Where we work · Bosnia and Herzegovina
ISO and GRC certification consulting in Bosnia and Herzegovina
Achieve ISO and GRC certification in Bosnia and Herzegovina with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Bosnia and Herzegovina
Clients include
ISO and GRC certification in Bosnia and Herzegovina at a glance
Bosnia and Herzegovina's Law on Personal Data Protection, published in Official Gazette No. 12/25 and aligned by its own terms with the GDPR, is supervised by the Personal Data Protection Agency, which has inspectors and a complaints procedure. Banks seated in Republika Srpska now work under a 2025 Banking Agency decision that tells them to contract only with ICT providers applying recognised security standards and to seek independent assurance. Food operators follow the Rulebook on Food Hygiene, which requires HACCP-based procedures after primary production, and exporters of animal products deal with the Veterinary Office. Medical device makers register with ALMBiH, and laboratories are accredited by the Institute for Accreditation (BATA), while management system certificates usually carry accreditation from another economy within the international arrangements. Statistics for 2025 put manufactured articles, metal and wood goods and machinery among the largest exports. Sterling serves clients across the country from its Frankfurt office, on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries and 20+ years of experience, and Effivity and Sterling Academy included with the engagement. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Bosnia and Herzegovina
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Bosnia and Herzegovina (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law on Personal Data Protection (Zakon o zaštiti ličnih podataka) Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini; the Agency) — Article 96 makes it an independent supervisory authority with its seat in Sarajevo; Article 101 gives it competence to supervise processing by controllers and processors (courts acting in their judicial function excepted), and Article 107 provides for inspection by the Agency's inspectors | Applies to processing done wholly by automated means and to non-automated processing of data that forms or is meant to form part of a filing system, with an exception for purely personal or household activity (Article 5). It applies to controllers and processors established in Bosnia and Herzegovina and also to those outside it whose processing relates to offering goods or services to people in Bosnia and Herzegovina or monitoring their behaviour there, and such a controller or processor must appoint a representative in writing unless a listed exception applies (Articles 6 and 29). Article 8 lists six lawful bases: consent, contract, legal duty, vital interests, a public-interest task or official authority, and legitimate interests (not open to public authorities performing their tasks). The Law also sets out information duties and the rights of access, rectification, erasure, restriction, portability and objection (Articles 14-23), processor contracts (Article 30), records of processing (Article 32), security of processing (Article 34), notification of a breach to the Agency and to the person where the risk is high (Articles 35-36), impact assessments for high-risk processing (Article 37), data protection officers for public authorities, large-scale monitoring and large-scale special-category data (Article 39), and rules for transfers abroad based on an adequacy list adopted by the Council of Ministers on the Agency's proposal, on safeguards such as standard contractual clauses adopted by the Agency or binding corporate rules, or on listed derogations (Articles 46-51). | |
| Agency tasks and tools under the Law Personal Data Protection Agency in Bosnia and Herzegovina | Article 102 gives the Agency the tasks of monitoring and applying the Law, raising awareness among controllers and processors, deciding on complaints by data subjects, adopting the standard contractual clauses, drawing up and keeping the list of processing operations that need an impact assessment, advising on prior consultation, and encouraging and approving codes of conduct. Article 108 gives every data subject the right to complain to the Agency. Article 47 provides that a decision on the adequacy of protection in another country is taken by the Council of Ministers on the Agency's proposal, and that a country the European Union has found adequate is treated as adequate. | |
| Banking Agency of Republika Srpska (Agencija za bankarstvo Republike Srpske) for banks with their seat in Republika Srpska that it has licensed; the Central Bank of Bosnia and Herzegovina co-ordinates the entity banking agencies that licence and supervise banks, according to the Foreign Investment Promotion Agency Banks (information systems and ICT risk) | Decision on the management of the information system and ICT risks in a bank (Odluka o upravljanju informacionim sistemom i rizicima informacione i komunikacione tehnologije u banci), "Službeni glasnik Republike Srpske" No. 42/25, adopted on 13 May 2025; Article 54 states that it applies from 1 April 2026 and replaces the earlier decision (No. 116/17). It covers the ICT risk framework, ICT incidents and cyber threats, digital operational resilience testing, ICT business continuity and third-party ICT service contracts. Article 24 requires a bank to contract only with ICT service providers that apply appropriate ICT security standards, to establish before signing that a provider supporting critical functions applies relevant and recognised standards, and to monitor that compliance and seek independent assurance (for example relevant certificates and reports of independent reviews). The Agency has also published guidance on ICT incident classification, ICT incident reporting, tools and methods for ICT risk management, the ICT services policy and the register of ICT service providers. The decision does not name ISO/IEC 27001. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, SOC 2 |
| Food Safety Agency of Bosnia and Herzegovina (Agencija za sigurnost hrane Bosne i Hercegovine), which gives scientific advice, assesses risk and initiates implementing rules; the competent authorities of the entities and of Brčko District register and approve food establishments, as the Rulebook states Food business operators (food hygiene and HACCP) | Food Act (Zakon o hrani), "Službeni glasnik BiH" No. 50/04, and the Rulebook on Food Hygiene (Pravilnik o higijeni hrane), "Službeni glasnik BiH" No. 4/13. Article 6 of the Rulebook requires food business operators to establish, implement and maintain permanent procedures based on the HACCP principles and lists those principles, and its paragraph 4 limits that duty to operators at stages after primary production. Article 7 requires operators to notify the competent authority of each establishment for registration and to have establishments approved where special rules require it. Article 1 states that food exported from Bosnia and Herzegovina must meet Article 21 of the Food Act and Articles 4 to 7 of the Rulebook. The Rulebook encourages guides to good hygiene practice and does not name ISO 22000 or FSSC 22000. | HACCP, ISO 22000, FSSC 22000 |
| Veterinary Office of Bosnia and Herzegovina (Kancelarija za veterinarstvo BiH), a state body under the Ministry of Foreign Trade and Economic Relations Exporters of animals and products of animal origin | According to its page on competence, the Veterinary Office proposes the veterinary conditions for international trade (export and import) in animals, raw materials, waste and products of animal origin, proposes the conditions for registering slaughter establishments and the uniform procedure for registering establishments that produce, process, finish or store products and raw materials of animal origin for export or import, proposes the uniform residue monitoring programme and co-ordinates border veterinary inspection. | HACCP, ISO 22000, FSSC 22000 |
| Agency for Medicinal Products and Medical Devices of Bosnia and Herzegovina (ALMBiH) Medicines and medical devices | Act on Medicinal Products and Medical Devices ("Official Gazette of B-H" No. 58/08), under which ALMBiH was established and started work on 1 May 2009. Its site publishes the list of medical devices with certificates of registering in the Registry of medical devices, the register of manufacturers of medicinal products and medical devices, and the registers of wholesale distributors. The site does not name ISO 13485 as a requirement. | ISO 13485 |
| Federal Ministry of Environment and Tourism (Federalno ministarstvo okoliša i turizma) for the Federation of Bosnia and Herzegovina Industrial operators needing environmental permits | Law on Environmental Protection (Zakon o zaštiti okoliša), listed among the Federation's laws on the Ministry's site. The Ministry's environmental permits section covers permits, the register of issued environmental permits, the register of installations and pollution (PRTR), best available techniques, environmental impact assessment and major-accident prevention. The permit is a legal requirement in its own right and the Ministry's pages do not name ISO 14001. | ISO 14001 |
| Agency for the Prevention of Corruption and Co-ordination of the Fight against Corruption (APIK) Public integrity and anti-corruption | APIK's site lists the Law on the Agency for the Prevention of Corruption and Co-ordination of the Fight against Corruption, the Law on the Protection of Persons Reporting Corruption in the Institutions of Bosnia and Herzegovina, and the Strategy for the Fight against Corruption 2024-2028 with its action plan, and provides for integrity plans. These frame public-sector integrity and reporting and do not by themselves make a private company seek ISO 37001 or ISO 37301; a buyer or tender sets that. | ISO 37001, ISO 37301 |
| Foreign Investment Promotion Agency of Bosnia and Herzegovina (FIPA) Investment-promoted sectors | FIPA's list of attractive sectors names agriculture and food processing, the automotive industry, banking and financial services, the construction industry, energy, forestry and wood products, ICT, mining and metal processing, tourism, textile, and business process outsourcing. Its automotive page lists the components made in the country, from engine, gear and brake parts to plastic injection parts, wheels and batteries, and gives "Quality production – ISO and industry certificates" as one reason to invest in the sector. | ISO 9001, IATF 16949, ISO 14001, ISO/IEC 27001 |
| Agency for Statistics of Bosnia and Herzegovina (BHAS) Export structure (official statistics) | BHAS's thematic bulletin on foreign trade in goods for 2025 groups exports by the SITC sectors. For 2025 the three largest export sectors by value were miscellaneous manufactured articles (including furniture, clothing and footwear), manufactured goods classified chiefly by material (including metal products, wood and cork, and paper) and machinery and transport equipment, followed by crude materials, chemicals, mineral fuels (including electricity) and food and live animals. | ISO 9001, IATF 16949, ISO 14001, ISO 45001 |
Accreditation and recognition
- Institute for Accreditation of Bosnia and Herzegovina (BATA; Institut za akreditiranje Bosne i Hercegovine): National accreditation body — an independent, non-profit administrative institution established under the Law on Establishing the Institute for Accreditation of Bosnia and Herzegovina (Official Gazette of BiH No. 10/02) and the Law on Accreditation of BiH (Official Gazette of BiH No. 19/01); it accredits testing, calibration and medical laboratories, product certification bodies and inspection bodies, and states that it also accredits bodies certifying quality and environmental management systems and persons.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Free zones and business zones: manufacturing for export, logistics
Sterling in Bosnia and Herzegovina
Sterling delivers in Bosnia and Herzegovina from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Bosnia and Herzegovina clients ask
Does Bosnia and Herzegovina have a GDPR-style data protection law and who supervises it?
Yes. The Law on Personal Data Protection was published in the Official Gazette of Bosnia and Herzegovina No. 12/25 and says it aligns national rules with the GDPR. The Personal Data Protection Agency in Bosnia and Herzegovina supervises it as an independent authority seated in Sarajevo. Confirm how the Law's start of application affects your processing with your counsel or the Agency.
Can a company outside Bosnia and Herzegovina fall under its data protection law?
Yes. The Law also covers controllers and processors without an establishment in the country when their processing relates to offering goods or services to people there or to monitoring their behaviour there, and they must normally appoint a representative in writing. Public authorities and occasional low-risk processing are excepted. Your counsel can confirm whether an exception fits your case.
What does the Republika Srpska banking decision of 2025 ask of ICT service providers?
It tells banks seated in Republika Srpska to contract only with ICT service providers that apply appropriate ICT security standards, to check this before signing when the service supports a critical function, and to monitor it and seek independent assurance such as relevant certificates or independent review reports. It applies from the date Article 54 states. It does not name ISO/IEC 27001; ask the bank what evidence it accepts.
Is HACCP mandatory for food companies in Bosnia and Herzegovina?
The Rulebook on Food Hygiene requires food business operators to establish, implement and maintain permanent procedures based on the HACCP principles, but only at stages after primary production. Food that is exported must also meet the Food Act and Articles 4 to 7 of the Rulebook. The Rulebook does not name ISO 22000 or FSSC 22000, so check your buyer's scheme requirement and confirm the details with the competent authority.
Who accredits certification and laboratories in Bosnia and Herzegovina?
The Institute for Accreditation of Bosnia and Herzegovina (BATA) is the national accreditation body. It is an EA MLA signatory for testing, calibration, inspection and product certification, and an ILAC MRA signatory for testing, calibration and inspection. Management system certificates usually carry accreditation from a body in another economy within the international arrangements, so ask the certification body for its accreditation scope.
In which language will an ISO audit be run in Bosnia and Herzegovina?
Expect Bosnian, Croatian or Serbian for the paperwork, since the Official Gazette, BATA and the food and veterinary bodies publish in all three, in Latin and Cyrillic script. English works in export, software and outsourcing firms. Settle the audit language, interpreter and script of controlled records with your certification body when you apply, and follow any language clause from a regulator or customer.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law on Personal Data Protection (Zakon o zaštiti ličnih podataka) — sluzbenilist.ba; bhas.gov.ba (accessed 18 Oct 2026)
- Agency tasks and tools under the Law — sluzbenilist.ba (accessed 18 Oct 2026)
- Decision on the management of the information system and ICT risks in a bank (Odluka o upravljanju informacionim sistemom i rizicima informacione i komunikacione tehnologije u banci), "Službeni glasnik Republike Srpske" No. 42/25, adopted on 13 May 2025; Article 54 states that it applies from 1 April 2026 and replaces the earlier decision (No. 116/17). It covers the ICT risk framework, ICT incidents and cyber threats, digital operational resilience testing, ICT business continuity and third-party ICT service contracts. Article 24 requires a bank to contract only with ICT service providers that apply appropriate ICT security standards, to establish before signing that a provider supporting critical functions applies relevant and recognised standards, and to monitor that compliance and seek independent assurance (for example relevant certificates and reports of independent reviews). The Agency has also published guidance on ICT incident classification, ICT incident reporting, tools and methods for ICT risk management, the ICT services policy and the register of ICT service providers. The decision does not name ISO/IEC 27001 — abrs.ba; fipa.gov.ba (accessed 18 Oct 2026)
- Food Act (Zakon o hrani), "Službeni glasnik BiH" No. 50/04, and the Rulebook on Food Hygiene (Pravilnik o higijeni hrane), "Službeni glasnik BiH" No. 4/13. Article 6 of the Rulebook requires food business operators to establish, implement and maintain permanent procedures based on the HACCP principles and lists those principles, and its paragraph 4 limits that duty to operators at stages after primary production. Article 7 requires operators to notify the competent authority of each establishment for registration and to have establishments approved where special rules require it. Article 1 states that food exported from Bosnia and Herzegovina must meet Article 21 of the Food Act and Articles 4 to 7 of the Rulebook. The Rulebook encourages guides to good hygiene practice and does not name ISO 22000 or FSSC 22000 — fsa.gov.ba (accessed 18 Oct 2026)
- According to its page on competence, the Veterinary Office proposes the veterinary conditions for international trade (export and import) in animals, raw materials, waste and products of animal origin, proposes the conditions for registering slaughter establishments and the uniform procedure for registering establishments that produce, process, finish or store products and raw materials of animal origin for export or import, proposes the uniform residue monitoring programme and co-ordinates border veterinary inspection — vet.gov.ba (accessed 18 Oct 2026)
- Act on Medicinal Products and Medical Devices ("Official Gazette of B-H" No. 58/08), under which ALMBiH was established and started work on 1 May 2009. Its site publishes the list of medical devices with certificates of registering in the Registry of medical devices, the register of manufacturers of medicinal products and medical devices, and the registers of wholesale distributors. The site does not name ISO 13485 as a requirement — almbih.gov.ba (accessed 18 Oct 2026)
- Law on Environmental Protection (Zakon o zaštiti okoliša), listed among the Federation's laws on the Ministry's site. The Ministry's environmental permits section covers permits, the register of issued environmental permits, the register of installations and pollution (PRTR), best available techniques, environmental impact assessment and major-accident prevention. The permit is a legal requirement in its own right and the Ministry's pages do not name ISO 14001 — fmoit.gov.ba (accessed 18 Oct 2026)
- APIK's site lists the Law on the Agency for the Prevention of Corruption and Co-ordination of the Fight against Corruption, the Law on the Protection of Persons Reporting Corruption in the Institutions of Bosnia and Herzegovina, and the Strategy for the Fight against Corruption 2024-2028 with its action plan, and provides for integrity plans. These frame public-sector integrity and reporting and do not by themselves make a private company seek ISO 37001 or ISO 37301; a buyer or tender sets that — apik.ba (accessed 18 Oct 2026)
- FIPA's list of attractive sectors names agriculture and food processing, the automotive industry, banking and financial services, the construction industry, energy, forestry and wood products, ICT, mining and metal processing, tourism, textile, and business process outsourcing. Its automotive page lists the components made in the country, from engine, gear and brake parts to plastic injection parts, wheels and batteries, and gives "Quality production – ISO and industry certificates" as one reason to invest in the sector — fipa.gov.ba (accessed 18 Oct 2026)
- BHAS's thematic bulletin on foreign trade in goods for 2025 groups exports by the SITC sectors. For 2025 the three largest export sectors by value were miscellaneous manufactured articles (including furniture, clothing and footwear), manufactured goods classified chiefly by material (including metal products, wood and cork, and paper) and machinery and transport equipment, followed by crude materials, chemicals, mineral fuels (including electricity) and food and live animals — bhas.gov.ba (accessed 18 Oct 2026)
- Institute for Accreditation of Bosnia and Herzegovina (BATA; Institut za akreditiranje Bosne i Hercegovine) — bata.gov.ba; european-accreditation.org (accessed 18 Oct 2026)
- Free zones and business zones — fipa.gov.ba
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice