A PDF certificate is a picture of a claim. It shows what a certificate looked like when someone saved it, and nothing about whether it is genuine, current or still valid. Files can be edited, lapses do not update them, and revocations never reach them. The only proof is the issuer's own live record, checked at source.
What exactly is wrong with a PDF?
Three things, each enough on its own.
It can be altered. Editing a PDF takes minutes with ordinary software. Names, dates, credential titles and scores can all be changed, and the result looks identical to the original. Even without deliberate fraud, people sometimes "update" their own certificates to reflect what they believe is true.
It cannot show a lapse. A certificate valid for 12 months looks exactly the same on the day after it expires as on the day before. Unless the reader notices the date and does the arithmetic, the PDF continues to claim validity indefinitely.
It cannot show a revocation. If an issuer withdraws a certificate, there is no way to reach every copy that has been saved, emailed or printed. The holder's PDF keeps saying they are certified.
So a PDF tells you, at best, that a certificate with these details existed at some point. For someone deciding whether to grant approval rights over an AI agent's work, that is close to worthless.
Why does this matter for people who approve agent work?
Because approval rights are being granted on the strength of these documents. A business decides that only certified reviewers may approve held payments, or that compliance officers need a current certificate before they sign off agent-prepared findings. The question of whether compliance officers need a certificate to approve agent actions only has a useful answer if "certificate" means something checkable.
If the business accepts PDFs, the control is only as strong as the weakest file someone uploaded. A reviewer whose certificate lapsed six months ago, or never existed, holds the same rights as one who renewed last week. And when an auditor later samples approvals, the business can show a PDF but cannot show that the certificate was valid on the day.
What does proof look like instead?
Proof is the issuer's record, read directly. Checking a certificate at source means looking it up with the organisation that issued it, using a certificate number or a QR code, and seeing its current status on the issuer's own page. If it has lapsed or been revoked, that page says so.
That changes what the document is for. A certificate the holder presents is no longer the evidence; it is a pointer to the evidence. Its job is to carry the number or code that lets you check. The guide on how to verify a training certificate is genuine sets out the steps.
Proof also needs to be specific. The source record should say what the person is certified to do, when the certificate was issued and when it expires. That is the argument in a certificate should say what someone can do today: a record of current, defined competence, not a souvenir of a past event.
What is the trade-off?
Checking at source creates dependence on the issuer. If the issuer's service is unavailable, you cannot check. If the issuer ceases to exist, the certificates lose their proof. That is a real risk, and it is worth asking any issuer how they handle it.
It also adds friction. A hiring manager or team lead has to take an extra step instead of glancing at an attachment. Over a large team, that adds up.
And there is a privacy consideration. Live verification means a third party, the issuer, learns that a check was made. Most people accept that as part of holding a checkable credential, but it should be clear.
None of these costs come close to the cost of relying on documents anyone can alter. The friction is a few seconds per check. The dependency can be managed by choosing issuers carefully and recording each check when it happens, so that you have your own evidence of what the source said on that date.
What should you do when a certificate lapses?
The check at source will show it. The business then needs a defined response: usually, the person's approval rights at the certified level pause until they renew, and held items route to a colleague. They keep working; they stop approving what requires certification. The guide on handling a reviewer whose certificate has lapsed covers the practical side.
What should you do differently?
- Stop accepting PDFs as evidence for approval rights. Treat them as pointers only.
- Ask for the certificate number or QR code, and look it up with the issuer.
- Record each check: who checked, when, and what the source showed.
- Recheck on a schedule, and whenever an expiry date passes.
- Choose certifications that can be checked at source in the first place, and avoid those that cannot.
The guide to AI literacy and certification for people who work with agents explains where verification fits.
Where the Academy fits
Pryme Intelligence Academy issues its certificates through VerifyDoc.ai, so each can be checked at source by number or QR code. A lapsed or revoked certificate shows as such on the same page, and a public register lists certified people by name, credential and expiry. The document a learner shares is the pointer; the record at source is the proof.
Questions people ask
Is a PDF with a digital signature good enough?
A signature can show the file has not been altered since signing, which helps with tampering. It still cannot show a later lapse or revocation, so you need a live check as well.
What if the issuer has no way to check at source?
Then treat the certificate as weak evidence. Contact the issuer directly and record their answer, and prefer certifications that support live checks in future.
Should employees be told their certificates will be checked?
Yes. Make it clear in policy that approval rights depend on a certificate that is current at source, and that checks happen when rights are granted and periodically afterwards.