This is where you must read carefully.
- Compliant means that the vendor believes they have followed FIPS encryption requirements and their product meets the specificaiton.
- Certified means that the product has actually been tested by NIST and issued a certificate number.
Certification is an expensive and time-consuming process, and must be re-done after changes, so companies will take the "compliant" route.
FISMA and specific RFI/RFPs, etc will state requirements around certified modules/hardware/etc and during review will require the NIST certificate number, so be sure to read requirements carefully and be specific when sending requirements to the vendor if you will accept compliant versus certified products.
Edit - also be sure that you're looking at the correct -version- of a product. FIPS certification applies to a specific set of code. There are also usually operational requirements about OS settings, etc so the terminology will some times say "FIPS 140-2 certified mode".
Thusly, FooLock 1.0 may be certified, but FooLock 1.1 is not because even though it's the same source code, it uses a different MS .NET CLR.
FooLock's publisher may (without any intent to deceive) say FooLock 1.1 is FIPS compliant because the crypto module is "the same code" but it is not certified, and if you use FooLock 1.1 for a solution which required a certified product, as South Park says, you're gonna have a bad time.