Where we work · Djibouti
ISO and GRC certification consulting in Djibouti
Achieve ISO and GRC certification in Djibouti with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Djibouti
Clients include
ISO and GRC certification in Djibouti at a glance
Djibouti's business agenda is set in large part by one authority: the Djibouti Ports and Free Zones Authority, which administers and regulates the ports and the free zones, licenses free-zone companies and issues operating permits to freight forwarders, shipping agents, stevedores and ship-chandlers. Around it sit the Agence Djiboutienne des Normes et de la Qualité, which develops national standards under Law n° 100/AN/20/8ème L, the Banque Centrale de Djibouti for banks and payment providers, and the Autorité de Régulation Multisectorielle for telecommunications and energy. In December 2025 an Arrêté adopted 71 Codex Alimentarius standards as national standards for food businesses. Demand comes from port and logistics firms, operators in the Djibouti International Free Trade Zone and the Djibouti Free Zone, banks, telecommunications and ICT companies, food importers, builders and utilities. Certificates are issued by accredited certification bodies and usually carry accreditation from another economy within the international arrangements. From its Nairobi office Sterling works with Djiboutian clients on site where the work needs it and remotely otherwise, backed by 8,100+ client engagements in 60+ countries and 20+ years, and every engagement includes Effivity and Sterling Academy.
ISO and GRC standards Sterling delivers in Djibouti
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Djibouti (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law n° 18/AN/23/9ème L ratifying the African Union Convention on Cyber Security and Personal Data Protection Not stated in the ratification Law | The two-article Law ratifies the continental Convention on cyber security and personal data protection. It sets the international frame rather than detailed business duties, so organisations handling personal data should confirm with counsel how the Convention is applied in domestic rules. | |
| Djibouti Ports and Free Zones Authority (DPFZA) Ports, free zones, freight forwarding, shipping agencies, stevedoring and ship-chandling | DPFZA describes itself as a governmental entity that administers and regulates Djibouti's ports and free zones; it was created by amended decree n°2003-0207/PRE of 9 October 2003. Free-zone companies hold a trade, industrial or service licence and register with DPFZA, which is the sole administrative interface in the zones. Under Decree n° 2015-063/PR, freight forwarders, shipping representatives, stevedores and ship-chandlers must hold a permit to operate from DPFZA. DPFZA's Port Community System, launched in July 2018, is the electronic single point of entry for trade. | ISO 9001, ISO 22301, ISO/IEC 20000-1, ISO 14001 |
| Agence Djiboutienne des Normes et de la Qualité (ADN), attached to the Ministry of Commerce Producers and standards users across industry and trade | Law n° 100/AN/20/8ème L creates ADN as a public industrial and commercial establishment and names it the national reference body for developing standards. Law n° 33/AN/18/8ème L on the national standardisation and quality promotion system states that standards are voluntary, that a standard can be made mandatory by an order of the President of the Republic for reasons such as public health or the environment, and that public contracts must refer explicitly to the applicable Djiboutian or international standards. | ISO 9001, ISO 14001, ISO 45001, ISO/IEC 17025 |
| Ministry of Commerce and Tourism with ADN; Veterinary and Food Control Service as competent authority; National Food Analysis Laboratory Food importers, processors, distributors and exporters | Arrêté n° 2025-163/PR/MCT, made on 3 December 2025, adopts 71 Codex Alimentarius standards as national standards for producers, processors, importers and distributors, makes them mandatory after a transition period set in the Arrêté and charges ADN with implementation and follow-up. Arrêté n° 2025-144/PR/MCT creates the technical committee for agri-food standardisation, with members from the ministries of commerce, agriculture and health, laboratories and the Chamber of Commerce. Decree n° 2009-0197/PR/MAEM sets the National Food Analysis Laboratory the task of microbiological and physico-chemical analysis for official control and for the self-control that food hygiene rules require, including for export and re-export, and of HACCP training and expertise. | HACCP, ISO 22000, FSSC 22000, ISO/IEC 17025 |
| Banque Centrale de Djibouti (BCD) Banks, microfinance, payment and e-money providers | BCD's site lists the banking laws, among them the statutes of the Central Bank, the law on credit institutions, Law n° 118/AN/15/7ème L on the national payment system and its regulation and oversight and Law n° 119/AN/15/7ème L on the credit information system, whose text makes credit data strictly confidential to the participating institution. Instructions listed include Instruction 2017-01 on e-money issuers and Instruction 2019-05 on corporate governance of credit institutions, and Circular 3/BCD/2012 on the annual internal control report. Their full text was not examined for references to ISO/IEC 27001 or PCI DSS. | ISO/IEC 27001, PCI DSS, ISO 22301, ISO 37301 |
| Autorité de Régulation Multisectorielle de Djibouti (ARMD) Telecommunications, information and communication technologies, and energy | Law n° 74/AN/20/8ème L creates ARMD, an independent administrative authority, to regulate telecommunications and information and communication technologies and renewable and non-renewable energy and gas; its missions include monitoring the quality of service of licensed operators and granting authorisations, licences and concessions. | ISO/IEC 20000-1, ISO 50001, ISO 9001, ISO/IEC 27001 |
| Ministry in charge of labour; National Commission on Safety and Health at Work Employers and workplaces | The Labour Code (Law n° 133/AN/05/5ème L) requires a hygiene and safety committee in industrial, building and public works enterprises that habitually employ fifty or more workers, with tasks that include studying working conditions, checking that rules are applied and inquiring into serious accidents. Decree n° 2015-211/PR/MTRA sets up a National Commission on Safety and Health at Work with the labour minister to advise on regulation and on the national policy for preventing occupational risks. | ISO 45001 |
| Ministry in charge of the environment Projects and operations needing environmental authorisation | Decree n° 2011-029/PR/MHUEAT, made under the Environment Code (Law n° 51/AN/09/6ème L of 1 July 2009), defines the environmental impact assessment procedure; the environmental authorisation is issued by the environment ministry after an ad hoc technical evaluation committee has assessed the study, and the decree also defines the environmental audit of existing activities. | ISO 14001 |
| Commission Nationale Indépendante pour la Prévention et la Lutte contre la Corruption (CNIPLC) Public bodies, private companies and organisations: prevention of corruption | Law n° 103/AN/24/9ème L on preventing and fighting corruption applies to private companies, national or foreign, as well as public bodies. Its provisions on prevention call on public entities, private establishments, companies and non-governmental organisations to adopt prevention mechanisms, including a procedures manual, an internal audit service and a staff code of conduct, and it provides for the liability of legal persons under the Penal Code. | ISO 37001, ISO 37301 |
| State approval scheme under Law n° 25/AN/14/7ème L Building and equipment contractors working for the State | The Law requires an enterprise in the building and equipment sectors to obtain an approval before it can take part in public tenders of the State, public establishments and local authorities, and defines the qualification, classification and certification of such enterprises by the public scheme. | ISO 9001, ISO 45001 |
| Autorité Nationale de Cybersécurité (ANC) Information systems of the State and operators of vital importance | Law n° 195/AN/25/9ème L creates the ANC as a public administrative establishment. Its missions include coordinating cybersecurity policy, assessing the impact of emerging technologies and contributing to personal data protection, and its powers include issuing rules for State systems and for operators of vital importance and checking compliance; Article 5 requires it to act within the laws on personal data protection. | ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 |
| Autorité de l'Aviation Civile (Civil Aviation Authority) Civil aviation and aircraft-related activities | The Civil Aviation Code (Law n° 152/AN/11/6ème L) and Decree n° 2015-272/PR/MET, which organises the Civil Aviation Authority, set the aviation framework; neither text mentions AS9100. | AS9100 |
| Ministry of Health Private clinics, polyclinics and laboratories | Decree n° 2024-219/PR/MS regulates private-sector health structures and defines medical practices, multidisciplinary clinics, specialised clinics and laboratories; it is not a rule on medical device manufacture. | ISO 13485, ISO 9001 |
Accreditation and recognition
- National accreditation framework in Law n° 33/AN/18/8ème L: The Law states that accreditation is voluntary and operates within a national, regional and international system, that conformity assessment bodies must be accredited as a regulatory text provides, and that the State treats as equivalent foreign conformity assessment bodies accredited by regional or international structures of which Djibouti is a member.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Electronic public procurement portal and official tender notices (Commission Nationale des Marchés Publics (portal host); Official Journal (BOAMP notices)): Decree n° 2023-038/PRE sets up the electronic public procurement portal, hosted and managed by the National Public Procurement Commission, with the State information systems agency responsible for its management and security. Law n° 33/AN/18/8ème L requires public contract clauses and specifications to name the applicable Djiboutian or international standards; any quality certificate counts only where a tender document sets it as a criterion.
- Approval of building and equipment enterprises for public works (State, under Law n° 25/AN/14/7ème L): An enterprise in the building and equipment sectors must hold an approval to take part in public tenders; the approval rests on qualification and classification by means in personnel, equipment and economic potential.
Economic zones
- Djibouti International Free Trade Zone (DIFTZ): logistics and bonded warehousing, processing manufacturing, including food processing, marine products and auto parts assembly, business support and financial services
- Djibouti Free Zone (DFZ): import, warehousing, processing and re-export of goods, light industrial units
Sterling in Djibouti
Sterling delivers in Djibouti from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Djibouti clients ask
Does Djibouti have a national accreditation body for ISO certificates?
Certificates for Djiboutian organisations usually carry accreditation from another economy. Law n° 33/AN/18/8ème L calls accreditation voluntary, expects conformity assessment bodies to be accredited under a regulatory text, and treats foreign bodies accredited through regional or international structures as equivalent. In practice, certificates usually carry accreditation from another economy. Check the scope and your buyer's acceptance before you commit.
What does the 2025 Codex Alimentarius Arrêté mean for food businesses?
Arrêté n° 2025-163/PR/MCT adopts 71 Codex Alimentarius standards as national standards for producers, processors, importers and distributors, and ADN is charged with implementing them. They become mandatory after a transition period that the Arrêté sets, so importers and processors should map their hygiene controls against the list now and confirm the detail with the ministry or ADN.
Do companies in the Djibouti free zones need a licence from DPFZA?
Yes. DPFZA is the sole administrative interface in the free zones, and a company registers with it, holds a free zone licence and has its registration office and base of operations inside a zone. The licence types are trade, industrial and service. Freight forwarders, shipping agents, stevedores and ship-chandlers also need a DPFZA permit. Confirm the current conditions with the Authority.
Is ISO certification compulsory in Djibouti?
Not as a general rule. Law n° 33/AN/18/8ème L makes standards voluntary unless the President orders a standard to be mandatory for reasons such as health or the environment. Public contracts must refer to the applicable standards in their specifications, but a certificate counts only where the tender sets it. Ask the contracting authority and your counsel what a specific bid requires.
Which language are audits in Djibouti conducted in?
Mostly in French, with English and Arabic possible. Arabic and French are the official languages under the Constitution, the Official Journal appears in both, and the free-zone authority writes in English. Decide the working language of the audit, the use of an interpreter and the language of your controlled documents at the application stage, because the auditor must read the evidence presented.
Is a health and safety committee compulsory for Djiboutian employers?
For some, yes. The Labour Code requires a hygiene and safety committee in industrial, building and public works enterprises that habitually employ fifty or more workers, and the committee studies working conditions, checks that rules are applied and inquires into serious accidents. Smaller employers and other sectors should check the Code and the labour inspectorate; ISO 45001 can structure the same duties.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law n° 18/AN/23/9ème L ratifying the African Union Convention on Cyber Security and Personal Data Protection — journalofficiel.dj (accessed 18 Oct 2026)
- DPFZA describes itself as a governmental entity that administers and regulates Djibouti's ports and free zones; it was created by amended decree n°2003-0207/PRE of 9 October 2003. Free-zone companies hold a trade, industrial or service licence and register with DPFZA, which is the sole administrative interface in the zones. Under Decree n° 2015-063/PR, freight forwarders, shipping representatives, stevedores and ship-chandlers must hold a permit to operate from DPFZA. DPFZA's Port Community System, launched in July 2018, is the electronic single point of entry for trade — dpfza.gov.dj (accessed 18 Oct 2026)
- Law n° 100/AN/20/8ème L creates ADN as a public industrial and commercial establishment and names it the national reference body for developing standards. Law n° 33/AN/18/8ème L on the national standardisation and quality promotion system states that standards are voluntary, that a standard can be made mandatory by an order of the President of the Republic for reasons such as public health or the environment, and that public contracts must refer explicitly to the applicable Djiboutian or international standards — journalofficiel.dj (accessed 18 Oct 2026)
- Arrêté n° 2025-163/PR/MCT, made on 3 December 2025, adopts 71 Codex Alimentarius standards as national standards for producers, processors, importers and distributors, makes them mandatory after a transition period set in the Arrêté and charges ADN with implementation and follow-up. Arrêté n° 2025-144/PR/MCT creates the technical committee for agri-food standardisation, with members from the ministries of commerce, agriculture and health, laboratories and the Chamber of Commerce. Decree n° 2009-0197/PR/MAEM sets the National Food Analysis Laboratory the task of microbiological and physico-chemical analysis for official control and for the self-control that food hygiene rules require, including for export and re-export, and of HACCP training and expertise — journalofficiel.dj (accessed 18 Oct 2026)
- BCD's site lists the banking laws, among them the statutes of the Central Bank, the law on credit institutions, Law n° 118/AN/15/7ème L on the national payment system and its regulation and oversight and Law n° 119/AN/15/7ème L on the credit information system, whose text makes credit data strictly confidential to the participating institution. Instructions listed include Instruction 2017-01 on e-money issuers and Instruction 2019-05 on corporate governance of credit institutions, and Circular 3/BCD/2012 on the annual internal control report. Their full text was not examined for references to ISO/IEC 27001 or PCI DSS — banque-centrale.dj; journalofficiel.dj (accessed 18 Oct 2026)
- Law n° 74/AN/20/8ème L creates ARMD, an independent administrative authority, to regulate telecommunications and information and communication technologies and renewable and non-renewable energy and gas; its missions include monitoring the quality of service of licensed operators and granting authorisations, licences and concessions — journalofficiel.dj (accessed 18 Oct 2026)
- The Labour Code (Law n° 133/AN/05/5ème L) requires a hygiene and safety committee in industrial, building and public works enterprises that habitually employ fifty or more workers, with tasks that include studying working conditions, checking that rules are applied and inquiring into serious accidents. Decree n° 2015-211/PR/MTRA sets up a National Commission on Safety and Health at Work with the labour minister to advise on regulation and on the national policy for preventing occupational risks — journalofficiel.dj (accessed 18 Oct 2026)
- Decree n° 2011-029/PR/MHUEAT, made under the Environment Code (Law n° 51/AN/09/6ème L of 1 July 2009), defines the environmental impact assessment procedure; the environmental authorisation is issued by the environment ministry after an ad hoc technical evaluation committee has assessed the study, and the decree also defines the environmental audit of existing activities — journalofficiel.dj (accessed 18 Oct 2026)
- Law n° 103/AN/24/9ème L on preventing and fighting corruption applies to private companies, national or foreign, as well as public bodies. Its provisions on prevention call on public entities, private establishments, companies and non-governmental organisations to adopt prevention mechanisms, including a procedures manual, an internal audit service and a staff code of conduct, and it provides for the liability of legal persons under the Penal Code — journalofficiel.dj (accessed 18 Oct 2026)
- The Law requires an enterprise in the building and equipment sectors to obtain an approval before it can take part in public tenders of the State, public establishments and local authorities, and defines the qualification, classification and certification of such enterprises by the public scheme — journalofficiel.dj (accessed 18 Oct 2026)
- Law n° 195/AN/25/9ème L creates the ANC as a public administrative establishment. Its missions include coordinating cybersecurity policy, assessing the impact of emerging technologies and contributing to personal data protection, and its powers include issuing rules for State systems and for operators of vital importance and checking compliance; Article 5 requires it to act within the laws on personal data protection — journalofficiel.dj (accessed 18 Oct 2026)
- The Civil Aviation Code (Law n° 152/AN/11/6ème L) and Decree n° 2015-272/PR/MET, which organises the Civil Aviation Authority, set the aviation framework; neither text mentions AS9100 — journalofficiel.dj (accessed 18 Oct 2026)
- Decree n° 2024-219/PR/MS regulates private-sector health structures and defines medical practices, multidisciplinary clinics, specialised clinics and laboratories; it is not a rule on medical device manufacture — journalofficiel.dj (accessed 18 Oct 2026)
- National accreditation framework in Law n° 33/AN/18/8ème L — journalofficiel.dj (accessed 18 Oct 2026)
- Electronic public procurement portal and official tender notices — journalofficiel.dj (accessed 18 Oct 2026)
- Approval of building and equipment enterprises for public works — journalofficiel.dj (accessed 18 Oct 2026)
- Djibouti International Free Trade Zone (DIFTZ) — dpfza.gov.dj (accessed 18 Oct 2026)
- Djibouti Free Zone (DFZ) — dpfza.gov.dj (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice