What Is ISO 14025? The Framework Behind EPDs

Please note: This article was substantially updated in 2026 to reflect the publication of ISO 14025:2026 (Edition 2), which replaced the original 2006 edition. This article is for educational purposes only. It does not replace the ISO and EN standards. If you work at a university, you probably already have a licence to view the complete standards. If not, please go to your relevant national provider of standards.

When you see an Environmental Product Declaration (EPD) claiming to present life cycle data for a product, what ensures consistency and credibility? ISO 14025 provides the framework that transforms scattered environmental data into comparable, verified information. This standard governs how EPDs work, who controls them, and what rules they must follow.

Understanding ISO 14025 matters because EPDs are rapidly becoming essential in construction, procurement, and regulatory compliance. The standard determines what counts as a valid declaration and what doesn’t.

What ISO 14025 Actually Governs

ISO 14025 establishes the principles, requirements and guidance for EPD programmes and the declarations themselves. The second edition was published in June 2026 by ISO/TC 207/SC 3, replacing the original 2006 edition that had stood for two decades. It sits within the ISO 14020 family as a specialisation of that umbrella standard, and now pulls in ISO/TS 14027 (PCR development) and ISO/TS 14029 (mutual recognition) as normative references. You can no longer read ISO 14025 in isolation.

The standard doesn’t tell you how to assess a specific product. It defines how programmes should operate, how product categories should be defined, and what verification requirements apply. It’s the meta-level framework that makes EPDs function as credible information tools.

One important clarification: ISO 14025 is not a certification standard. An organisation is not ‘ISO 14025 certified’. Products have verified EPDs, published by a programme operator, valid for a stated period.

The Terminology Shift

The most visible change in the 2026 edition is terminology. The 2006 edition spoke of ‘Type III environmental declarations’, positioned against Type I ecolabels (ISO 14024) and Type II self-declared claims (ISO 14021). The 2026 edition retires the Type I/II/III taxonomy entirely across the whole ISO 14020 family and adopts the term the market actually uses: environmental product declaration (EPD).

This matters more than it looks. For years, practitioners used ‘EPD’ colloquially whilst standards, PCRs, and procurement specs formally said ‘Type III’. Aligning the language removes a translation layer that caused real confusion in tenders, green building credits, and regulation. The old taxonomy also invited abuse, including manufacturers marketing self-declared claims as ‘Type II EPDs’, a label that never existed under the standards.

EPDs present quantified environmental data across multiple impact categories, based on Life Cycle Assessment conducted according to ISO 14040/44. Unlike ecolabels that say ‘this product meets our criteria’ or self-declared claims that highlight specific attributes, EPDs present comprehensive data without making judgements about whether a product is environmentally good or bad. An EPD does not set pass/fail thresholds and does not certify that a product is environmentally preferable. It reports numbers under agreed rules, so that informed comparison becomes possible where the rules are the same.

New and Updated Definitions

The 2026 edition reorganised and expanded the definitions section, adding several terms that reflect how EPDs are now produced and used in practice. These include general programme instructions (GPI), EPD tool, declared unit (now formally defined rather than just referenced), environmental performance, predetermined impact indicators and predetermined inventory indicators (replacing the vague 2006 phrase ‘predetermined parameters’), and sustainability-related information. The standard also adopted a full chain of custody vocabulary borrowed from ISO 22095, bringing mass balance, credit method, and book-and-claim into the framework as first-class concepts that programmes are expected to address.

The Programme Operator: Who Controls the System

Every EPD exists within a programme run by a programme operator. This isn’t optional infrastructure. ISO 14025 requires that someone must establish the rules, maintain consistency, and ensure credibility.

Who Can Be a Programme Operator

The standard allows various bodies to run programmes. A company or industry association might operate a programme for its sector. Government agencies could run programmes for public procurement. Independent organisations might establish broad multi-sector programmes.

This flexibility creates both opportunity and complexity. EPD programmes with different operators might establish different rules, even for the same product categories. A steel EPD from one programme might not be directly comparable to a steel EPD from another programme, depending on how each operator interprets ISO 14025.

What Programme Operators Actually Do

Programme operators don’t just rubber stamp declarations. They establish and maintain the general programme instructions (GPI) that define how everything works. These instructions specify the scope of the programme, procedures for stakeholder involvement, rules for Product Category Rules development, verification requirements, and fee structures.

Programme operators decide critical questions. Will third-party verification be mandatory for business-to-business declarations? What databases are acceptable? How will data confidentiality be managed? These decisions shape the practical usability and credibility of every declaration within the programme.

The operator also maintains public registries of PCRs and declarations, publishes documents, monitors other programmes, and ensures competent verifiers. They effectively act as both rulemaker and quality controller for their programme.

Expanded Governance Requirements (2026 Edition)

The 2006 edition gave programme operators a fairly compact list of duties. The 2026 edition expands this dramatically. Operators must now disclose their ownership structure, governance, and revenue mechanisms, and put procedures in place so that revenue cannot compromise impartiality. They must publish GPI on an electronic platform and maintain publicly available digital registries of PCRs and EPDs. They must operate transparent PCR development with voting procedures, dispute resolution, and public consultation before publication. They must maintain a complaints procedure, including for errors found in already-published EPDs. And they must adopt a competition and anti-trust policy communicated to all interested parties.

Taken together, this reads less like a labelling standard and more like a governance regime for a regulated market, which, given where EU product regulation and green-claims regulation is heading, is almost certainly the point.

The Power and Problem of Programme Operators

Programme operators wield significant influence. They can set requirements beyond what ISO 14025 mandates: stricter data quality requirements, specific databases, or additional impact categories.

This creates a fundamental tension. ISO 14025 encourages harmonisation between programmes to enable comparability, but operators have legitimate reasons to differ. Regional databases might be more representative. Sector-specific requirements might improve relevance. The result is a proliferation of programmes with subtly incompatible requirements. The 2026 edition addresses this through stronger integration with ISO/TS 14027 and ISO/TS 14029, and by requiring operators to actively participate in mutual recognition arrangements. Whether this moves harmonisation from aspiration to practice remains to be seen.

Product Category Rules: The Comparability Mechanism

Product Category Rules (PCRs) are the specific requirements for EPDs within a product category. They’re what makes comparing two concrete mixes or two laptops potentially meaningful, rather than comparing apples to oranges.

How PCRs Work

A PCR defines the product category and specifies exactly how to conduct the LCA for products in that category. It establishes the functional unit, sets system boundaries, specifies which life cycle stages to include, determines which impact categories to report, and defines data quality requirements.

The PCR also determines allocation rules for multi-output processes, acceptable data sources, and how to handle specific technical issues unique to the product category. PCRs can run to dozens of pages of technical specifications.

PCR Development Process

ISO 14025 requires PCRs to be developed through an open consultation process involving interested parties. The programme operator identifies stakeholders, provides adequate review time, and ensures transparent procedures.

PCRs must be based on one or more Life Cycle Assessments that identify the significant environmental aspects of the product category. The standard encourages harmonisation: before creating a new PCR, programme operators should consider adopting existing PCRs for the same product category. In practice, PCR harmonisation has historically been more aspiration than reality. The same product category might have multiple incompatible PCRs across different programmes and regions, though the 2026 edition’s integration of ISO/TS 14027 is intended to improve this.

PCR Review: Third-Party Oversight

Before a PCR can be used, it must undergo third-party review by an independent panel with at minimum a chair and two members with combined expertise in the sector, LCA methodology, and environmental aspects of the products. The 2026 edition makes clear that PCR review and EPD verification must be two separate processes. The PCR review verifies that the rules follow ISO 14040/44, fulfil the programme’s general instructions, and ensure the prescribed data will adequately describe the product’s significant environmental aspects.

The Verification Requirement

ISO 14025 requires independent verification of the underlying data and the declaration itself, but the specifics depend on the intended audience and programme operator decisions.

Independent verifiers must confirm that data conforms to the PCR and to ISO 14040/44, the LCA meets data quality requirements for coverage, precision, completeness, representativeness, consistency, reproducibility, sources, and uncertainty, and the declaration accurately reflects the supporting documentation.

Independence Requirements (Strengthened in 2026)

The 2006 edition distinguished between independent verification (internal or external, meaning someone not involved in conducting the LCA) and third-party verification (a body recognised as independent of both the declaration developer and any interested parties). The 2026 edition keeps this distinction but sharpens the independence requirements considerably.

The definition of ‘third party’ now spells out exactly who the verifier must be independent of: the responsible party (the manufacturer or EPD owner), the programme operator, the LCA practitioner, and the EPD tool developer. The definition of ‘verifier’ itself was also tightened, now reading as a ‘competent and independent’ person, where the 2006 edition simply described someone who ‘carries out verification’.

For business-to-consumer communication, third-party verification is mandatory and the verifier must be named in the declaration. For business-to-business, programme operators can still choose, though most major programmes require third-party verification for credibility. Programme operators must also establish and implement policies to identify, disclose, and manage conflicts of interest across operators, verifiers, and panel members.

Whilst the standard made clear that automated tools must be verified independently, there is a lot of ambiguity and leeway here, and the question of whether nominally separate entities under shared ownership satisfy the standard’s independence requirements remains to be tested. In our opinion, this part of the ISO standard is weak enough to be unenforceable against anyone who puts thought into their corporate structures.

The Critical Comparison to ISO 14067

This verification framework differs fundamentally from ISO 14067 for carbon footprinting. ISO 14067 makes verification entirely optional: you can produce a carbon footprint study, never have it verified, and still claim conformance. ISO 14025 requires at minimum independent verification, with programme operators often mandating third-party verification.

This creates a credibility gulf. A product carbon footprint might be entirely self-declared and unverified. An EPD within an ISO 14025 programme must be independently verified. For business audiences choosing between carbon footprint studies and EPDs, this verification difference is critical.

EPD Tools: Formal Recognition

For the first time, ISO 14025 acknowledges that EPDs are increasingly generated by software. The 2026 edition defines ‘EPD tool’ and builds a verification pathway around it: programme operators must specify requirements for verifying EPD tools, and a verified tool can unlock a simplified, streamlined verification process for the individual EPDs it produces. The GPI must describe EPD tool verification explicitly.

This is a significant development for the digitisation of EPDs. Pre-verifying a tool, checking the calculation engine once and rigorously, means every declaration it produces inherits that assurance, which is the model that makes EPDs affordable at scale. The standard pairs this efficiency gain with the independence requirements described above: automation is welcome, provided the automation is independently verifiable and the verifier is not the vendor.

EPD Types: Declaring What an EPD Actually Represents

The 2026 edition introduces a new requirement for programme operators to define and classify EPD types. Rather than treating every EPD as interchangeable, the standard now expects programmes to classify declarations along parameters such as the number of products, companies, and manufacturing facilities covered, the percentage of the GWP result derived from supply-chain-specific data, which life cycle stages are included, and how many consecutive months of specific data underpin the LCA.

The type must be declared in the EPD itself. This is a quiet but meaningful shift toward comparability with honesty. A single-product, single-facility EPD built on twelve months of primary data is a very different object from an industry-average declaration leaning on generic background data, and now the EPD has to say so on its face. For anyone in procurement or benchmarking, that is a genuine upgrade in signal quality.

Prospective EPDs

The 2026 edition also formalises prospective EPDs, intended for products recently launched or not yet on the market. The 2006 edition focused primarily on EPDs developed from representative production data. The revised standard recognises that programme operators may allow prospective EPDs for products at different stages of commercialisation, using data from similar products, comparable technologies on the market, or forecast and design data from a manufacturing plant.

This addresses a real challenge: in rapidly evolving sectors such as advanced manufacturing, construction materials, and clean energy technologies, manufacturers often need credible environmental information before a product has accumulated enough operational data to support a conventional EPD. Waiting for a full year of representative production data can delay product launches, procurement decisions, and sustainability reporting.

The guardrails are specific: prospective EPDs have limited validity, require mandatory re-evaluation after a year, must quantify uncertainty, and must be clearly labelled to avoid confusion with EPDs based on established production data. Whether those guardrails hold will depend on how programme operators implement them.

Modularity and Information Modules

ISO 14025 introduces the concept of information modules: compilations of LCA data covering unit processes or combinations of processes within a product’s life cycle. This modular approach enables supply chain transparency without requiring every company to conduct full LCAs covering their entire upstream chain, making EPDs feasible for complex manufactured goods.

Modularity works well within a single programme with clear rules, but cross-programme module sharing remains limited because modules must use consistent databases, impact assessment methods, and system boundaries to be compatible.

Business-to-Business Versus Business-to-Consumer

ISO 14025 explicitly recognises different needs for industrial versus consumer audiences. EPDs were designed primarily for B2B communication: technical buyers, architects, procurement specialists, and manufacturers who need detailed quantified data and can interpret impact categories, understand functional units, and recognise LCA methodology limitations.

When EPDs target consumers, ISO 14025 imposes stricter requirements: third-party verification becomes mandatory and the verifier must be named in the declaration. Some programmes develop simplified formats for consumer-facing declarations whilst maintaining full technical data as backup.

When You Need ISO 14025 Compliance

Regulations increasingly reference EPDs and ISO 14025. The EU Construction Products Regulation requires environmental information for certain products, and various procurement policies specify ISO 14025-compliant declarations. LEED, BREEAM, and other green building schemes award credits for products with EPDs, typically specifying ISO 14025 compliance to ensure declaration credibility. Even without regulatory mandates, ISO 14025 compliance provides competitive credibility: B2B buyers increasingly recognise the difference between marketing claims and verified declarations.

Limitations and Criticisms

The proliferation of programme operators creates comparability problems. ISO 14025 encourages harmonisation but cannot mandate it. An EPD from the International EPD System might differ subtly from one in the German IBU programme, even for identical products, undermining one of the core purposes of EPDs. The 2026 edition’s stronger harmonisation provisions and mutual recognition requirements are intended to address this, though it remains early days.

The PCR requirement creates bottlenecks for emerging products or small sectors. Developing a PCR requires resources, LCA expertise, stakeholder consultation, and third-party review: barriers that are manageable for large industries but challenging for smaller sectors.

Cost and complexity also create barriers. Creating ISO 14025-compliant declarations requires significant investment in LCA, documentation, verification, programme fees, and ongoing maintenance. Small and medium enterprises often struggle with these costs, though the recognition of EPD tools and streamlined verification pathways in the 2026 edition may lower this threshold over time.

The independence provisions, whilst strengthened on paper, contain structural ambiguities around shared ownership and corporate separation that may limit their practical enforceability, as discussed in the verification section above.

Finally, EPDs present data without judging whether impacts are acceptable. An EPD doesn’t mean a product is environmentally good; it means impacts are quantified and verified. Less sophisticated audiences might misinterpret EPD presence as environmental endorsement rather than transparency. The new EPD typing requirements should help here, by making it clearer what data quality and scope sit behind each declaration.

The Relationship to ISO 14040/44

ISO 14025 explicitly builds on ISO 14040 and ISO 14044. Programme operators cannot define PCR requirements that contradict ISO 14040/44, and verifiers must check conformance with both ISO 14025 and the ISO 14040 series.

ISO 14040/44 governs how to conduct LCA but doesn’t specify communication formats, verification procedures, or programme structures. ISO 14025 fills these gaps. The LCA standards allow flexibility in system boundaries, impact categories, and data sources appropriate for the study’s goal and scope. ISO 14025 requires that PCRs constrain these choices for consistency within product categories. This additional structure makes EPDs more rigid than general LCA studies, but that rigidity enables comparability.

Making ISO 14025 Work for Your Organisation

Successfully using ISO 14025 requires strategic thinking about programmes, products, and resources. Research available programmes in your sector and market: major international programmes include EPD International, IBU (Germany), The Norwegian EPD Foundation, and others. Compare their scopes, fee structures, PCR availability, verification requirements, and market recognition. Check if relevant PCRs exist before committing to a programme, as creating a new PCR adds significant time and cost.

Assess whether to build internal LCA capability or work with external consultants. For processes you control directly, invest in data collection systems that support ongoing declaration updates. Engage verifiers early and budget adequate time: tight deadlines lead to rushed reviews or project delays.

For practical guidance on the full process, see our guides on how to get an EPD, EPD data requirements, and what to expect from verification.

FAQs