Where we work · Côte d'Ivoire
ISO and GRC certification consulting in Côte d'Ivoire
Achieve ISO and GRC certification in Côte d'Ivoire with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Côte d'Ivoire
Clients include
ISO and GRC certification in Côte d'Ivoire at a glance
Certification demand in Côte d'Ivoire follows its export chains and its regulators. The Conseil du Café-Cacao is rolling out a national traceability system and approves the operators in the cocoa, coffee and cashew trade, while the Autorité Ivoirienne de Régulation Pharmaceutique licenses pharmaceutical establishments and laboratories. Décret n° 2021-916 adopted a national information systems security framework, inspired by ISO 27001 and ISO 27002, that public bodies and private companies must follow. The ARTCI, the telecoms and ICT regulator, also acts as the data protection authority under Law No. 2013-450. CEPICI administers the investment code and names agro-industry, chemicals, construction materials, health, textiles, automotive, packaging and the digital economy as priority clusters, and CIAPOL and the CNPS prevention directorate cover environmental and workplace safety. CODINORM develops national standards. Accreditation is regional, since SOAC holds laboratory recognitions, so management-system certificates usually carry accreditation from another economy. Sterling's Casablanca office serves Ivorian organisations, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Côte d'Ivoire
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Côte d'Ivoire (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), which the law names as the independent administrative authority that carries out the data protection authority's tasks (Autorité de protection); its tasks include informing people and controllers, receiving declarations, granting and withdrawing authorisations, handling complaints, carrying out checks through sworn agents, imposing administrative and financial sanctions and keeping a public register of processing | Covers collection, processing, transmission, storage and use of personal data by individuals, the State, local authorities and public or private legal persons, and any processing carried out on national territory. Processing is declared to the authority before it starts, and the authority issues a receipt; processing of genetic and medical data, offence data, national identification numbers, biometric data, data for public-interest, historical, statistical or scientific purposes and any transfer to a third country needs prior authorisation. A controller that appoints a qualified data protection correspondent is exempt from declaration, except where a transfer to a third country is planned. Data must be processed lawfully and fairly, for specified purposes, accurately, transparently and confidentially, with processors chosen for sufficient guarantees. Sensitive data such as racial, ethnic, political, religious, union, sex-life, genetic and health data is prohibited except in listed cases. Transfers need a level of protection at least equivalent and the authority's prior authorisation. People have rights of information, access, objection, rectification, erasure and portability, and direct marketing needs prior consent. Controllers must prepare an annual report on their security measures for the authority. | |
| Declaration and authorisation procedure, correspondents and public registers Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), acting as Autorité de protection | The authority's data protection site publishes the decree, the forms for controllers, a complaints channel, lists of authorised companies, companies in the compliance process and compliant companies, and registers of data protection correspondents. In January 2026 it invited controllers and correspondents to enter their details in a national file of correspondents designated under the 2024 order. It also publishes its decisions, including warnings and formal notices. | |
| Related digital-economy texts listed by the ARTCI Not a single regulator; the ARTCI publishes the texts together and is the multisectoral authority created by Ordonnance n° 2012-293 | These texts form the legal setting around data protection: offences committed through information systems, electronic transactions and signatures, the telecoms and ICT regime, and electronic exchanges with public authorities. They give context for information security work and are not a security standard. | |
| Ministry in charge of the digital economy (decree sponsor) and the ARTCI, which the framework names as responsible for network and information-system security Information systems security, public bodies and private companies, critical infrastructure | Décret n° 2021-916 du 22 décembre 2021 portant adoption du Référentiel Général de Sécurité des Systèmes d'Information (RGSSI) et du Plan de Protection des Infrastructures Critiques (PPIC). The decree adopts both documents as annexes, says the PPIC aims to guarantee the availability of the main goods and services essential to society, and states that public bodies and private companies must comply with the RGSSI and the PPIC. The RGSSI annex describes itself as strongly inspired by ISO 27001:2013 and ISO 27002:2013, sets out an audit framework of 138 criteria in 16 domains from leadership and risk management to supplier relations, incident management and business continuity, and recalls the ARTCI's statutory audit and certification role for the information systems of legal persons engaged in electronic transactions. | ISO/IEC 27001 |
| Autorité Ivoirienne de Régulation Pharmaceutique (AIRP) Medicines, other pharmaceutical products, pharmaceutical establishments and medical laboratories | Loi n°2017-541 du 3 août 2017 relative à la régulation du secteur pharmaceutique created the AIRP as an independent administrative authority, organised by Décret N°2018-926 du 12 décembre 2018. Its site lists marketing authorisations, licences to open and operate pharmaceutical establishments and medical biology laboratories, import and export authorisations, inspections, vigilance and market surveillance, clinical-trial authorisation and inspection, quality control, advertising approval and action against substandard and falsified products. Its quality policy states that it works to ISO 9001. | |
| Banque Centrale des Etats de l'Afrique de l'Ouest (BCEAO), the common central bank of the Union, which lists Côte d'Ivoire among its member states Banks, credit institutions, electronic money issuers and payment service providers in the West African Monetary Union | The BCEAO publishes the Union's payment-system rules, including Règlement n°15/2002/CM/UEMOA on payment systems, Instruction n°008-05-2015 governing electronic money issuers, Instruction N°001-03-2021 on oversight of financial market infrastructures, payment means and services, and the Loi uniforme of 1 December 2011 on offences involving cheques, bank cards and other electronic payment instruments. | |
| Conseil du Café-Cacao (Conseil de Régulation, de Stabilisation et de Développement de la filière café-cacao) Cocoa, coffee and cashew value chains | The Council's site publishes yearly approval notices for exporters, buyers, processors and suppliers, a notice on approving certification projects and sustainability programmes for the 2026-2027 coffee-cacao campaign, and a news item stating that its national traceability system enters into force on 1 September 2026 with a compulsory producer card, which it links to the EU deforestation regulation. It also briefed exporters in November 2023 on the ARS 1000 standard for sustainable cocoa and its pilot. | |
| Centre Ivoirien Antipollution (CIAPOL), a public administrative body created by Décret n°91-662 du 09 octobre 1991 under the environment ministry Environmental protection, classified installations and industrial pollution | CIAPOL describes its mission as following up the application of environmental texts and conventions. Its technical units include the Central Environmental Laboratory, an inspection unit for classified installations, a police unit and a unit for polluted sites, with regional branches in Daloa, San-Pedro and Yamoussoukro. It also handles environmental charges on ships at the ports of Abidjan and San-Pédro. | |
| Caisse Nationale de Prévoyance Sociale (CNPS), through its Direction de la Prévention et de la Promotion de la Santé et Sécurité au Travail Occupational health and safety prevention | The CNPS prevention page describes a directorate that carries out workplace checks, advises companies, helps them prepare and follow prevention actions, measures workplace nuisances, trains on occupational safety and health, and promotes occupational medicine, and it publishes the application files for a national occupational health and safety prize for companies. | |
| Ministère des Mines, du Pétrole et de l'Energie, with its Direction Générale des Mines et de la Géologie (DGMG) Mining, hydrocarbons and energy | The DGMG site links to the mining e-cadastre portal. PETROCI Holding, created in 1975, states missions covering exploration and production of hydrocarbons and the storage, trade and transport of petroleum products, and publishes ethics, quality and social-responsibility policies. SODEMI, created by decree in 1962, offers geophysics, mineral analysis and ore-processing laboratories. | |
| Centre de Promotion des Investissements en Côte d'Ivoire (CEPICI) Investors, industrial companies and exporters | CEPICI processes applications for the benefits of the investment code, published as Ordonnance N°2024-857, under a declaration regime and an approval regime, runs a one-stop business formalities service and a desk for industrial land. It states that the 2021-2025 national development plan names agro-industry, chemicals, construction materials, health and pharmacy, textiles, automotive, packaging, the digital economy, tourism and creative industries as priority clusters. | |
| CODINORM (Côte d'Ivoire Normalisation) National standards and standardisation committees | CODINORM's site describes a non-profit association created in 1992, recognised as of public utility and under the supervision of the ministry in charge of industry, which brings together private companies and the State and works on standardisation, with ISO, IEC, CEN, CENELEC and ARSO among its listed partners. Its role here is standards development only. |
Accreditation and recognition
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation): Regional accreditation body, listed by ILAC under Côte d'Ivoire.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Industrial land and free-zone regimes handled through CEPICI: manufacturing, agro-industry, chemicals, construction materials
- Port Autonome d'Abidjan: fishing, fruit export, timber, petroleum products, warehousing
Sterling in Côte d'Ivoire
Sterling delivers in Côte d'Ivoire from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Côte d'Ivoire clients ask
Which body accredits certification in Côte d'Ivoire?
Accreditation here is regional. ILAC lists SOAC, the West African Accreditation System, under Côte d'Ivoire and records its recognitions for calibration, testing and medical laboratories; none is recorded for management-system certification. For an ISO 9001 or ISO 27001 certificate, ask the certification body which accreditation body covers your standard and check that the scope matches your sector.
Does Côte d'Ivoire have a personal data protection law, and who enforces it?
Yes, Law No. 2013-450 of 19 June 2013. The telecoms and ICT regulator ARTCI doubles as the data protection authority: it takes processing declarations and authorisation requests, hears complaints, carries out checks and can impose sanctions. Its dedicated website lists authorised and compliant companies and registered correspondents. Counsel or the ARTCI can tell you which formalities apply to your own processing.
Are certification audits in Côte d'Ivoire conducted in French?
French is the working language of the regulators, so expect it for documents, contracts and most interviews. Where the audit team and your staff share English or a local language, the certification body can agree that for specific sessions. Fix the audit language, interpreter arrangements and the language of controlled procedures with the certification body at the application stage.
Who regulates medicines and pharmaceutical establishments in Côte d'Ivoire?
The Autorité Ivoirienne de Régulation Pharmaceutique (AIRP), created by Law No. 2017-541 of 3 August 2017. Its site lists marketing authorisations, licences for pharmaceutical establishments and medical laboratories, import and export authorisations, inspections, vigilance and clinical-trial oversight. Its own quality policy follows ISO 9001, but a certificate does not replace the authorisations it issues.
Is information security compulsory for private companies in Côte d'Ivoire?
A 2021 decree, number 2021-916, adopted the national information systems security framework (RGSSI) and a critical infrastructure protection plan, and says public bodies and private companies must comply. The framework is inspired by ISO 27001:2013 and 27002:2013 but is its own audit reference, so an ISO 27001 certificate supports rather than replaces it. Confirm the scope with counsel or the ARTCI.
Which sectors drive demand for ISO certification in Côte d'Ivoire?
Cocoa, coffee and cashew chains, agro-industry, energy and mining suppliers, pharmaceuticals, banking and payments, and digital services stand out. CEPICI names agro-industry, chemicals, construction materials, health, textiles, automotive, packaging and the digital economy as priority clusters, and the cocoa council is rolling out national traceability. The buyer, lender or approval usually decides which certificates count.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel — artci.ci; autoritedeprotection.ci (accessed 18 Oct 2026)
- Declaration and authorisation procedure, correspondents and public registers — autoritedeprotection.ci (accessed 18 Oct 2026)
- Related digital-economy texts listed by the ARTCI — artci.ci (accessed 18 Oct 2026)
- Décret n° 2021-916 du 22 décembre 2021 portant adoption du Référentiel Général de Sécurité des Systèmes d'Information (RGSSI) et du Plan de Protection des Infrastructures Critiques (PPIC). The decree adopts both documents as annexes, says the PPIC aims to guarantee the availability of the main goods and services essential to society, and states that public bodies and private companies must comply with the RGSSI and the PPIC. The RGSSI annex describes itself as strongly inspired by ISO 27001:2013 and ISO 27002:2013, sets out an audit framework of 138 criteria in 16 domains from leadership and risk management to supplier relations, incident management and business continuity, and recalls the ARTCI's statutory audit and certification role for the information systems of legal persons engaged in electronic transactions. — autoritedeprotection.ci (accessed 18 Oct 2026)
- Loi n°2017-541 du 3 août 2017 relative à la régulation du secteur pharmaceutique created the AIRP as an independent administrative authority, organised by Décret N°2018-926 du 12 décembre 2018. Its site lists marketing authorisations, licences to open and operate pharmaceutical establishments and medical biology laboratories, import and export authorisations, inspections, vigilance and market surveillance, clinical-trial authorisation and inspection, quality control, advertising approval and action against substandard and falsified products. Its quality policy states that it works to ISO 9001. — airp.ci (accessed 18 Oct 2026)
- The BCEAO publishes the Union's payment-system rules, including Règlement n°15/2002/CM/UEMOA on payment systems, Instruction n°008-05-2015 governing electronic money issuers, Instruction N°001-03-2021 on oversight of financial market infrastructures, payment means and services, and the Loi uniforme of 1 December 2011 on offences involving cheques, bank cards and other electronic payment instruments. — bceao.int (accessed 18 Oct 2026)
- The Council's site publishes yearly approval notices for exporters, buyers, processors and suppliers, a notice on approving certification projects and sustainability programmes for the 2026-2027 coffee-cacao campaign, and a news item stating that its national traceability system enters into force on 1 September 2026 with a compulsory producer card, which it links to the EU deforestation regulation. It also briefed exporters in November 2023 on the ARS 1000 standard for sustainable cocoa and its pilot. — conseilcafecacao.ci (accessed 18 Oct 2026)
- CIAPOL describes its mission as following up the application of environmental texts and conventions. Its technical units include the Central Environmental Laboratory, an inspection unit for classified installations, a police unit and a unit for polluted sites, with regional branches in Daloa, San-Pedro and Yamoussoukro. It also handles environmental charges on ships at the ports of Abidjan and San-Pédro. — ciapol.ci (accessed 18 Oct 2026)
- The CNPS prevention page describes a directorate that carries out workplace checks, advises companies, helps them prepare and follow prevention actions, measures workplace nuisances, trains on occupational safety and health, and promotes occupational medicine, and it publishes the application files for a national occupational health and safety prize for companies. — cnps.ci (accessed 18 Oct 2026)
- The DGMG site links to the mining e-cadastre portal. PETROCI Holding, created in 1975, states missions covering exploration and production of hydrocarbons and the storage, trade and transport of petroleum products, and publishes ethics, quality and social-responsibility policies. SODEMI, created by decree in 1962, offers geophysics, mineral analysis and ore-processing laboratories. — mines.gouv.ci; petroci.ci; sodemi.ci (accessed 18 Oct 2026)
- CEPICI processes applications for the benefits of the investment code, published as Ordonnance N°2024-857, under a declaration regime and an approval regime, runs a one-stop business formalities service and a desk for industrial land. It states that the 2021-2025 national development plan names agro-industry, chemicals, construction materials, health and pharmacy, textiles, automotive, packaging, the digital economy, tourism and creative industries as priority clusters. — cepici.ci (accessed 18 Oct 2026)
- CODINORM's site describes a non-profit association created in 1992, recognised as of public utility and under the supervision of the ministry in charge of industry, which brings together private companies and the State and works on standardisation, with ISO, IEC, CEN, CENELEC and ARSO among its listed partners. Its role here is standards development only. — codinorm.ci (accessed 18 Oct 2026)
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation) — ilac.org; wacomp.ecowas.int (accessed 18 Oct 2026)
- Industrial land and free-zone regimes handled through CEPICI — cepici.ci (accessed 18 Oct 2026)
- Port Autonome d'Abidjan — portabidjan.ci (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice