Where we work · Estonia
ISO and GRC certification consulting in Estonia
Achieve ISO and GRC certification in Estonia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Estonia
Clients include
ISO and GRC certification in Estonia at a glance
Estonian buyers ask for ISO and GRC evidence for three reasons: an export-oriented industrial and electronics base, a digital economy with strong IT, shared-service and fintech activity, and public rules that lean on security standards. The Information System Authority, RIA, supervises security under the Cybersecurity Act, asks ISO/IEC 27001-certified providers to send it their certificate and maintains the Estonian information security standard E-ITS. The Andmekaitse Inspektsioon supervises personal data under the Personal Data Protection Act and the GDPR. The Agriculture and Food Board approves food businesses, the State Agency of Medicines oversees medical devices and the Labour Inspectorate enforces the Occupational Health and Safety Act. Certificates come from certification bodies accredited by EAK, the Estonian Accreditation Centre, never from Sterling. Sterling serves Estonian clients from its Frankfurt office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Estonia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Estonia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act Andmekaitse Inspektsioon (AKI, the Estonian Data Protection Inspectorate) — it describes itself as the national supervisory authority under the Personal Data Protection Act, the Public Information Act, the Electronic Communications Act and the GDPR | The Inspectorate publishes the Estonian legislation it applies, including the Personal Data Protection Act, the Public Information Act and the Electronic Communications Act, links to the consolidated texts on Riigi Teataja, and offers guidance for foreign persons and authorities. | |
| Data protection officer notification and cross-border data protection impact assessment list Andmekaitse Inspektsioon (AKI) | The Inspectorate says a data protection officer is the contact person for the supervisory authority and for data subjects, that communication with the Inspectorate and the public is in Estonian under the Estonian Language Act, and that the easiest way to report the officer is through the e-Business Register. It also publishes an indicative list of cross-border processing that calls for a data protection impact assessment. | |
| Riigi Infosüsteemi Amet (RIA, the Information System Authority), which operates as the National Cyber Security Centre NCSC-EE and sits in the administrative area of the Ministry of Justice and Digital Affairs Providers of services that matter to society, state and local government bodies, telecommunications, digital services and trust services | Küberturvalisuse seadus (the Cybersecurity Act). RIA says it supervises security measures in the information systems of state and local government bodies, providers of essential and vital services, telecommunications, digital services and trust services, under the Cybersecurity Act, the Public Information Act, the Electronic Communications Act and the trust services Act. RIA also says that, under the Cybersecurity Act, it is the competent authority and contact point for the NIS Directive. | ISO/IEC 27001, ISO 22301 |
| Riigi Infosüsteemi Amet (RIA) Organisations fulfilling public duties and service providers subject to the Government's cyber security requirements | Eesti infoturbestandard (E-ITS, the Estonian information security standard) and the Government regulation 'Võrgu- ja infosüsteemide küberturvalisuse nõuded' (cyber security requirements for network and information systems). RIA says E-ITS is compatible with ISO/IEC 27001, must be implemented by any organisation fulfilling public duties and may be used by private businesses. RIA also says a service provider that has applied security measures in line with ISO/IEC 27001 must send RIA its ISO/IEC 27001 conformity certificate, and that a provider obliged to be audited must send RIA the conclusion of its E-ITS audit. | ISO/IEC 27001 |
| Finantsinspektsioon (the Estonian Financial Supervision and Resolution Authority) — it describes itself as an independent financial supervision and crisis resolution authority and as part of the Single Supervisory Mechanism Financial entities (banks, insurers, investment firms, payment and e-money institutions and others in DORA's scope) | Regulation (EU) 2022/2554 (DORA) on digital operational resilience for the financial sector, which applies to credit institutions, payment institutions, electronic money institutions, investment firms and other listed entities. The Regulation is not a certification scheme and does not name ISO/IEC 27001. | |
| Põllumajandus- ja Toiduamet (PTA, the Agriculture and Food Board), a government agency under the Ministry of Regional Affairs and Agriculture Food businesses | The Food Act and Regulation (EC) No 852/2004. PTA says an operator that handles food and puts it on the market must be approved under the Food Act before it starts, lists the operators that need approval (including those processing, manufacturing or packaging food), and runs governmental supervision of food handling. Regulation (EC) No 852/2004 requires food business operators to maintain a permanent procedure based on the HACCP principles; neither source makes a third-party certificate compulsory. | HACCP, ISO 22000 |
| Ravimiamet (the State Agency of Medicines), an agency under the Ministry of Social Affairs Medical device manufacturers, distributors and importers | Regulations (EU) 2017/745 and (EU) 2017/746, which the Agency says are directly applicable in Estonia, together with the national Medical Devices Act. The Agency conducts market surveillance, says the manufacturer is solely responsible for conformity and notes that for higher-risk devices a notified body takes part in conformity assessment. It says EUDAMED registration is mandatory for economic operators and that distributors of listed device classes still notify the Agency. Its pages do not name ISO 13485. | |
| Tööinspektsioon (the Labour Inspectorate) Employers (occupational health and safety) | The Occupational Health and Safety Act. The Inspectorate says the Act applies in full to posted workers, that a user undertaking must ensure compliance for temporary agency workers, and, in its 2024 news release, that a work environment risk analysis is mandatory for every Estonian company with at least one employee. The sources do not name ISO 45001. | |
| EU framework; the Estonian supervisory arrangements are for the competent national authorities to confirm Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and its text does not name ISO/IEC 42001. | |
| EU framework; the Estonian authority applying it is for the enterprise to confirm Large energy users (energy management systems and energy audits) | Directive (EU) 2023/1791 on energy efficiency. It requires Member States to ensure that enterprises above a stated energy consumption implement an energy management system certified by an independent body in accordance with relevant European or international standards, and that enterprises above a lower threshold which do not do so are subject to energy audits. A recital gives EN ISO 50001 as an example of a relevant standard. | ISO 50001 |
Accreditation and recognition
- EAK (Eesti Akrediteerimiskeskus, the Estonian Accreditation Centre): National accreditation body — EAK's own site says it is the national accreditation body named by Government order No. 253 of 9 July 2020, as the accreditation unit of the non-profit Eesti Standardimis- ja Akrediteerimiskeskus (EVS).
- EVS (Eesti Standardimis- ja Akrediteerimiskeskus, the Estonian Centre for Standardisation and Accreditation): National standards body — standards role only: it adopts and publishes European and international standards as Estonian standards (the EVS-EN, EVS-EN ISO and EVS-ISO designations) and sells them with related training.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Act (Contracting authorities; the Ministry of Finance is responsible for public procurement policy, drafting the law, supervision and consulting): The Ministry of Finance says Estonian public procurement is regulated by the Public Procurement Act, supplemented by Government regulations, with notices and e-procurement in the central Public Procurement Register. It says the Government agreed strategic procurement principles in November 2023 (reliable, environmentally friendly, supporting innovation, socially responsible and reasonable). At EU level, Directive 2014/24/EU says that where authorities require certificates from independent bodies on quality assurance or environmental management they refer to systems certified by accredited bodies, and must recognise equivalent certificates from bodies in other Member States. Each tender sets its own criteria.
Economic zones
- North Estonia industrial, shared-service and electronics cluster: manufacturing, energy, electronics, global business services, supply chain
- South Estonia ICT and start-up ecosystem: ICT, start-ups, research and academia
- West Estonia timber, food, energy and marine industries: timber, agriculture, food, tourism, energy, marine
Sterling in Estonia
Sterling delivers in Estonia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Estonia clients ask
Are certification audits in Estonia conducted in Estonian or English?
The certification body agrees the language with you at application. Estonian is the official language and English is widely used in business, so many audits run in English with Estonian records. Say early which language the auditors must read in your procedures. Regulators can differ: the Data Protection Inspectorate states that its communication with data protection officers is in Estonian.
Which authority supervises personal data protection in Estonia?
Andmekaitse Inspektsioon, the Data Protection Inspectorate. It describes itself as the national supervisory authority under the Personal Data Protection Act, the Public Information Act, the Electronic Communications Act and the GDPR, and publishes the legislation it applies. For how a processing activity is treated, ask the Inspectorate or your counsel.
Which body accredits certification bodies in Estonia?
EAK, the Estonian Accreditation Centre, which its own site names as the national accreditation body under a Government order of 9 July 2020. It says it signed the EA multilateral agreement for management system certification in 2005. Recognition is by scope, so check the scope of the certification body you choose before applying.
What does RIA ask of a service provider that holds ISO/IEC 27001 certification?
RIA states that a service provider which has applied security measures in line with ISO/IEC 27001 must send RIA its conformity certificate under the Government's cyber security requirements regulation. RIA also describes E-ITS as compatible with ISO/IEC 27001. Whether the duty reaches your organisation depends on its status, so confirm with RIA.
Do food businesses in Estonia need approval before they start?
Many do. The Agriculture and Food Board says an operator handling food and placing it on the market must be approved under the Food Act before starting, and lists the categories, including food processing, manufacturing and packaging. Regulation (EC) No 852/2004 separately requires HACCP-based procedures. Ask the Board which category fits your activity.
Can Estonian public buyers ask for ISO certificates?
Yes, within limits. The Public Procurement Act governs tenders, and at EU level Directive 2014/24/EU says authorities asking for independent quality or environmental certificates refer to systems certified by accredited bodies and accept equivalent certificates from other Member States. Each tender sets its own criteria, so read the documents and take legal advice on a specific bid.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act — aki.ee; eur-lex.europa.eu (accessed 18 Oct 2026)
- Data protection officer notification and cross-border data protection impact assessment list — aki.ee (accessed 18 Oct 2026)
- Küberturvalisuse seadus (the Cybersecurity Act). RIA says it supervises security measures in the information systems of state and local government bodies, providers of essential and vital services, telecommunications, digital services and trust services, under the Cybersecurity Act, the Public Information Act, the Electronic Communications Act and the trust services Act. RIA also says that, under the Cybersecurity Act, it is the competent authority and contact point for the NIS Directive. — ria.ee (accessed 18 Oct 2026)
- Eesti infoturbestandard (E-ITS, the Estonian information security standard) and the Government regulation 'Võrgu- ja infosüsteemide küberturvalisuse nõuded' (cyber security requirements for network and information systems). RIA says E-ITS is compatible with ISO/IEC 27001, must be implemented by any organisation fulfilling public duties and may be used by private businesses. RIA also says a service provider that has applied security measures in line with ISO/IEC 27001 must send RIA its ISO/IEC 27001 conformity certificate, and that a provider obliged to be audited must send RIA the conclusion of its E-ITS audit. — ria.ee (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA) on digital operational resilience for the financial sector, which applies to credit institutions, payment institutions, electronic money institutions, investment firms and other listed entities. The Regulation is not a certification scheme and does not name ISO/IEC 27001. — fi.ee; eur-lex.europa.eu (accessed 18 Oct 2026)
- The Food Act and Regulation (EC) No 852/2004. PTA says an operator that handles food and puts it on the market must be approved under the Food Act before it starts, lists the operators that need approval (including those processing, manufacturing or packaging food), and runs governmental supervision of food handling. Regulation (EC) No 852/2004 requires food business operators to maintain a permanent procedure based on the HACCP principles; neither source makes a third-party certificate compulsory. — pta.agri.ee; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulations (EU) 2017/745 and (EU) 2017/746, which the Agency says are directly applicable in Estonia, together with the national Medical Devices Act. The Agency conducts market surveillance, says the manufacturer is solely responsible for conformity and notes that for higher-risk devices a notified body takes part in conformity assessment. It says EUDAMED registration is mandatory for economic operators and that distributors of listed device classes still notify the Agency. Its pages do not name ISO 13485. — ravimiamet.ee (accessed 18 Oct 2026)
- The Occupational Health and Safety Act. The Inspectorate says the Act applies in full to posted workers, that a user undertaking must ensure compliance for temporary agency workers, and, in its 2024 news release, that a work environment risk analysis is mandatory for every Estonian company with at least one employee. The sources do not name ISO 45001. — ti.ee (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and its text does not name ISO/IEC 42001. — eur-lex.europa.eu (accessed 18 Oct 2026)
- Directive (EU) 2023/1791 on energy efficiency. It requires Member States to ensure that enterprises above a stated energy consumption implement an energy management system certified by an independent body in accordance with relevant European or international standards, and that enterprises above a lower threshold which do not do so are subject to energy audits. A recital gives EN ISO 50001 as an example of a relevant standard. — eur-lex.europa.eu (accessed 18 Oct 2026)
- EAK (Eesti Akrediteerimiskeskus, the Estonian Accreditation Centre) — eak.ee; european-accreditation.org (accessed 18 Oct 2026)
- EVS (Eesti Standardimis- ja Akrediteerimiskeskus, the Estonian Centre for Standardisation and Accreditation) — evs.ee; eak.ee (accessed 18 Oct 2026)
- Public procurement under the Public Procurement Act — fin.ee; eur-lex.europa.eu (accessed 18 Oct 2026)
- North Estonia industrial, shared-service and electronics cluster — investinestonia.com (accessed 18 Oct 2026)
- South Estonia ICT and start-up ecosystem — investinestonia.com (accessed 18 Oct 2026)
- West Estonia timber, food, energy and marine industries — investinestonia.com (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice