Where we work · Armenia
ISO and GRC certification consulting in Armenia
Achieve ISO and GRC certification in Armenia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Armenia
- Ores, metals and other mining-linked exporters
- Jewellery, precious-metal and gem processors
- Electronics, electrical and precision-engineering manufacturers
- Beverage, tobacco and other food and agri-food producers and exporters
- Banks, payment institutions and other financial organisations
- Information technology and software firms
Clients include
ISO and GRC certification in Armenia at a glance
Armenia's Law on Cybersecurity (No. HO-442-N), adopted on 4 December 2025 and shown by ARLIS as active from 4 January 2026, now sits beside the Law on Protection of Personal Data (No. HO-49-N), whose processor registry the Ministry of Justice's Personal Data Protection Agency keeps. Operators of critical information infrastructure must undergo cybersecurity audits against an applicable standard, with ISO named as an example. Food producers answer to the Food Safety Inspection Body, whose HACCP page rests on a Government decision and a Customs Union Commission decision. ARMNAB, the National Accreditation Body, is listed in the EA directory as an MLA signatory for calibration, testing and management system certification. Public tenders under the Law on Procurement set bidder criteria without a quality certificate, so demand follows export buyers in ores, jewellery, electronics, beverages and food, plus banks and information technology firms. Sterling, with 8,100+ client engagements in 60+ countries and 20+ years of practice, serves Armenian organisations from its Dubai office, on-site where the work needs it and remotely otherwise, with Effivity and Sterling Academy included. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Armenia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Armenia (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of the Republic of Armenia on Protection of Personal Data, No. HO-49-N The authorised body for the protection of personal data, which Article 24 says operates independently. The Ministry of Justice's page describes the Personal Data Protection Agency as a separate subdivision of the Ministry that keeps the registry of entities processing personal data and protects the rights of data subjects. Article 24 lists its powers: checking compliance on its own initiative or on application, applying administrative sanctions, requiring blocking, suspension or termination of unlawful processing, keeping the register of processors and publishing an annual public report | The Law regulates the processing of personal data by state and local bodies, institutions, legal persons and natural persons. Processing is lawful where the data subject has consented or the data come from publicly available sources, and consent is given in writing or electronically with a digital signature, with the burden of proving it on the processor (Articles 8 and 9). Special category and biometric data need consent unless a law provides otherwise (Articles 12 and 13), and the processor notifies the authorised body before processing them (Article 23). Processors that use an authorised person do so under a written assignment (Article 14), must keep data secure and confidential (Article 19), and must publish an announcement and report to the Police and the authorised body when data leak from electronic systems (Article 21). Transfers abroad rest on the data subject's consent or the purposes of processing, and go without permission to states that ensure adequate protection, otherwise with the authorised body's permission (Article 27). Counsel should confirm which amendments after the English text apply to your processing. | |
| Law of the Republic of Armenia on Cybersecurity, No. HO-442-N The Law gives roles to an authorised body, the state administration body for the relevant policy sectors, and to an autonomous body, the Information Systems Regulatory Commission provided for by the Law on the information systems regulatory body. The autonomous body runs the National CERT, keeps the register of service providers and the cyber incident registry, and supervises service providers together with their sector regulators | Service providers must meet the minimum cybersecurity requirements and notify cyber incidents to the autonomous body without delay. Operators of critical information infrastructure must also undergo cybersecurity audits on the basis of an applicable international standard, with a standard of the International Organization for Standardization given as an example and the list of applicable standards to be set by the Government, and must submit a document certifying compliance with an international or national cybersecurity standard within the period the transitional provisions set. The Law is a cybersecurity framework, not a privacy law, and it does not name ISO/IEC 27001; an ISO 27001 certificate is evidence of an information security management system, not proof of compliance with the Law. | |
| Food Safety Inspection Body of the Republic of Armenia Food producers, processors, caterers and exporters | The Body's history page says it ensures food safety through food and feed safety, veterinary and phytosanitary responsibilities, and records that it was renamed the RA Food Safety Inspection Body in 2019. Its HACCP page states that certain large producers of meat, fish, fruit and vegetable, dairy and dietary products had to implement a system of hygienic production and hazard analysis and critical control points under Government Decision No. 827-N of 23 July 2015, and quotes the Customs Union Commission Decision No. 880 of 9 December 2011 on food safety, which requires manufacturers to develop, implement and maintain procedures based on HACCP principles. Its registry page lists food production facilities subject to state registration. | HACCP |
| Scientific Center of Drug and Medical Technologies Expertise (SCDMTE), accountable to the Ministry of Health Medicine and medical device manufacturers, importers and exporters | The Centre's page lists expert assessment of medicines, and of medical devices for the purpose of state registration, and professional expertise of medicines for certification of their import and export. The page does not name ISO 13485 or good manufacturing practice. | |
| Central Bank of Armenia Banks, payment institutions, insurers and other financial organisations | The Central Bank describes risk-based regulation and supervision of banks, insurance companies, payment institutions, crypto-asset service providers and other financial organisations, with regulatory standards that cover risk management practices including operational risk, corporate governance, consumer protection and market conduct. It licenses and supervises payment institutions, including money transfer institutions and processing and clearing institutions, and states that supervision assesses regulatory compliance and operational resilience. The pages do not name ISO/IEC 27001 or PCI DSS. | |
| The inspection body that Article 262 of the Labour Code charges with supervising safety assurance and healthcare of employees Employers (occupational safety and health) | Labour Code Article 243 obliges the employer to maintain the safety and health of employees and, depending on the danger of the work, to include a qualified safety service or carry out that function personally. Article 261 requires the employer to record occupational diseases and accidents, and Government Decision No. 458-N of 23 March 2006, active on ARLIS, sets the procedure for recording and officially investigating them. Neither names ISO 45001. | |
| Ministry of Environment of the Republic of Armenia Industrial and mining operators with environmental impact | The Ministry's news item of 18 April 2026 describes amendments to the Laws "On Environmental Impact Assessment and Expertise" and "On State Duty", which align domestic law with the Aarhus and Espoo Conventions and make strategic environmental assessment procedures more targeted and flexible. It does not name ISO 14001. | |
| Information Systems Regulatory Commission, with the sector regulator of each service provider Operators of critical information infrastructure and cybersecurity service providers | Law No. HO-442-N on Cybersecurity (Articles 17, 19 and 20 and the final part) requires cybersecurity audits against an applicable international or national standard, lets cybersecurity services be delegated to providers holding a document certifying compliance with such a standard, and requires critical information infrastructure operators and cybersecurity service providers to submit such a document within the transitional period. The Government sets the list of applicable standards. | |
| National Body for Standards and Metrology under the Ministry of Economy (standards role only) Manufacturers and standards users | The Body's site, under the Ministry of Economy heading, carries the catalogue of standards, the annual state standardisation programme, draft national standards, lists of standards that ensure enforcement of technical regulations and technical commissions. This is its standards role as the site presents it. |
Accreditation and recognition
- National Accreditation Body (ARMNAB), operating under the Ministry of Economy of the Republic of Armenia: National accreditation body of the Republic of Armenia; the Law on Accreditation (No. HO-20-N of 8 February 2012) defines it as the sole body created by the Government with the power to accredit conformity assessment bodies, and sets voluntariness among the principles of accreditation unless legislation provides otherwise.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law of the Republic of Armenia on Procurement, No. HO-21-N of 16 December 2016 (Contracting authorities, which include public administration and local self-government bodies, state and community institutions, state or community non-commercial organisations, organisations with more than half of their shares held by the state or a community, and the Central Bank): Article 6 sets the qualification criteria a bidder must meet as set by the invitation: compliance of professional activities with the contract, professional experience, technical resources, financial resources and labour resources, and bars any criterion that the Article does not provide for. A management system certificate is therefore not a criterion in itself. Article 6 also makes a bidder ineligible if it, or a representative of its executive body, was convicted within the look-back period the Article sets of crimes that include giving or receiving a bribe. Article 13 requires the description of the subject of procurement to set out quality, standard and safety characteristics based on international standards and the standards effective in Armenia where possible.
Economic zones
- Alliance Free Economic Zone, Yerevan: electronics and microelectronics, precision engineering and instrument making, pharmaceuticals and biotechnology, information technology and software, alternative energy and energy-saving technologies, telecommunications equipment
Sterling in Armenia
Sterling delivers in Armenia from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Armenia clients ask
Is there a personal data law in Armenia, and which body supervises it?
Yes. The Law on Protection of Personal Data (No. HO-49-N) was adopted on 18 May 2015 and has been in force since 1 July 2015. Its authorised body acts independently; the Ministry of Justice describes the Personal Data Protection Agency as a separate subdivision that keeps the registry of processors and protects data subjects' rights. Ask counsel which amendments after the English text apply to your processing.
Does the Law on Cybersecurity require an ISO certificate?
It requires audit and compliance evidence against an applicable standard rather than naming one certificate. Operators of critical information infrastructure undergo cybersecurity audits on the basis of an international or national standard, ISO being given as an example, and the Government sets the list of applicable standards. Check the list and your sector regulator's requirements before choosing an ISO 27001 scope.
Which body accredits certification bodies in Armenia?
The National Accreditation Body, ARMNAB, is the sole body the Government created to accredit conformity assessment bodies. The EA directory lists it as an MLA signatory for calibration, testing and management system certification. For any standard, ask the certification body for its accreditation certificate and scope, and confirm that your buyer accepts the accreditation behind it.
Do Armenian public tenders require ISO certification?
Not as a stand-alone rule. Article 6 of the Law on Procurement lists professional activity, experience, technical, financial and labour resources as the qualification criteria and bars criteria the Article does not provide for. Specifications can still call for quality and safety characteristics based on international standards, so read each invitation for what the contracting authority asks.
Is HACCP compulsory for food producers in Armenia?
For some producers, yes. The Food Safety Inspection Body's page says certain large producers of meat, fish, fruit and vegetable, dairy and dietary foods had to implement HACCP under Government Decision No. 827-N of 2015, and a Customs Union Commission decision requires manufacturers to keep procedures based on HACCP principles. Check which instrument covers your product with the Inspection Body.
Which days should be avoided when scheduling audits in Armenia?
Avoid Saturdays and Sundays for office-based work and the non-working holidays and commemoration days that the national calendar sets by law. The Labour Code bars work on those days except in listed cases, and Sunday is the common rest day. Continuous-process sites run shift schedules, so agree on-site dates with the certification body early.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of the Republic of Armenia on Protection of Personal Data, No. HO-49-N — arlis.am; translation-centre.am; moj.am (accessed 18 Oct 2026)
- Law of the Republic of Armenia on Cybersecurity, No. HO-442-N — arlis.am (accessed 18 Oct 2026)
- The Body's history page says it ensures food safety through food and feed safety, veterinary and phytosanitary responsibilities, and records that it was renamed the RA Food Safety Inspection Body in 2019. Its HACCP page states that certain large producers of meat, fish, fruit and vegetable, dairy and dietary products had to implement a system of hygienic production and hazard analysis and critical control points under Government Decision No. 827-N of 23 July 2015, and quotes the Customs Union Commission Decision No. 880 of 9 December 2011 on food safety, which requires manufacturers to develop, implement and maintain procedures based on HACCP principles. Its registry page lists food production facilities subject to state registration — snund.am (accessed 18 Oct 2026)
- The Centre's page lists expert assessment of medicines, and of medical devices for the purpose of state registration, and professional expertise of medicines for certification of their import and export. The page does not name ISO 13485 or good manufacturing practice — pharm.am (accessed 18 Oct 2026)
- The Central Bank describes risk-based regulation and supervision of banks, insurance companies, payment institutions, crypto-asset service providers and other financial organisations, with regulatory standards that cover risk management practices including operational risk, corporate governance, consumer protection and market conduct. It licenses and supervises payment institutions, including money transfer institutions and processing and clearing institutions, and states that supervision assesses regulatory compliance and operational resilience. The pages do not name ISO/IEC 27001 or PCI DSS — cba.am (accessed 18 Oct 2026)
- Labour Code Article 243 obliges the employer to maintain the safety and health of employees and, depending on the danger of the work, to include a qualified safety service or carry out that function personally. Article 261 requires the employer to record occupational diseases and accidents, and Government Decision No. 458-N of 23 March 2006, active on ARLIS, sets the procedure for recording and officially investigating them. Neither names ISO 45001 — translation-centre.am; arlis.am (accessed 18 Oct 2026)
- The Ministry's news item of 18 April 2026 describes amendments to the Laws "On Environmental Impact Assessment and Expertise" and "On State Duty", which align domestic law with the Aarhus and Espoo Conventions and make strategic environmental assessment procedures more targeted and flexible. It does not name ISO 14001 — environment.gov.am (accessed 18 Oct 2026)
- Law No. HO-442-N on Cybersecurity (Articles 17, 19 and 20 and the final part) requires cybersecurity audits against an applicable international or national standard, lets cybersecurity services be delegated to providers holding a document certifying compliance with such a standard, and requires critical information infrastructure operators and cybersecurity service providers to submit such a document within the transitional period. The Government sets the list of applicable standards — arlis.am (accessed 18 Oct 2026)
- The Body's site, under the Ministry of Economy heading, carries the catalogue of standards, the annual state standardisation programme, draft national standards, lists of standards that ensure enforcement of technical regulations and technical commissions. This is its standards role as the site presents it — armstandard.am (accessed 18 Oct 2026)
- National Accreditation Body (ARMNAB), operating under the Ministry of Economy of the Republic of Armenia — armnab.am; european-accreditation.org; website.armnab.am (accessed 18 Oct 2026)
- Public procurement under the Law of the Republic of Armenia on Procurement, No. HO-21-N of 16 December 2016 — translation-centre.am (accessed 18 Oct 2026)
- Alliance Free Economic Zone, Yerevan — fez.am (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice