R2v3 Certification for Server and GPU Repair and Refurbishment Shops

If you repair and refurbish servers and GPUs for data centers and your customers have started asking for R2, you need certification to R2v3, the standard published by SERI (Sustainable Electronics Recycling International). Because you test and repair equipment for reuse, your certification also covers Appendix C (Test and Repair) on top of the ten core requirements. Appendix C requires a certified quality management system, and every R2 facility needs a certified environmental, health and safety management system as well. SERI says the whole process takes most facilities 8 to 12 months.

That is real work, but most of what an auditor wants to see is a disciplined version of what a good refurbishment shop already does. You test every unit against defined criteria, keep the results by serial number, wipe data in a way you can prove, and know where every board and battery goes when it leaves your dock.

Why are data-center customers asking for R2?

Because the companies that buy, retire and resell data-center hardware write it into their vendor standards. Microsoft's supplier conformance standards cover suppliers doing "repair, refurbishment, and parts harvesting; recycling; or disposal." They ask for "internationally recognized electronic waste management certification and registrations, including but not limited to R2 and e-Stewards; and, ISO 14001."

Dell's Electronics Disposition Partner Performance Standard (revision 5, November 2025) covers "Disposition, Remanufacturing, Refurbishment, Repair and Reuse services." It asks partners for ISO 9001, ISO 14001 and ISO 45001 certifications, plus an internationally recognized electronic waste certification such as R2 or e-Stewards, or a RIOS certification. Equinix says the suppliers behind its on-site shredding service "meet industry standards, including ISO 9001, 14001, 45001, 27001, and R2v3 certifications."

None of these buyers says R2 is the only certification it will accept, and e-Stewards and RIOS appear alongside it. If your customer has named R2 specifically, R2v3 is the version a certification body will audit you to today.

Does R2v3 cover GPUs?

R2v3 never uses the word GPU. The standard defines electronic equipment to include "storage devices; servers; networking systems" and "any components of the types of equipment listed here." In my reading, a GPU that comes out of a server, or is sold to go into one, falls under that definition as a server component. Confirm it with your certification body before you write your scope statement, because the scope drives everything else in the audit.

What does R2v3 require of a repair and refurbishment shop?

Every R2 facility is audited against the ten core requirements.

On top of those, a server and GPU refurbisher usually needs three of the seven appendices. Here is what matters most for this kind of shop, quoting the R2v3 standard where the wording matters:

1. Appendix C, Test and Repair. You must be certified "to an approved quality management system (QMS) standard." SERI's approved list includes ISO 9001:2015 and RIOS:2016. Your test plans need "pass and fail criteria for each function." You must also "generate and maintain records of test results for each function tested for each unique identifier assigned." In practice that means a test record for every serial number, not a sign-off for the batch.
2. Functional categories. SERI's equipment categorization document grades working equipment as "F3 Key Functions Working," "F4 Hardware Functional," "F5 Refurbished" or "F6 Like New." SERI's knowledge base adds that assigning any of those "requires that the device be tested and verified functioning through Appendix C."
3. Appendix B, Data Sanitization, if you wipe drives yourself. Your sanitization software must be "configured to fail the media if any user-addressable locations cannot be sanitized." In addition, "a minimum of 5% of logically sanitized data storage media shall be routinely sampled by a competent and independent party" to show the data cannot be recovered. Sustained clean results can bring that sample down, but never below 1%.
4. Core Requirement 7, Data Security. Physical destruction of data storage devices has to follow Appendix A of NIST Special Publication 800-88 (revision 1), which the standard cites.
5. Core Requirement 8, Focus Materials. Circuit boards ("whole, partial, or shredded circuit boards regardless of lead and/or mercury content") and batteries (every chemistry except alkaline batteries without mercury) are focus materials. The boards you cannot repair and the batteries you pull from servers need controlled handling and a qualified downstream path.
6. Appendix A, Downstream Recycling Chain. SERI's appendix guidance is plain: "Every R2 Facility that is not the final process in the Recycling Chain, such as collectors, dismantlers, test and repair operations, etc., must be certified to Appendix A." You will need due diligence on every downstream vendor that takes your scrap and your rejects.

What changes when the unit is a GPU?

The requirements are the same ones, but three of them land differently on a GPU than on a whole server.

Testing a part, not a system. SERI's knowledge base on parts and components says "all components of used electronic equipment that are sold for reuse must be tested and verified as functional in accordance with Appendix C." A GPU sold on its own is exactly that kind of component, so it needs a test record of its own, tied to its own identifier.

Deciding what "working" means. Appendix C leaves it to you to define the functions you test and the pass and fail criteria for each one. For a GPU, that definition has to be written down for each model you handle, and the categorization you sell it under (F3 through F6) has to match what the test actually proved.

Failed cards are focus materials. A GPU card that fails test and cannot be repaired is a circuit board under Core Requirement 8. It has to be tracked as a focus material and sent only to a downstream vendor you have qualified under Appendix A.

How does certification actually work?

R2v3 certification is a two-stage audit by an accredited certification body. SERI lists the accreditation bodies for the program as ANAB in the US, JASANZ in Australia and New Zealand, and NABCB in India.

• Build the management systems first. Core Requirement 3 says an R2 facility "shall be certified by an accredited Certification Body, to one or more of the approved EHSMS standards," and Appendix C adds the quality system. SERI's approved list covers ISO 14001 for the environmental side and ISO 45001 for health and safety, or RIOS, which covers environmental, health and safety, and quality in a single certification. SERI's clarifications also say an R2 certificate is never issued ahead of the QMS and EHSMS certificates it depends on.
• Run the system before the audit. SERI's Code of Practices requires three months of implementation records at the readiness review.
• Stage 1, then Stage 2 on site. SERI says Stage 2 typically follows Stage 1 by 30 to 60 days. The Code of Practices requires the certificate to be issued within eight months of the Stage 1 audit.
• Keep it. Surveillance audits are annual, and recertification is a full system audit before the end of the three-year cycle.

Where server and GPU shops tend to get stuck

These are the places I would look first in a gap assessment for this kind of operation.

Test records that follow the serial number. A spreadsheet filled in at the end of the day is hard to defend when an auditor picks one unit off the shelf and asks for its record. The record should be created when the test runs and tied to the unique identifier on the unit.

Every place a server can hold data. Before you write your sanitization procedure, walk each server model you handle and list every component that can store data, not only the drives in the bays.

The management system certificates on the critical path. The R2 certificate cannot be issued before the QMS and EHSMS certificates, so schedule those audits early. Many facilities in this position build ISO 9001, ISO 14001 and ISO 45001 as one integrated management system, and SERI allows a certification body to integrate the management-system portion of the audits.

A note on dates

As of September 2026, R2v3 version 3.1, effective January 31, 2024, is the current standard. SERI's five-year review timeline, which it describes as an estimate, shows the next version published in late 2027 or early 2028. The standard cites NIST SP 800-88 revision 1, but NIST published revision 2 in September 2025, so ask your certification body which revision it expects your procedures to reference.

How Certify Consulting Group helps

At Certify Consulting Group, I help server and GPU repair and refurbishment shops scope R2v3 and build the quality and EH&S management systems it depends on. I write Appendix B and Appendix C procedures that match how the shop actually tests and wipes equipment, and I prepare the team for Stage 1 and Stage 2. If a customer has put an R2 deadline in front of you, start with our R2v3 certification page or book a call.