Does my certificate need to contain the name of my organization?

When issuing a personal certificate, customers often ask whether the Organization (“O”) attribute must be included. This article explains when the organization name is typically included, when it is required, and what legal obligations apply.

Is the Organization (“O”) Attribute Mandatory?

For personal certificates, there is generally no legal requirement to include the organization name.

Under the eIDAS Regulation, the only mandatory attribute for a personal certificate is the name of the natural person. No European regulation explicitly requires the inclusion of the organization name in personal certificates.

We are not aware of any law or regulation that mandates inclusion of the Organization (“O”) attribute in personal certificates.

When Is the Organization Name Commonly Included?

Although not legally mandatory, including the organization name is common practice in certain situations:

• Employees or statutory representatives
  The organization attribute is typically included.

• Employee or self-employed (OSVČ) certificate types
  For these certificate types, the organization field is usually required.

For a relying party, the presence of the organization name serves as an indication of the signer’s relationship to the company (e.g., employee, statutory representative, contractor).

However, it is important to understand:

The organization attribute does not confirm that the person is authorized to act on behalf of the company in specific matters.

For example, a person may be authorized to sign HR documents but not to conclude contracts. The certificate itself does not define the scope of authority.

When Might the Organization Be Omitted?

There are valid scenarios where a personal certificate is used within a business context but does not include the organization name. This commonly occurs when:

• An individual represents multiple companies

• The individual does not want to maintain separate certificates for each company

• The certificate is primarily intended for personal identification rather than organizational representation

Summary

• The organization name is not legally required in personal certificates.

• Under eIDAS, only the person’s name is mandatory.

• Including the organization is common for employee or business-related certificates.

• The organization attribute indicates affiliation, not legal authority to act on behalf of the company.

• In some cases, omitting the organization is practical and appropriate.