ISO 37001:2025 changes: what is new, and how to transition before February 2027

ISO 37001:2025 transition dates: who has to act, and by when

Any organisation holding an accredited ISO 37001:2016 certificate must complete a transition audit, and receive its certification body's decision, before 28 February 2027. After that date a 2016 certificate is no longer valid, whatever its printed expiry. Organisations still building a first anti-bribery management system should build it to the 2025 text: no initial certificate to the old edition has been possible since the end of August 2026.

The dates are set by IAF MD 30:2025, the mandatory transition requirements issued on 10 October 2025 by the international accreditation cooperation. That role passed to Global ACI on 1 January 2026, and the dates stand.

In practice, the audit already booked in your cycle sets the real deadline. If your next surveillance falls in late 2026, that visit is the natural place for the transition. If it falls after February 2027, a separate audit will be needed before the end date.

What ISO 37001:2025 changes

The Foreword of the 2025 edition names five changes, and the transition audit is required to cover all of them. The table sets each one against the place it now sits in the standard and the question worth asking of your own system.

Some commentators list further additions beyond these five. Treat any claim that is not in the Foreword with care until you have read the licensed 2025 text yourself; the Foreword is the list the certification body works from.

What stays the same in the 2025 edition

Training providers and certification bodies describe the second edition as keeping the structure and the core requirements of the first. The operational heart of the standard is still there under familiar titles: bribery risk assessment in 4.5, due diligence in 8.2, financial and non-financial controls in 8.3 and 8.4, commitments from business associates in 8.6, gifts and hospitality in 8.7, raising concerns in 8.9 and investigations in 8.10.

That matters for planning. A system that already runs well to the 2016 edition does not need a new manual, a new risk method or a fresh round of due diligence because the edition changed. The work is narrower: revisit the context review, strengthen what leaders do about culture, formalise conflicts of interest, confirm the function's standing, and align the wording.

The scope of the standard is also unchanged in one important respect: it covers bribery and nothing else. If your programme has grown to include fraud or money-laundering controls, the transition does not bring those into the certificate unless you choose to extend the system. How ISO 37001 compares with the wider compliance standard is covered in ISO 37001 vs ISO 37301: which one, or both?

How to plan the move from ISO 37001:2016

Treat the transition as a small project with an owner, usually the anti-bribery function, a sponsor from top management and a date agreed with the certification body.

1. Agree the audit that will carry the transition

Ask your certification body which visit it proposes, whether it plans additional audit time, and what it wants to see beforehand.

2. Compare the system with the 2025 text

Using a licensed copy of the new edition, check each of the five changes and every clause whose wording moved. Record what already conforms, what needs a light edit and what needs a genuine change in practice.

3. Make the changes in practice, not only on paper

Update the context review with the climate determination, give the culture subclause real content through leadership actions and communication, add conflict-of-interest declarations to hiring and periodic reviews, and refresh the function's mandate.

4. Audit and review against the new edition

Run an internal audit that samples the changed areas, have the anti-bribery function carry out its review, and hold a management review that records the transition as a decision item. These records are what the certification body will ask to see.

5. Close findings before the transition audit

Anything the internal audit raised should be corrected, with evidence, before the external visit.

The ISO 37001:2025 transition audit

IAF MD 30 requires the transition audit to include every change from the previous edition and to assess whether your management system needed to change as a result. The certification body can combine it with a surveillance audit or a recertification audit, or run it as a separate audit. Sterling does not certify; the decision to issue a 2025 certificate rests with the accredited certification body.

Expect the auditor to start with the five changes: the climate determination in the context review, evidence that leaders promote an anti-bribery culture, the conflict-of-interest arrangements in the employment process, and the standing and reports of the anti-bribery function.

The rest of the visit follows the audit type it is combined with. A recertification looks at the whole system; a surveillance audit samples it. For the full certification sequence, see ISO 37001 certification process, step by step.

What happens if the transition is left until early 2027

Certification bodies have finite audit capacity, and the last months before a fixed end date tend to fill first. An organisation that asks for a separate transition audit in January 2027 may find no auditor free before the deadline.

Findings raised at the transition audit also take time to close, and the body decides only once they are closed. If that process runs past 28 February 2027, the old certificate expires in the meantime.

ISO 37001:2025 changes and transition: questions buyers ask