Where we work · Denmark
ISO and GRC certification consulting in Denmark
Achieve ISO and GRC certification in Denmark with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Denmark
Clients include
ISO and GRC certification in Denmark at a glance
Danish demand for ISO and GRC certification is shaped by a handful of regulators that each speak directly to management systems. The Styrelsen for Samfundssikkerhed leads on the NIS 2-loven, passed on 29 April 2025 and in force since 1 July 2025, and its guidance maps the required measures to ISO/IEC 27001. Datatilsynet supervises the GDPR under the Data Protection Act. Finanstilsynet applies DORA to financial entities, Lægemiddelstyrelsen regulates medical devices, and Fødevarestyrelsen expects a HACCP-based self-check programme. Executive orders on energy management and ISO 45001 certificates both rely on certification bodies accredited by DANAK, the national accreditation body, never by Sterling. Demand is strongest in IT and digital services, financial services, life sciences, food, energy and offshore wind around Port Esbjerg, manufacturing and logistics. Sterling serves Danish clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Denmark
Each page covers who needs the standard in Denmark, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Denmark (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Danish Data Protection Act Datatilsynet (the Danish Data Protection Agency) — the Act makes it responsible, with complete independence, for monitoring processing covered by the Act and the GDPR | The Act supplements and implements the GDPR. It applies to processing by controllers and processors established in Denmark, and to processing of data about people in Denmark by controllers outside the EU that offer them goods or services or monitor their behaviour there. Datatilsynet describes itself as the independent authority that supervises compliance, gives guidance and advice, handles complaints and carries out inspections. | |
| Datatilsynet catalogue of security measures and the accreditation of GDPR certification bodies Datatilsynet; DANAK as the national accreditation body for the accreditation role the Act describes | The catalogue gives examples of technical and organisational measures and says they draw on inspections, breach notifications, EDPB guidelines and information security requirements highlighted by ISO information security standards, the national cybersecurity centre and the security requirements for state authorities. The Act gives Datatilsynet and the national accreditation body powers to accredit certification bodies under the GDPR. | |
| Styrelsen for Samfundssikkerhed (SAMSIK), as competent authority for state authorities, municipalities, parts of manufacturing and chemicals, together with sector authorities such as Finanstilsynet, Digitaliseringsstyrelsen, Energistyrelsen, Trafikstyrelsen, Søfartsstyrelsen, Sundhedsdatastyrelsen, Miljøstyrelsen and Fødevarestyrelsen Essential and important entities under the NIS 2 Law (energy, transport, health, drinking water, digital infrastructure, manufacturing, food and other listed sectors, and public authorities) | Lov nr. 434 af 6. maj 2025 (NIS 2-loven), passed by Folketinget on 29 April 2025 and in force since 1 July 2025 per SAMSIK, with registration on virk.dk and the designation order BEK nr. 620 af 2. juni 2025. SAMSIK's guidance on the measures maps them to DS/EN ISO/IEC 27001:2023, NIST CSF 2.0 and IEC 62443 and says that following a standard is a help but not in itself assurance of compliance. Incident reports are handled by Forsvarets Efterretningstjeneste as national CSIRT. | ISO/IEC 27001 |
| Finanstilsynet (the Danish Financial Supervisory Authority) Financial entities (credit institutions, payment and e-money institutions, insurers and other entities in DORA's scope) | Regulation (EU) 2022/2554 (DORA), which Finanstilsynet says applies directly to covered entities from 17 January 2025. Finanstilsynet's page covers ICT risk management, incident reporting, resilience testing and ICT third-party risk, and it names Finanstilsynet as the sector authority for financial digital infrastructure under NIS 2. The page does not name ISO/IEC 27001. | |
| Lægemiddelstyrelsen (the Danish Medicines Agency) Medical device manufacturers and distributors | The EU medical device and in vitro diagnostic regulations and the Danish executive orders. The Agency says devices need CE marking after a conformity assessment, that higher risk classes use a notified body, and that manufacturers choose their notified body. Its pages on CE marking and marketing do not name ISO 13485. | |
| Fødevarestyrelsen (the Danish Veterinary and Food Administration) Food businesses | Every food business keeps an egenkontrolprogram (self-check programme) that Fødevarestyrelsen says must be based on the seven HACCP principles and backed by a written risk analysis. The guidance does not require a third-party certificate. | HACCP |
| Energistyrelsen (the Danish Energy Agency); the order was issued by the Klima-, Energi- og Forsyningsministeriet Large energy users (mandatory energy management systems and energy audits) | Executive Order No. 1138 of 18 September 2025 on mandatory energy management systems and energy and climate audits in certain companies. It defines certification as accredited certification to ISO 50001, ISO 14001 or an equivalent standard by a certification body accredited by DANAK or an equivalent accreditation body, and it lets certain companies use EMAS or an equivalent system instead. | ISO 50001, ISO 14001 |
| Arbejdstilsynet (the Danish Working Environment Authority) Occupational health and safety | Executive Order No. 688 of 16 June 2025, in force from 1 July 2025: Arbejdstilsynet publishes on its website information about companies with an international ISO 45001 certificate, on condition that the certificate comes from a certification body accredited for ISO 45001 by DANAK or an equivalent accreditation body. The order repeals Executive Order No. 92 of 26 January 2024 on recognised working environment certificates. | ISO 45001 |
| Digitaliseringsstyrelsen (the Danish Agency for Digital Government) Providers and deployers of AI systems | The EU AI Regulation, for which Digitaliseringsstyrelsen describes itself as the national coordinating supervisory authority. The agency's page does not name ISO/IEC 42001. | |
| Datatilsynet (National Whistleblower Scheme) Employers and organisations running whistleblowing channels | Lov nr. 1436 af 29. juni 2021 om beskyttelse af whistleblowere. Datatilsynet runs the National Whistleblower Scheme, which takes reports of serious breaches such as bribery and fraud, and its site says larger workplaces must also set up an internal scheme. The pages do not name ISO 37001 or ISO 37301. |
Accreditation and recognition
- DANAK (Den Danske Akkrediteringsfond, the Danish Accreditation Fund): National accreditation body — DANAK describes itself as an independent non-profit fund responsible for accrediting laboratories, certification bodies, inspection bodies and validation and verification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Port Esbjerg: offshore wind, oil and gas, bulk and break bulk, intermodal transport
- Danish life sciences cluster: pharmaceuticals, biotechnology, health technology, medical devices
- Danish cleantech sector: wind and renewable energy, energy efficiency, climate technology
- Danish food cluster: food production, food ingredients, agri-food
Sterling in Denmark
Sterling delivers in Denmark from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Denmark, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Danish clients ask
Are certification audits in Denmark conducted in Danish or English?
Either can be used, and the choice is settled with the certification body when you apply. Danish is the official language and English is widely used in business. Name the language for the audit itself and for controlled documents early, and follow anything a contract or regulator procedure prescribes, so the auditor team can be assigned accordingly.
Which accreditation body should a certification body hold for Denmark?
DANAK, the Danish national accreditation body. EA lists it as an MLA signatory with a management system certification scope, and Danish executive orders on energy management and ISO 45001 certificates refer to certification bodies accredited by DANAK or an equivalent body. Recognition is scope by scope, so check the certification body's scope for your standard.
Is the Danish NIS2 law in force?
According to the Styrelsen for Samfundssikkerhed, yes: the NIS 2-loven took effect on 1 July 2025, after Folketinget voted it through on 29 April 2025. Oversight is shared between SAMSIK and sector authorities, and covered entities register on virk.dk. Whether your organisation is covered depends on sector and size, which your sector authority or counsel can confirm.
Which authority supervises the GDPR in Denmark?
Datatilsynet, the Danish Data Protection Agency. The Data Protection Act makes it responsible, with complete independence, for monitoring processing under the Act and the GDPR, and the Agency describes itself as supervising compliance, guiding, handling complaints and inspecting. Ask Datatilsynet or your counsel how a particular processing activity is treated.
Does Danish law require a certified energy management system?
For certain large energy users, yes. Executive Order No. 1138 of 18 September 2025 requires a certified energy management system in obligated companies, with certification meaning accredited certification to ISO 50001, ISO 14001 or an equivalent standard by a DANAK-accredited body. Some companies may use EMAS or an equivalent system. Whether your company is caught is for Energistyrelsen or your counsel.
Does Arbejdstilsynet publish ISO 45001 certificate information?
Yes, on conditions. Executive Order No. 688 of 16 June 2025, in force from 1 July 2025, has Arbejdstilsynet publish information about companies holding an international ISO 45001 certificate, provided it was issued by a certification body accredited for ISO 45001 by DANAK or an equivalent body. It replaces the earlier recognised-certificate order, so check the current rules with the Authority.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Danish Data Protection Act — datatilsynet.dk; retsinformation.dk (accessed 11 Oct 2026)
- Datatilsynet catalogue of security measures and the accreditation of GDPR certification bodies — datatilsynet.dk; retsinformation.dk (accessed 11 Oct 2026)
- Lov nr. 434 af 6. maj 2025 (NIS 2-loven), passed by Folketinget on 29 April 2025 and in force since 1 July 2025 per SAMSIK, with registration on virk.dk and the designation order BEK nr. 620 af 2. juni 2025. SAMSIK's guidance on the measures maps them to DS/EN ISO/IEC 27001:2023, NIST CSF 2.0 and IEC 62443 and says that following a standard is a help but not in itself assurance of compliance. Incident reports are handled by Forsvarets Efterretningstjeneste as national CSIRT. — samsik.dk; retsinformation.dk (accessed 11 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which Finanstilsynet says applies directly to covered entities from 17 January 2025. Finanstilsynet's page covers ICT risk management, incident reporting, resilience testing and ICT third-party risk, and it names Finanstilsynet as the sector authority for financial digital infrastructure under NIS 2. The page does not name ISO/IEC 27001. — finanstilsynet.dk; samsik.dk (accessed 11 Oct 2026)
- The EU medical device and in vitro diagnostic regulations and the Danish executive orders. The Agency says devices need CE marking after a conformity assessment, that higher risk classes use a notified body, and that manufacturers choose their notified body. Its pages on CE marking and marketing do not name ISO 13485. — laegemiddelstyrelsen.dk (accessed 11 Oct 2026)
- Every food business keeps an egenkontrolprogram (self-check programme) that Fødevarestyrelsen says must be based on the seven HACCP principles and backed by a written risk analysis. The guidance does not require a third-party certificate. — foedevarestyrelsen.dk (accessed 11 Oct 2026)
- Executive Order No. 1138 of 18 September 2025 on mandatory energy management systems and energy and climate audits in certain companies. It defines certification as accredited certification to ISO 50001, ISO 14001 or an equivalent standard by a certification body accredited by DANAK or an equivalent accreditation body, and it lets certain companies use EMAS or an equivalent system instead. — retsinformation.dk (accessed 11 Oct 2026)
- Executive Order No. 688 of 16 June 2025, in force from 1 July 2025: Arbejdstilsynet publishes on its website information about companies with an international ISO 45001 certificate, on condition that the certificate comes from a certification body accredited for ISO 45001 by DANAK or an equivalent accreditation body. The order repeals Executive Order No. 92 of 26 January 2024 on recognised working environment certificates. — lovtidende.dk; retsinformation.dk (accessed 11 Oct 2026)
- The EU AI Regulation, for which Digitaliseringsstyrelsen describes itself as the national coordinating supervisory authority. The agency's page does not name ISO/IEC 42001. — digst.dk (accessed 11 Oct 2026)
- Lov nr. 1436 af 29. juni 2021 om beskyttelse af whistleblowere. Datatilsynet runs the National Whistleblower Scheme, which takes reports of serious breaches such as bribery and fraud, and its site says larger workplaces must also set up an internal scheme. The pages do not name ISO 37001 or ISO 37301. — whistleblower.dk; retsinformation.dk (accessed 11 Oct 2026)
- DANAK (Den Danske Akkrediteringsfond, the Danish Accreditation Fund) — danak.dk; european-accreditation.org; ilac.org (accessed 11 Oct 2026)
- Port Esbjerg — portesbjerg.dk (accessed 11 Oct 2026)
- Danish life sciences cluster — investindk.com (accessed 11 Oct 2026)
- Danish cleantech sector — investindk.com (accessed 11 Oct 2026)
- Danish food cluster — investindk.com (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice