Many businesses run an Android app that never went near Google Play. A sales team gets an APK file over WhatsApp. Delivery staff install an app from a link on the company website. A dealer network uses an app that a former developer built and nobody has touched since. All of these rely on Android letting a phone install an app from anywhere. Android developer verification changes that rule, and the change reaches every country in 2027.
We are a product engineering team at Infopark in Kochi. We build and publish Android and iOS apps for businesses in India, the UAE and Australia. This guide explains what Google has announced, who it affects and what to check now, so that a routine app update does not fail on your team's phones next year.
The short answer
Google now requires every app installed on a certified Android phone to come from a developer whose identity Google has verified, and every app to be registered to that developer. Enforcement started on 30 September 2026 in a small group of first markets and covers installs from Google Play and several phone makers' stores. It expands to all certified devices worldwide in 2027. If your app is on Google Play, you have probably been verified and registered already, and you should confirm it. If your app is shared as an APK, through a link or through a third-party store, you need to register it through Google's Android Developer Console before the global rollout, or new installs and updates will stop working for ordinary users.
What Android developer verification is
Until now, Android has checked who built an app only for apps in Google Play. An APK from any other source could be installed once the user allowed installs from unknown sources. Scammers have used this to push fake banking and delivery apps to people's phones, and that is the problem Google says verification is meant to address.
Under the new rules there are two parts. The developer, whether a company or an individual, verifies their identity with Google. Each app, identified by its package name and the key used to sign it, is then registered to that verified developer. When a certified Android phone installs or updates an app, it checks that the app is registered. A certified device is one that ships with Google's apps and services, which covers most phones sold in India and the Gulf. Google's FAQ says the checks apply to certified devices running Android 7 or later.
Verification does not involve Google reviewing what the app does. Google states that it collects no information about an app's content or features through this process, so an app built for your business alone does not have to be described to anyone.
The timeline
| When | What happens |
|---|---|
| March 2026 | App registration opens. Google links apps to verified developer identities. |
| August 2026 | The Android Developer Console, free limited distribution accounts and the advanced install flow for power users launch. |
| 30 September 2026 | Enforcement begins in the first markets, which do not include India, for installs from Google Play and participating phone maker stores. |
| 2027 | Verification expands to all certified Android devices worldwide, covering apps from any source. |
The September 2026 phase applies only to installs from Google Play, Samsung's Galaxy Store and the app stores of Xiaomi, OPPO, vivo, HONOR and Transsion, in the first markets. APKs shared directly are not checked yet. Google has said they will be in 2027 and advises developers to register before then. Google has not yet published a day in 2027, so treat the start of the year as the safe target.
Which business apps are affected
Apps on Google Play
If your app is published on Google Play, most of the work has been done for you. Google reports that more than 99 percent of apps have been registered and that most Play developers are already verified. Apps that use Play App Signing are claimed automatically. Open Play Console, go to the Android developer verification page and check that each of your apps shows as registered. If one does not, register it there.
Apps shared as an APK
This is the group that needs action. It includes field sales and service apps sent over WhatsApp or email, apps downloaded from a page on your website, apps installed by a vendor on staff phones, and customer apps distributed outside Google Play to avoid store rules. It is a common way to run internal apps in Kerala and across India, because it is quick and has no store review. After the global rollout, an unregistered app of this kind will not install on a normal user's phone, and updates to copies already installed will fail.
Apps on company-managed phones
If your company issues phones and installs apps through its own managed app store, Google says those apps do not need verification, because the company's IT team has already vetted them. Google still recommends registering them in case they are ever installed from another source or on a phone the company does not manage. If staff use their own phones, as is usual for field teams in smaller businesses, this exemption does not help you.
Apps in testing
Apps installed by a developer through ADB, the command-line tool connected over a cable, are exempt. That keeps development and testing as they are. It is not a way to run a business app for a team of fifty.
What happens if you do nothing
An unregistered app will not stop on phones overnight in a way you can predict, and that is the risk. The failure arrives at the moment you need to change something. A new salesperson joins and cannot install the app. You fix a bug, send out a new APK and every update fails. A phone is replaced and the app cannot be put back. Google's FAQ is explicit that updates to unregistered apps fail unless the user has turned on the advanced flow or the update is installed through ADB.
The advanced flow is Google's route for experienced users who choose to install apps from unverified developers. It requires turning on developer options, restarting the phone, waiting through a one-time 24-hour period and confirming with a fingerprint or PIN. Asking every member of staff to do that, and to click past a warning on each install, is not a reasonable way to run a business app.
What to do now
1. List every Android app your business depends on
Include apps for staff, dealers, drivers and customers, and note how each one reaches phones: Google Play, a link, a shared file or a managed company store. Apps built years ago by a freelancer are the ones most often forgotten.
2. Find out who holds the signing key
Every Android app is signed with a key file, and registration proves that you control that key. Google states that if the signing key is lost, the app's package cannot be registered. Ask your developer or former vendor for the keystore file and its passwords, and store them somewhere the business controls. If the key is gone, the app will have to be published under a new package name, and every user will need to install it afresh.
3. Get a D-U-N-S number for the company
Organisations verify with a D-U-N-S number, a nine-digit business identifier issued by Dun & Bradstreet. It is free to obtain from Dun & Bradstreet, but Google warns that it can take up to 28 days, and that some third-party services charge for something that costs nothing. If your company already has one from a Google Play or Apple developer account, use the same number.
4. Verify the company, not a person
Register the developer account in the company's name, using a company email address that more than one person can reach. An app registered to an employee's personal account, or to your vendor's account, belongs to them in Google's records. If the app is distributed only outside Google Play, the account is created in the Android Developer Console, which has a one-time fee of US $25. If you already have a Play Console account, Google lets you manage verification for apps outside Play from there.
5. Register each app and test an update
Register each package name and signing key, then confirm the status reads as registered. Build a new version of the app, install it as an update on an ordinary phone and check that it goes through. Recent versions of Android Studio show the registration status when the developer generates a signed APK, which makes this easy to check at every release.
Limited distribution accounts: when they fit
Google also offers a free limited distribution account that needs no government ID. It allows an app to be shared with up to 20 specific devices. Google describes it as intended for students, hobbyists and testing. It suits a pilot with a handful of staff. It does not suit a business app that will grow, and Google allows moving from a limited account to a full one but not back again. For a company app, set up full verification from the start.
Should you move the app to Google Play instead?
Verification removes one reason for staying outside the store, because an APK app now needs a verified developer account as well. Google Play adds a review process and store policies, and in return gives automatic updates, crash reports and a familiar install for staff. For internal apps, Google Play's private app option, used with managed Google Play, lets a company publish an app only to its own users. Weigh this when you register.
There is a third route for some apps. If the app is mainly forms, lists and status screens, a progressive web app opens from a link and is not affected by Android app verification at all. Our comparison of PWA vs native apps explains where a web app is enough and where a field team still needs an installed app.
Frequently asked questions
Does Android developer verification apply in India?
Not yet for enforcement. The first phase from 30 September 2026 covers a small group of markets that excludes India. Google has announced a global rollout to all certified Android devices in 2027, which includes India, the UAE, Saudi Arabia and the other markets we work in.
Does it cost anything?
A full Android Developer Console account has a one-time US $25 fee. The D-U-N-S number is free from Dun & Bradstreet. Limited distribution accounts are free. If you are already a Google Play developer, verification is managed through your existing Play Console account.
Will iPhone apps be affected?
No. This is an Android change. Apple has long required developers to be enrolled before their apps can be installed on iPhones, through the App Store or Apple's business distribution programmes.
Our vendor built the app under their own account. What should we do?
Ask for the app to be registered under your company's verified account, and for the signing key to be handed over. This is worth settling now while the relationship is working, not when you need an urgent update.
Can users still install unverified apps?
Yes, through ADB or the advanced flow, both of which are meant for developers and experienced users. Neither is a practical way to give a business app to staff or customers.
Conclusion
Android developer verification turns a loose arrangement into a formal one. Every app needs a verified owner and a registered package. For apps on Google Play, the work is mostly a status check. For staff and customer apps shared as an APK, it means finding the signing key, getting a D-U-N-S number and registering each app before 2027. None of it is difficult, and all of it is easier before an update fails than after.
If you are not sure where your app stands, or the developer who built it is no longer available, our mobile app team in Kochi can check the app, recover what can be recovered and handle the registration. We can often take over an app that another team built, starting with an audit of its build and release process. Tell us about your app and we will tell you what it needs.
Human. Digital. Future.
