Where we work · Argentina
ISO and GRC certification consulting in Argentina
Achieve ISO and GRC certification in Argentina with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Argentina
Clients include
ISO and GRC certification in Argentina at a glance
Argentina's certification market is shaped by a handful of public texts. Law 25.326 on personal data is supervised by the Agencia de Acceso a la Información Pública, and the European Commission's adequacy list still names Argentina. Law 27.401 makes an integrity programme a condition for certain contracts with the national State. The Código Alimentario Argentino sets HACCP guidelines and traceability duties, SENASA authorises export plants, ANMAT adopts the Mercosur manufacturing norm for medical devices, and the central bank sets technology and information-security rules for banks and payment providers. Demand comes from agro-food exporters, oil, gas and mining supply chains, vehicle makers, software and services exporters, financial firms and device manufacturers. The Organismo Argentino de Acreditación is listed by Global ACI as a full member and mutual recognition signatory. Certificates come from accredited certification bodies, never from Sterling. Sterling serves Argentine clients from its New York office, on-site where the work needs it and remotely otherwise, with 20+ years, 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Argentina
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Argentina (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley 25.326 de Protección de los Datos Personales — Personal Data Protection Law Agencia de Acceso a la Información Pública (AAIP), acting through its national data protection directorate (Dirección Nacional de Protección de Datos Personales), which keeps the Registro Nacional de Bases de Datos. | Covers personal data held in files, registers, databases or other technical means, public or private, and applies as far as pertinent to data about legal persons. Treatment needs the free, express and informed consent of the data subject, in writing or an equivalent form, with listed exceptions (public-access sources, legal duties, contractual relationships, bank operations); people must be told the purpose, recipients, the identity of the controller and their access, rectification and deletion rights when data is collected. Sensitive data cannot be required from anyone and may be collected only for reasons of general interest set by law or for statistical or scientific use without identification. Controllers must adopt technical and organisational measures for security and confidentiality, those involved in treatment owe professional secrecy, data may be assigned to third parties only with consent and under the same obligations, and a processor working for a third party may not use data beyond the service contract. International transfers to countries or bodies without adequate protection are prohibited, with listed exceptions. Private databases that are not for exclusively personal use must be registered, and the control authority may impose administrative sanctions, while the law also creates a habeas data court action. The law cites no ISO standard and creates no certificate of compliance. Penalties are set in the law and are not restated here. | |
| European Commission adequacy decision for Argentina (Decision 2003/490/EC) European Commission (decision); the AAIP is the Argentine authority for the law the decision assessed. | Under the Commission's description, an adequacy decision lets personal data flow from the EU and the EEA countries to the recognised country without further safeguards. This is a data-transfer fact for EU-facing Argentine businesses, not a certificate; whether a particular transfer needs further tools is a question for counsel. | |
| Ministerio de Salud (ANMAT) and the agriculture authorities (SENASA) under the Código Alimentario Argentino, Law 18.284 Food and beverage processing and trade | The Código Alimentario Argentino, Chapter II: Article 18 bis states that establishments that implement a HACCP system must follow the Code's HACCP guidelines, which are mandatory for products for which the Code requires HACCP and optional for the others; Article 18 tris makes every person, firm or establishment that processes, distributes, imports or sells food responsible for documented traceability procedures; Article 18 tris 1 requires a documented product withdrawal plan, excluding retail outlets and restaurants. | HACCP |
| Servicio Nacional de Sanidad y Calidad Agroalimentaria (SENASA) Exporters of food and other animal-origin products | SENASA's procedures: an establishment must hold SENASA registration and authorisation for federal transit before it can request authorisation for a specific export destination, and only products within the establishment's authorised categories can be exported. For dairy exports SENASA states that it certifies shipments only from authorised establishments, whose requirements include Decree 2687/77 and the Mercosur GMC Resolution 80/96 good manufacturing practices norm. | |
| Administración Nacional de Medicamentos, Alimentos y Tecnología Médica (ANMAT), Ministerio de Salud Medical devices and in vitro diagnostic products (manufacture) | Disposición ANMAT 3266/2013 (Boletín Oficial, 7 June 2013) incorporates Mercosur GMC Resolution 20/11, the technical regulation on good manufacturing practices for medical devices and in vitro diagnostic products. It requires each manufacturer to establish and maintain a quality system, with a measurable quality policy, a management representative, management review, a continuous risk management process over the product life cycle, supplier controls and document control. It does not name ISO 13485. | |
| Banco Central de la República Argentina (BCRA) Banks, systemic payment systems and payment service providers | BCRA consolidated text 'Requisitos mínimos para la gestión y control de los riesgos de tecnología y seguridad de la información' (text updated to February 2026, last communication incorporated 'A' 8401). It applies to financial entities, the systemic payment systems it names and payment service providers in the BCRA register, and has sections on governance, risk management, information security, business continuity, technology infrastructure, cyber-incident management, software development and relations with third parties. It names no ISO standard and refers generically to international frameworks and standards. | |
| Criminal courts under Law 27.401 (Régimen de Responsabilidad Penal aplicable a las Personas Jurídicas Privadas) Companies that deal with the public sector or run corruption-exposed operations | Law 27.401 (Boletín Oficial, 1 December 2017): Articles 22 and 23 describe the integrity programme, which must fit the company's risks, size and economic capacity and must contain at least a code of ethics or conduct, specific rules for tenders and public-sector interaction, and periodic training, with further elements such as risk analysis, reporting channels, whistleblower protection, third-party due diligence and an internal officer. Article 24 makes an adequate programme a necessary condition for certain contracts with the national State. The law names no ISO standard. | |
| Superintendencia de Riesgos del Trabajo (SRT) Employers (occupational safety and health) | SRT Resolution 103/2005 adopted the ILO-OSH 2001 guidelines as the reference framework for employers' occupational safety and health management systems, and Resolution 523/2007 approved the national guidelines for such systems, with sections on policy, worker participation, planning, hazard prevention, evaluation and continual improvement. Neither text names ISO 45001. | |
| Environmental authorities under Law 25.675 (Ley General del Ambiente), including the national environment authority and the provinces Industry and any activity that may significantly degrade the environment | Law 25.675 (Boletín Oficial, 28 November 2002): works or activities likely to degrade the environment significantly are subject to an environmental impact assessment before they start, and anyone carrying out activities risky to the environment must take out insurance with enough capacity to finance recomposition of the damage. It sets minimum budgets and names no ISO standard. | |
| Secretaría de Energía, Ministerio de Economía Energy users in industry | The Secretaría de Energía's energy-efficiency programme for productive sectors promotes ISO 50001 energy management systems: its May 2023 news item describes the ninth learning network in energy management systems, with an introduction to ISO 50001:2018 and the phases of implementation, and its December 2021 news item reports an award recognising companies that implement and certify ISO 50001. These are promotion activities, not a legal duty. | ISO 50001 |
| Jefatura de Gabinete de Ministros, with the national cybersecurity directorate National public bodies and their suppliers (information security) | Decisión Administrativa 641/2021, 'Requisitos mínimos de Seguridad de la Información para Organismos' (Boletín Oficial, 28 June 2021). Its Article 2 applies it to the bodies of the national public sector listed in Article 8(a) of Law 24.156 and to providers that contract with them, for the tasks they carry out, and Article 7 requires incident reports to the national cybersecurity directorate within 48 hours. It names no ISO standard, only national and international good practice and standards generally. | |
| Subsecretaría de Tecnologías de la Información, Jefatura de Gabinete de Ministros Organisations that design or use artificial intelligence | Disposición 2/2023 (Boletín Oficial, 2 June 2023) approves the 'Recomendaciones para una Inteligencia Artificial Fiable' annexed to it. The text calls them recommendations and does not name an ISO standard. | |
| Instituto Nacional de Estadística y Censos (INDEC) Foreign trade statistics (export mix) | INDEC's trade report (Intercambio comercial argentino. Bienes) for June 2026 gives the export mix for the first half of 2026: agro-industrial manufactures 32.0% of goods exports, industrial manufactures 27.1%, primary products 25.5% and fuels and energy 15.4%. It also reports separately on the automotive sector and soy-related products. |
Accreditation and recognition
- Organismo Argentino de Acreditación (OAA): National accreditation body — OAA's own site describes it as Argentina's sole national accreditation body, accrediting testing, calibration and clinical laboratories, certification and inspection bodies, reference material producers and proficiency testing providers; it also runs the monitoring of good laboratory practice for the OECD and keeps a public register of accredited entities.
- Instituto Argentino de Normalización y Certificación (IRAM): National standards institute — standards-development role only. IRAM's own site describes a private non-profit civil association founded in 1935 that develops Argentine standards and is Argentina's representative of ISO. It is not an accreditation body, and this record uses it for standards only.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Integrity programme condition for contracts with the national State (Law 27.401 (Congreso de la Nación), applied by the contracting national bodies): Article 24 makes the existence of an adequate integrity programme, as Articles 22 and 23 describe it, a necessary condition for contracts that by amount need approval at minister rank or above and that fall within Article 4 of Decree 1023/01 or are governed by Laws 13.064, 17.520 and 27.328, and for public-service concession or licence contracts. It asks for the programme, not for an ISO certificate.
- Information security requirements for providers to the national public sector (Jefatura de Gabinete de Ministros, Decisión Administrativa 641/2021): The decision applies its minimum information-security requirements to national public bodies and to providers that contract with them, for the tasks they carry out; each contract and tender sets its own detailed requirements, and the decision names no ISO standard.
Economic zones
- Zonas francas (free zones) under Law 24.331:
- Régimen de Incentivo para Grandes Inversiones (RIGI): forestry industry, tourism, infrastructure, mining, technology, steel, energy, oil and gas
- Régimen de Promoción de la Economía del Conocimiento (a tax and registration regime, not a physical zone): software and digital services, audiovisual production, biotechnology, aerospace and satellite, professional services exported, industry 4.0 automation
Sterling in Argentina
Sterling delivers in Argentina from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Argentina clients ask
Who supervises personal data protection in Argentina?
The Agencia de Acceso a la Información Pública, or AAIP, is the application authority for Law 25.326, the personal data protection law. Decree 746 of 25 September 2017 gave it that role, and its national data protection directorate keeps the register of databases. Duties can change, so confirm current obligations with the AAIP or your counsel.
Which body accredits certification bodies in Argentina?
The Organismo Argentino de Acreditación, OAA, which describes itself as the sole national accreditation body. Global ACI lists it as a full member and mutual recognition signatory, with ISO 9001 and ISO 14001 recognised from 2005 and ISO 45001 and ISO 13485 from July 2025. Scope matters, so ask any certification body for its accreditation certificate.
Are certification audits in Argentina conducted in English?
Often, for exporters and multinationals, although Argentine statutes, regulator resolutions and accreditation documents are in Spanish. Many audits run in both languages. Settle the audit language, any interpreter and the language of your controlled documents with the certification body when you apply, and mention early if shop-floor interviews will be in Spanish.
Do Argentine public contracts require an integrity programme?
For some national contracts, yes. Law 27.401 makes an adequate integrity programme a necessary condition for contracts that need approval at minister rank or above and fall within the listed procurement, public-works and concession rules. The law requires a programme with a code of conduct, tender rules and training, not an ISO certificate. Check the tender documents.
Does the Argentine food code require HACCP?
It depends on the product. The Código Alimentario Argentino says its HACCP guidelines are mandatory where the Code requires a HACCP system for a product and optional elsewhere, and it also imposes traceability and withdrawal-plan duties on food businesses. Which of your products fall under a HACCP requirement is a question for the health authority or your counsel.
Does the Argentine central bank require ISO 27001 from banks and payment firms?
Not by name. The BCRA's minimum requirements for technology and information-security risk apply to financial entities, named systemic payment systems and registered payment service providers, and cover governance, security, continuity and third-party relationships, but they name no ISO standard. ISO 27001 can still help evidence those controls to a bank customer or inspector.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley 25.326 de Protección de los Datos Personales — Personal Data Protection Law — argentina.gob.ar (accessed 18 Oct 2026)
- European Commission adequacy decision for Argentina (Decision 2003/490/EC) — eur-lex.europa.eu; commission.europa.eu (accessed 18 Oct 2026)
- The Código Alimentario Argentino, Chapter II: Article 18 bis states that establishments that implement a HACCP system must follow the Code's HACCP guidelines, which are mandatory for products for which the Code requires HACCP and optional for the others; Article 18 tris makes every person, firm or establishment that processes, distributes, imports or sells food responsible for documented traceability procedures; Article 18 tris 1 requires a documented product withdrawal plan, excluding retail outlets and restaurants. — argentina.gob.ar (accessed 18 Oct 2026)
- SENASA's procedures: an establishment must hold SENASA registration and authorisation for federal transit before it can request authorisation for a specific export destination, and only products within the establishment's authorised categories can be exported. For dairy exports SENASA states that it certifies shipments only from authorised establishments, whose requirements include Decree 2687/77 and the Mercosur GMC Resolution 80/96 good manufacturing practices norm. — argentina.gob.ar (accessed 18 Oct 2026)
- Disposición ANMAT 3266/2013 (Boletín Oficial, 7 June 2013) incorporates Mercosur GMC Resolution 20/11, the technical regulation on good manufacturing practices for medical devices and in vitro diagnostic products. It requires each manufacturer to establish and maintain a quality system, with a measurable quality policy, a management representative, management review, a continuous risk management process over the product life cycle, supplier controls and document control. It does not name ISO 13485. — argentina.gob.ar (accessed 18 Oct 2026)
- BCRA consolidated text 'Requisitos mínimos para la gestión y control de los riesgos de tecnología y seguridad de la información' (text updated to February 2026, last communication incorporated 'A' 8401). It applies to financial entities, the systemic payment systems it names and payment service providers in the BCRA register, and has sections on governance, risk management, information security, business continuity, technology infrastructure, cyber-incident management, software development and relations with third parties. It names no ISO standard and refers generically to international frameworks and standards. — bcra.gob.ar (accessed 18 Oct 2026)
- Law 27.401 (Boletín Oficial, 1 December 2017): Articles 22 and 23 describe the integrity programme, which must fit the company's risks, size and economic capacity and must contain at least a code of ethics or conduct, specific rules for tenders and public-sector interaction, and periodic training, with further elements such as risk analysis, reporting channels, whistleblower protection, third-party due diligence and an internal officer. Article 24 makes an adequate programme a necessary condition for certain contracts with the national State. The law names no ISO standard. — argentina.gob.ar (accessed 18 Oct 2026)
- SRT Resolution 103/2005 adopted the ILO-OSH 2001 guidelines as the reference framework for employers' occupational safety and health management systems, and Resolution 523/2007 approved the national guidelines for such systems, with sections on policy, worker participation, planning, hazard prevention, evaluation and continual improvement. Neither text names ISO 45001. — argentina.gob.ar (accessed 18 Oct 2026)
- Law 25.675 (Boletín Oficial, 28 November 2002): works or activities likely to degrade the environment significantly are subject to an environmental impact assessment before they start, and anyone carrying out activities risky to the environment must take out insurance with enough capacity to finance recomposition of the damage. It sets minimum budgets and names no ISO standard. — argentina.gob.ar (accessed 18 Oct 2026)
- The Secretaría de Energía's energy-efficiency programme for productive sectors promotes ISO 50001 energy management systems: its May 2023 news item describes the ninth learning network in energy management systems, with an introduction to ISO 50001:2018 and the phases of implementation, and its December 2021 news item reports an award recognising companies that implement and certify ISO 50001. These are promotion activities, not a legal duty. — argentina.gob.ar (accessed 18 Oct 2026)
- Decisión Administrativa 641/2021, 'Requisitos mínimos de Seguridad de la Información para Organismos' (Boletín Oficial, 28 June 2021). Its Article 2 applies it to the bodies of the national public sector listed in Article 8(a) of Law 24.156 and to providers that contract with them, for the tasks they carry out, and Article 7 requires incident reports to the national cybersecurity directorate within 48 hours. It names no ISO standard, only national and international good practice and standards generally. — boletinoficial.gob.ar; argentina.gob.ar (accessed 18 Oct 2026)
- Disposición 2/2023 (Boletín Oficial, 2 June 2023) approves the 'Recomendaciones para una Inteligencia Artificial Fiable' annexed to it. The text calls them recommendations and does not name an ISO standard. — boletinoficial.gob.ar (accessed 18 Oct 2026)
- INDEC's trade report (Intercambio comercial argentino. Bienes) for June 2026 gives the export mix for the first half of 2026: agro-industrial manufactures 32.0% of goods exports, industrial manufactures 27.1%, primary products 25.5% and fuels and energy 15.4%. It also reports separately on the automotive sector and soy-related products. — indec.gob.ar (accessed 18 Oct 2026)
- Organismo Argentino de Acreditación (OAA) — oaa.org.ar; global-aci.org (accessed 18 Oct 2026)
- Instituto Argentino de Normalización y Certificación (IRAM) — iram.org.ar (accessed 18 Oct 2026)
- Zonas francas (free zones) under Law 24.331 — argentina.gob.ar (accessed 18 Oct 2026)
- Régimen de Incentivo para Grandes Inversiones (RIGI) — argentina.gob.ar; arca.gob.ar (accessed 18 Oct 2026)
- Régimen de Promoción de la Economía del Conocimiento (a tax and registration regime, not a physical zone) — argentina.gob.ar (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice