Where we work · China
ISO and GRC certification consulting in China
Achieve ISO and GRC certification in China with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Shanghai office team
- Effivity and Academy included
Sectors that ask for certification in China
Clients include
ISO and GRC certification in China at a glance
China's certification and compliance demand is driven by regulation as much as by customers. The Personal Information Protection Law, the Data Security Law, the Cybersecurity Law and the Network Data Security Management Regulations, with the Cyberspace Administration of China at the centre, put security and audit duties on anyone handling data. Sector rules add to this: the National Financial Regulatory Administration and the People's Bank of China for banks, insurers and payments, the National Health Commission for hospitals, the National Medical Products Administration for medical device makers, and the National Development and Reform Commission for key energy-using units. The State-owned Assets Supervision and Administration Commission expects central state-owned enterprises to run compliance management systems. Commercial pull comes from export and contract manufacturing, the automotive supply chain, electronics and semiconductors, medical devices, food processing and export, IT, cloud and SaaS providers, financial services and fintech, and logistics and cross-border e-commerce. Certificates are issued by certification bodies approved by the Certification and Accreditation Administration, with CNAS as the national accreditation body. Sterling's Shanghai office brings 20+ years of experience and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in China
Each page covers who needs the standard in China, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in China (16)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Information Protection Law of the People's Republic of China (PIPL) Cyberspace Administration of China (the national cyberspace department) coordinates personal information protection; relevant State Council departments supervise within their own remits | Applies to processing of natural persons' personal information within China, and to processing outside China of personal information of natural persons in China where the purpose is to provide products or services to them, to analyse or assess their behaviour, or in other cases set by law. Handlers must adopt internal management systems, classification, encryption and de-identification, access permissions, staff training and incident response plans; carry out regular compliance audits; and perform personal information protection impact assessments before, among others, processing sensitive personal information or providing personal information outside China. Cross-border provision requires one of: a CAC security assessment, personal information protection certification by a professional institution under CAC rules, a CAC standard contract, or other conditions set by law. Overseas handlers within its extraterritorial scope must set up a dedicated entity or appoint a representative in China. | |
| Network Data Security Management Regulations State Council; cyberspace administration departments with other competent departments | Network data handlers must regularly audit, themselves or through a professional institution, their compliance with personal information laws. Handlers of the personal information of more than 10 million people must also follow the rules set for handlers of important data. Overlapping results of important-data risk assessments and cybersecurity classified-protection (MLPS) evaluations may be mutually relied upon. | |
| Measures for Personal Information Protection Compliance Audits Cyberspace Administration of China | CAC's published Q&A: handlers audit themselves regularly; handlers processing the personal information of more than 10 million people must carry out a compliance audit at least once every two years; departments responsible for personal information protection may also require a handler to commission a professional institution to audit, at the handler's cost, within a set time, with a report and rectification. | |
| Data Security Law of the People's Republic of China Central national security leadership body (decision-making and coordination); sector and public security departments; cyberspace administration | Governs data processing activities and data security in China, and liability for processing outside China that harms China's national security, public interest or the lawful rights of citizens or organisations. | |
| Cybersecurity Law of the People's Republic of China Cyberspace Administration of China coordinates cybersecurity work; telecommunications, public security and other departments within their remits | Applies to building, operating, maintaining and using networks in China. Basis of the cybersecurity classified-protection system (MLPS) that sector rules refer to. The CAC page shows the 2016 text; check the current consolidated text for later amendments before quoting provisions. | |
| National Financial Regulatory Administration (NFRA) Banks and insurance institutions | Measures for Data Security Management of Banking and Insurance Institutions (金规〔2024〕24号, in force on publication) — institutions processing data over networks must fulfil data security duties on the basis of the cybersecurity classified-protection system (MLPS) and bring data into MLPS; does not name ISO/IEC 27001. | |
| People's Bank of China (PBOC) People's Bank of China business areas (payment, clearing and other PBOC-supervised activities) | Measures for Data Security Management in the Business Areas of the People's Bank of China (PBOC Order 〔2025〕 No. 3, in force from 30 June 2025); does not name PCI DSS or ISO/IEC 27001. | |
| National Health Commission (with the National Administration of Traditional Chinese Medicine and the National Disease Control and Prevention Administration) Medical and health institutions | Measures for the Cybersecurity Management of Medical and Health Institutions (国卫规划发〔2022〕29号) — built on the Cybersecurity Law, Data Security Law, PIPL and the MLPS; priority on critical information infrastructure and MLPS level 3 and above networks; does not name ISO/IEC 27001. | |
| National Medical Products Administration (NMPA) Medical device manufacturers | Good Manufacturing Practice for Medical Devices, revised (NMPA Announcement 2025 No. 107), in force from 1 November 2026, replacing the 2014 version; the announcement does not cite ISO 13485 (national adoption: GB/T 42061-2022, identical to ISO 13485:2016). | |
| National Development and Reform Commission with other departments (Order No. 15, 2018) Key energy-using units | Measures for the Energy Conservation Management of Key Energy-Using Units — units shall establish and effectively operate an energy management system in accordance with standards such as 'Energy management system requirements'; energy management system certification is encouraged. | ISO 50001 |
| State-owned Assets Supervision and Administration Commission of the State Council (SASAC) Central state-owned enterprises | Measures for the Compliance Management of Central Enterprises (SASAC Order No. 42, in force from 1 October 2022) — SASAC guides and supervises compliance management and evaluates the construction and effectiveness of the compliance management system; does not name ISO 37301. | |
| Cyberspace Administration of China with six other departments Providers of generative AI services to the public in China | Interim Measures for the Management of Generative Artificial Intelligence Services (CAC and others, Order No. 15), in force from 15 August 2023; does not name ISO/IEC 42001. | |
| State Council; ecology and environment departments Enterprises and other producers discharging pollutants | Regulations on the Administration of Pollutant Discharge Permits (State Council Decree No. 736), in force from 1 March 2021; does not cite ISO 14001. | |
| State Council; emergency management departments All production and business units | Regulations on Emergency Responses to Work Safety Accidents (State Council Decree No. 708), in force from 1 April 2019 — production and business units must identify and assess the risks of possible work safety accidents and prepare emergency rescue plans; does not cite ISO 45001. | |
| State Administration for Market Regulation (qualification accreditation, CMA) Inspection and testing bodies issuing data or results with proof function to society | Measures for the Administration of Qualification Accreditation of Inspection and Testing Bodies (AQSIQ Order No. 163, amended by SAMR Order No. 38 of 2021) — bodies issuing data and results with proof function for judicial or administrative decisions, among others, must obtain qualification accreditation; separate from voluntary ISO/IEC 17025 accreditation by CNAS. The gov.cn copy checked is the 2015 text. | |
| State Administration for Market Regulation and Cyberspace Administration of China Personal information handlers seeking certification | Announcement on Implementing Personal Information Protection Certification (2022 No. 37) — certification encouraged; certification bodies must be approved and follow the Implementation Rules for Personal Information Protection Certification. | Personal Information Protection Law (PIPL) |
Accreditation and recognition
- China National Accreditation Service for Conformity Assessment (CNAS): National accreditation body; accredits management-system certification bodies against CNAS-CC01 (ISO/IEC 17021-1:2015, IDT), product, personnel and validation/verification bodies, laboratories and inspection bodies; management-system fields include QMS, EMS, OHSMS, FSMS, HACCP, ISMS, ISO/IEC 20000-1, EnMS and BCMS.
- Certification and Accreditation Administration of the People's Republic of China (CNCA) — the State Council's certification and accreditation supervision and administration department: Regulator of certification activity; approves the establishment of certification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Government procurement — supplier qualification conditions (State Council; Ministry of Finance): Regulations for the Implementation of the Government Procurement Law (State Council Decree No. 658): setting qualification, technical or commercial conditions that do not fit the specific characteristics and actual needs of the project, or are unrelated to contract performance, counts as unreasonable differential or discriminatory treatment. The regulations do not list ISO certificates; any certificate requirement must be justified in the individual procurement.
- 2025 special rectification of four types of violations in government procurement (Ministry of Finance, Ministry of Public Security, State Administration for Market Regulation): Targets, among others, suppliers who provide false test reports, certification certificates, contract performance records or SME declarations to win bids — certificates submitted in tenders must be genuine.
Economic zones
- China (Shanghai) Pilot Free Trade Zone: financial services, shipping services, commercial and trade services, professional services, cultural services, social services
- Lingang Special Area of the China (Shanghai) Pilot Free Trade Zone: integrated circuits, artificial intelligence, biomedicine, civil aviation
- China (Hainan) Pilot Free Trade Zone (Hainan Free Trade Port): tourism, modern services, high-tech industries
- Suzhou Industrial Park: advanced manufacturing, research and development, regional headquarters
Sterling in China
Sterling delivers in China from its Shanghai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in China, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Chinese clients ask
Can a foreign certification body issue ISO certificates in China?
A foreign certification body cannot do so through a representative office. Certification may be carried out only by bodies approved by the State Council's certification and accreditation department, within the scope approved, and no unit or individual may certify without approval. A foreign body's representative office may promote its parent's business but may not certify. The text checked is the 2003 version, so confirm the current wording.
Is CNAS accreditation recognised outside China?
CNAS publishes an APAC MRA scope that covers management systems certification, with sub-scopes for QMS, EMS, FSMS, ISMS and OHSMS, alongside laboratories and inspection. CNAS also states that Global Accreditation Cooperation Incorporated began operating on 1 January 2026 and took over the functions of the IAF and ILAC. Confirm CNAS's current Global ACI listing and sub-scopes before quoting them.
Does the PIPL apply to a company outside China?
Yes, in defined cases. Its reach extends to handling done abroad when the information concerns people in China and the aim is to supply them with goods or services, to analyse or assess their behaviour, or another case the law sets. An overseas handler within that reach must set up a dedicated entity or appoint a representative in China. Check your own position with counsel.
Do Chinese government tenders require ISO certificates?
Not as a general rule. The Regulations for the Implementation of the Government Procurement Law treat qualification or technical conditions that do not fit the project, or are unrelated to contract performance, as discriminatory, and they do not list ISO certificates. A tender may still ask for one if justified. The 2025 rectification campaign targets false certification certificates, so any certificate submitted must be genuine.
Are audits in China conducted in Chinese or English?
Either can work, but agree it early. National laws, regulations and the GB/T standards are published in Chinese. Settle the audit language, the certificate language and the language of controlled documents with the certification body when you apply. Multinational clients often keep bilingual Chinese and English documentation. Follow any language requirement in a client contract or from your regulator.
How do public holidays affect audit scheduling in China?
Audit dates must be checked against the current year's public holiday notice. The General Office of the State Council publishes the holiday and make-up working-day arrangement each year, covering the Spring Festival, Qingming, Labour Day, the Dragon Boat Festival, the Mid-Autumn Festival and National Day. Some weekends become working days, so never assume fixed dates when planning with the certification body.
Cities Sterling covers in China
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Information Protection Law of the People's Republic of China (PIPL) — cac.gov.cn (accessed 5 Oct 2026)
- Network Data Security Management Regulations — gov.cn (accessed 5 Oct 2026)
- Measures for Personal Information Protection Compliance Audits — gov.cn (accessed 5 Oct 2026)
- Data Security Law of the People's Republic of China — cac.gov.cn (accessed 5 Oct 2026)
- Cybersecurity Law of the People's Republic of China — cac.gov.cn (accessed 5 Oct 2026)
- Measures for Data Security Management of Banking and Insurance Institutions (金规〔2024〕24号, in force on publication) — gov.cn (accessed 5 Oct 2026)
- Measures for Data Security Management in the Business Areas of the People's Bank of China (PBOC Order 〔2025〕 No. 3, in force from 30 June 2025); does not name PCI DSS or ISO/IEC 27001 — gov.cn (accessed 5 Oct 2026)
- Measures for the Cybersecurity Management of Medical and Health Institutions (国卫规划发〔2022〕29号) — gov.cn (accessed 5 Oct 2026)
- Good Manufacturing Practice for Medical Devices, revised (NMPA Announcement 2025 No. 107), in force from 1 November 2026, replacing the 2014 version; the announcement does not cite ISO 13485 (national adoption: GB/T 42061-2022, identical to ISO 13485:2016) — gov.cn (accessed 5 Oct 2026)
- Measures for the Energy Conservation Management of Key Energy-Using Units — gov.cn (accessed 5 Oct 2026)
- Measures for the Compliance Management of Central Enterprises (SASAC Order No. 42, in force from 1 October 2022) — gov.cn (accessed 5 Oct 2026)
- Interim Measures for the Management of Generative Artificial Intelligence Services (CAC and others, Order No. 15), in force from 15 August 2023; does not name ISO/IEC 42001 — gov.cn (accessed 5 Oct 2026)
- Regulations on the Administration of Pollutant Discharge Permits (State Council Decree No. 736), in force from 1 March 2021; does not cite ISO 14001 — gov.cn (accessed 5 Oct 2026)
- Regulations on Emergency Responses to Work Safety Accidents (State Council Decree No. 708), in force from 1 April 2019 — gov.cn (accessed 5 Oct 2026)
- Measures for the Administration of Qualification Accreditation of Inspection and Testing Bodies (AQSIQ Order No. 163, amended by SAMR Order No. 38 of 2021) — gov.cn (accessed 5 Oct 2026)
- Announcement on Implementing Personal Information Protection Certification (2022 No. 37) — gov.cn (accessed 5 Oct 2026)
- China National Accreditation Service for Conformity Assessment (CNAS) — cnas.org.cn (accessed 5 Oct 2026)
- Certification and Accreditation Administration of the People's Republic of China (CNCA) — the State Council's certification and accreditation supervision and administration department — gov.cn (accessed 5 Oct 2026)
- Government procurement — supplier qualification conditions — gov.cn (accessed 5 Oct 2026)
- 2025 special rectification of four types of violations in government procurement — gov.cn (accessed 5 Oct 2026)
- China (Shanghai) Pilot Free Trade Zone — gov.cn (accessed 5 Oct 2026)
- Lingang Special Area of the China (Shanghai) Pilot Free Trade Zone — gov.cn (accessed 5 Oct 2026)
- China (Hainan) Pilot Free Trade Zone (Hainan Free Trade Port) — gov.cn (accessed 5 Oct 2026)
- Suzhou Industrial Park — gov.cn (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Shanghai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
china@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice