Where we work · Belgium
ISO and GRC certification consulting in Belgium
Achieve ISO and GRC certification in Belgium with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Belgium
Clients include
ISO and GRC certification in Belgium at a glance
Belgian demand for certification is driven less by one rule than by several regulators working side by side. The Centre for Cybersecurity Belgium enforces the NIS2 Law of 26 April 2024, in force since 18 October 2024, and accepts CyberFundamentals or ISO/IEC 27001 as the reference for conformity assessment. The Gegevensbeschermingsautoriteit (Autorité de protection des données) supervises the GDPR under the law of 3 December 2017 and the Act of 30 July 2018. Financial entities answer to the National Bank of Belgium under DORA, medical device distributors register with the FAMHP, and food businesses run a mandatory self-checking system based on HACCP principles that the FASFC lets them have validated by an accredited certification body. Certificates come from certification bodies accredited by BELAC, the national accreditation body, never from Sterling. Demand is strongest in IT and managed services, financial services, life sciences, logistics around the Port of Antwerp-Bruges and Brucargo, chemicals and food. Sterling serves Belgian clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Belgium
Each page covers who needs the standard in Belgium, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Belgium (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the law establishing the Data Protection Authority Gegevensbeschermingsautoriteit / Autorité de protection des données (APD-GBA) — Article 4 of the 2017 law makes it the competent supervisory authority unless another law provides otherwise | The 2017 law makes the Authority responsible for supervising compliance with the basic principles of personal data protection across the whole Kingdom. Its website offers three routes: a request for information, a request for mediation and a complaint. A revised organic law applies to complaints, mediation files, requests, inspections and Litigation Chamber procedures that began on or after 1 June 2024. | |
| Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data Gegevensbeschermingsautoriteit / Autorité de protection des données (APD-GBA) | The Act applies to processing by automated means and to non-automated processing of data in a filing system. It applies to processing in the context of an establishment of a controller or processor on Belgian territory, and to processing of data of people who are in Belgium by a controller or processor outside the EU where that processing relates to offering goods or services to them or monitoring their behaviour in Belgium. | |
| Centre for Cybersecurity Belgium (CCB) — national cybersecurity authority and national CSIRT, supported by sectoral authorities Essential and important entities under NIS2 (energy, transport, health, digital infrastructure and other listed sectors) | Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (the NIS2 Law), in force since 18 October 2024 per the CCB, and its Royal Decree. Conformity assessment is mandatory for essential entities and voluntary for others; entities can use CyberFundamentals (CyFun) or ISO/IEC 27001 as the reference framework. The CCB's guidance on the 18 April 2026 milestone sets out what each route asks for. | ISO/IEC 27001 |
| National Bank of Belgium (NBB) Financial entities (credit institutions, insurers, payment and e-money institutions and others in DORA's scope) | Regulation (EU) 2022/2554 (DORA), applied to financial entities since 17 January 2025. The Bank supervises compliance, runs TIBER-BE as the threat-led penetration testing authority and says DORA prevails over NIS2 where they overlap. The Bank's report does not name ISO/IEC 27001 or ISO 22301. | |
| Federal Agency for Medicines and Health Products (FAMHP / AFMPS) Medical device distributors and importers | Regulation (EU) 2017/745 as applied through the FAMHP web portal: distributors register, and operators who relabel or repackage must send a notified body certificate showing that their quality management system meets Article 16(3). The FAMHP page does not name ISO 13485. | |
| Federal Agency for the Safety of the Food Chain (FASFC / AFSCA) Food and feed businesses | Self-checking system under the Royal Decree of 14 November 2003: applying it is mandatory and, for food safety, it must be based on HACCP principles. Validation by an accredited independent certification body is voluntary and requires an approved sector guide; the FASFC says validated systems can earn a reduced annual contribution and a lower inspection frequency. | HACCP |
| Federal State and the Flemish, Walloon and Brussels-Capital Regions Environmental management (EMAS) | Cooperation agreement on implementing Regulation (EC) No 1221/2009 (EMAS), listed with the BELAC legal documents. It concerns the EU eco-management and audit scheme and does not name ISO 14001. |
Accreditation and recognition
- BELAC (Belgian accreditation system, published by FPS Economy): National accreditation body — the BELAC system for accreditation of conformity assessment bodies was created by Royal Decree of 31 January 2006; European co-operation for Accreditation describes it as Belgium's National Accreditation Body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Port of Antwerp-Bruges: chemicals and petrochemicals, logistics and shipping, liquefied natural gas storage and transshipment
- Brucargo (Brussels Airport logistics zone): air cargo and logistics, pharmaceuticals, perishables, e-commerce
- Flanders life sciences and health ecosystem: biopharma, biotechnology, health technology
Sterling in Belgium
Sterling delivers in Belgium from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Belgium, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Belgian clients ask
Are certification audits in Belgium conducted in Dutch, French or English?
By agreement with the certification body. Belgium has three official languages, Dutch, French and German, and English is common in business, so say at application which language you want for the audit and for controlled documents. Follow any language requirement written into a contract or a regulator's procedure, and confirm the arrangement before the audit is scheduled.
Which accreditation body should a certification body hold for Belgium?
BELAC, the Belgian national accreditation body whose system was created by Royal Decree of 31 January 2006. European co-operation for Accreditation lists it as an EA MLA signatory, including for certification of management systems under ISO/IEC 17021-1. Recognition is scope by scope, so check the certification body's BELAC scope for the standard you need.
Is the Belgian NIS2 law already in force?
Yes, per the Centre for Cybersecurity Belgium. Its page says the Law of 26 April 2024, transposing Directive (EU) 2022/2555, entered into force on 18 October 2024, and a Royal Decree implementing it has been adopted. Entities then work out whether they are essential or important, which depends on the legal tests; the CCB or your counsel can confirm.
Which authority supervises the GDPR in Belgium?
The Gegevensbeschermingsautoriteit (Autorité de protection des données in French). Under Article 4 of the law of 3 December 2017 it is the competent supervisory authority unless another law says otherwise. Individuals reach it through three routes on its website: an information request, a mediation request or a complaint. Ask the Authority or your counsel about a particular processing activity.
Can ISO/IEC 27001 be used to show NIS2 conformity in Belgium?
Yes, as one of two routes. The CCB says entities can use CyberFundamentals or ISO/IEC 27001 as the reference framework, and its guidance for the ISO route asks for the certification scope, the Statement of Applicability and the latest internal audit report. A direct inspection route also exists. Confirm which route suits your entity with the CCB.
Does Belgian food-safety law require HACCP certification?
Not a certificate, but a system. Applying a self-checking system is mandatory and, for food safety, it must be based on HACCP principles. Validation by an accredited independent certification body is voluntary and needs an approved sector guide; the FASFC says validated systems can earn a reduced contribution and fewer inspections. Check your sector guide with the FASFC.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the law establishing the Data Protection Authority — dataprotectionauthority.be (accessed 7 Oct 2026)
- Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data — dataprotectionauthority.be (accessed 7 Oct 2026)
- Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (the NIS2 Law), in force since 18 October 2024 per the CCB, and its Royal Decree. Conformity assessment is mandatory for essential entities and voluntary for others; entities can use CyberFundamentals (CyFun) or ISO/IEC 27001 as the reference framework. The CCB's guidance on the 18 April 2026 milestone sets out what each route asks for. — ccb.belgium.be (accessed 7 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), applied to financial entities since 17 January 2025. The Bank supervises compliance, runs TIBER-BE as the threat-led penetration testing authority and says DORA prevails over NIS2 where they overlap. The Bank's report does not name ISO/IEC 27001 or ISO 22301. — nbb.be (accessed 7 Oct 2026)
- Regulation (EU) 2017/745 as applied through the FAMHP web portal: distributors register, and operators who relabel or repackage must send a notified body certificate showing that their quality management system meets Article 16(3). The FAMHP page does not name ISO 13485. — afmps.be (accessed 7 Oct 2026)
- Self-checking system under the Royal Decree of 14 November 2003: applying it is mandatory and, for food safety, it must be based on HACCP principles. Validation by an accredited independent certification body is voluntary and requires an approved sector guide; the FASFC says validated systems can earn a reduced annual contribution and a lower inspection frequency. — fasfc.be (accessed 7 Oct 2026)
- Cooperation agreement on implementing Regulation (EC) No 1221/2009 (EMAS), listed with the BELAC legal documents. It concerns the EU eco-management and audit scheme and does not name ISO 14001. — economie.fgov.be (accessed 7 Oct 2026)
- BELAC (Belgian accreditation system, published by FPS Economy) — economie.fgov.be; european-accreditation.org; ilac.org (accessed 7 Oct 2026)
- Port of Antwerp-Bruges — portofantwerpbruges.com (accessed 7 Oct 2026)
- Brucargo (Brussels Airport logistics zone) — brusselsairport.be (accessed 7 Oct 2026)
- Flanders life sciences and health ecosystem — invest.flandersinvestmentandtrade.com (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice