. What a stage 2 file contains.
Does it have to be the company's seal, or can a person sign?
We've asked the VCA and will update this page. Everything in the EU eCoC world is a company seal, and that's what we've built for. One certificate covers everyone in the office who makes files.
What if we're national small series?
Then you're exempt from eCoC entirely and can carry on with paper. Check your type approval certificate before you spend anything.
How long does it last?
Certificates are issued for a fixed period, typically a year or three, and seals bought in packs expire after twelve months; with CoC AutoDocs the renewal is ours to handle and you never see it. A file that was sealed is not changed when the certificate later expires; the VCA keep the copy they accepted, and you keep your own export for the ten years the law requires.