Where we work · France
ISO and GRC certification consulting in France
Achieve ISO and GRC certification in France with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in France
Clients include
ISO and GRC certification in France at a glance
Demand for certification and compliance work in France runs through a handful of named institutions. Cofrac, the sole national accreditation body, accredits the certification bodies and laboratories behind most management-system certificates. ANSSI pilots the NIS 2 transposition, still a bill, already runs the NIS regime for designated operators of essential services and qualifies cloud providers under SecNumCloud. The CNIL supervises personal-data processing under the GDPR and the Loi Informatique et Libertés. Health-data hosts need HDS certification, training providers need Qualiopi, and companies caught by article 17 of the Sapin II law answer to the Agence française anticorruption. Automotive suppliers work with IATF France, and financial entities with DORA. Demand is strongest among banks and insurers, IT and cloud providers, health, automotive and aerospace suppliers, industry, food producers and training firms. Certificates come from accredited certification bodies; Sterling does not certify. Sterling's Enschede office serves French clients with 20+ years behind it and 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy come included with the engagement.
ISO and GRC standards Sterling delivers in France
Each page covers who needs the standard in France, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in France (18)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR; in French RGPD) and the Loi Informatique et Libertés Commission nationale de l'informatique et des libertés (CNIL) — the Loi n° 78-17 states that the CNIL is an independent administrative authority and the national supervisory authority for the purposes of the GDPR | The GDPR applies directly. The Loi n° 78-17 supplements it: the CNIL informs data subjects and controllers of their rights and obligations, checks that processing complies, and publishes guidelines, recommendations and reference frameworks to help controllers and processors comply. | |
| Designation of a data protection officer (délégué à la protection des données, DPO) CNIL | The CNIL states designation is mandatory for public authorities and bodies; for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale; and for organisations whose core activities involve large-scale processing of sensitive data or data on criminal convictions and offences. In other cases the CNIL encourages designation. The DPO may be internal or external. | |
| Agence nationale de la sécurité des systèmes d'information (ANSSI) Essential and important entities under the EU NIS 2 Directive (France's transposition) | Projet de loi Résilience (Résilience des infrastructures critiques et renforcement de la cybersécurité, Texte n° 33 (2024-2025)) — transposition pending: ANSSI states 'La transposition de la directive NIS 2 en France est en cours'; the Sénat's dossier shows first-reading adoption by the Sénat on 12 March 2025 and the Assemblée nationale special committee text dated 10 September 2025. ANSSI pilots the transposition and will implement it; pre-registration of entities is open on MesServicesCyber. | |
| ANSSI Operators of essential services and digital service providers (NIS 1 regime, in force) | NIS 1 transposed in France on 26 February 2018; the rules apply to any operator designated Opérateur de service essentiel by arrêté of the Prime Minister under the décret n° 2018-384 du 23 mai 2018 relatif à la sécurité des réseaux et systèmes d'information des opérateurs de services essentiels et des fournisseurs de service numérique; ANSSI supports operators and controls compliance as national authority. A separate dispositif protects vital information systems (SIIV). | |
| ANSSI Future NIS 2 entities and other organisations securing information systems | Référentiel Cyber France (ReCyF) — available from 17 March 2026 as a working document listing the measures ANSSI recommends to meet the NIS 2 security objectives; non-mandatory by default, it lets future regulated entities who apply it rely on it in an ANSSI inspection; ANSSI offers a tool to compare ReCyF with other frameworks, standards and regulations already in use. | |
| ANSSI Cloud service providers (SaaS, PaaS, IaaS, CaaS) serving public and private entities | SecNumCloud — qualification scheme based on the SecNumCloud reference ANSSI developed in 2016; the qualification is subject to annual surveillance audits and renewal, and the reference can also be used as good practice outside any regulatory context. No standalone hub exists on sterling-grc.com for SecNumCloud (hub candidate). | |
| Agence du Numérique en Santé (ANS) reference; certification bodies accredited by Cofrac Health-data hosts (hébergeurs de données de santé, HDS) | HDS certification — Cofrac's document CERT CEPE REF 35 (revision 08, effective 7 July 2026) sets the specific requirements for accrediting bodies that certify management systems in information technology, covering both ISO/IEC 27001 certification and certification of health-data-hosting management systems against the ANS HDS certification reference; the document cites the Ordonnance n°2017-27 du 12 janvier 2017 relative à l'hébergement de données de santé à caractère personnel. No standalone hub exists on sterling-grc.com for HDS (hub candidate). | ISO/IEC 27001 |
| Competent financial supervisory authorities designated under the Regulation Financial entities and their ICT third-party providers | Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) — directly applicable EU regulation; its recitals cover ICT risk management and ICT third-party risk across the financial sector. | |
| Agence française anticorruption (AFA) Companies and groups subject to the Sapin II anti-corruption programme duty | Article 17 of the Sapin II law — entities subject to it must put in place an anti-corruption programme built on leadership commitment, corruption risk mapping, a code of conduct, training for exposed staff, third-party integrity assessment, an internal alert system, internal and accounting controls and a disciplinary regime; the AFA advises and controls. The AFA document does not make an ISO certificate a requirement. | |
| EU law applied through French implementation Private and public employers — internal whistleblowing channels | Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law — Member States ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up. | |
| State (labour ministry services, DREETS) with certification bodies accredited or authorised by Cofrac Training providers seeking public or pooled funding | Qualiopi quality certification — obligatory for training providers that want public or pooled funds, delivered by third-party bodies accredited or authorised by Cofrac against a national quality reference organised around seven criteria. Qualiopi is a separate French scheme, not ISO 9001. No standalone hub exists on sterling-grc.com for Qualiopi (hub candidate). | |
| IATF France — oversight office Automotive suppliers (quality management) | IATF 16949 — IATF France, a non-profit association whose members are FIEV, Renault Group, Sernauto, Stellantis and Volvo Group, oversees the operations of IATF certification bodies, coordinates auditor qualification and contributes to standards development. | IATF 16949 |
| EU food hygiene law, applied by the competent French authorities Food businesses | Regulation (EC) No 852/2004, Article 5 — food business operators must put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. | HACCP |
| EU medical devices law, applied by the competent authority and notified bodies Medical device manufacturers | Regulation (EU) 2017/745 on medical devices — manufacturers must establish, document, implement, maintain, keep up to date and continually improve a quality management system that ensures compliance with the Regulation, proportionate to risk class and device type. | |
| EU energy efficiency law, applied through French implementation Large energy consumers | Directive (EU) 2023/1791 on energy efficiency (recast), Article 11 — enterprises above the Directive's average annual energy-consumption threshold must implement an energy management system certified by an independent body in accordance with the relevant European or international standards; enterprises with a certified environmental management system that includes an energy audit are exempt from the audit and management-system duties. | |
| EU law; CNIL publishes AI guidance on personal data Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act); the CNIL runs an artificial intelligence section with guidance and tools, and the Loi n° 78-17 charges it to promote privacy-respecting AI innovation through its guidelines and reference frameworks. | |
| MASE association network Industrial and service companies working on high-risk sites | MASE certification — a health, safety and environment (SSE) certification scheme with its own reference (editions V2014 and V2024) managed through eleven local associations. No standalone hub exists on sterling-grc.com for MASE (hub candidate). | |
| EU law applied through French implementation Employers (occupational health and safety) | Council Directive 89/391/EEC — the employer takes the measures necessary for the safety and health protection of workers, including prevention of occupational risks, and holds an assessment of the risks to safety and health at work. |
Accreditation and recognition
- Comité français d'accréditation (Cofrac): Sole national accreditation body in France — a non-profit association created in 1994 at the initiative of the public authorities and designated in 2008 as the single national accreditation body under Regulation (EC) No 765/2008; its sections cover certification bodies (including management-system certification), laboratories, inspection bodies and human-health laboratories.
- ANSSI: Not an accreditation body — national cybersecurity authority that grants security 'visas' such as the SecNumCloud qualification to solutions and services that demonstrate a high level of security.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Directive 2014/24/EU on public procurement — Article 62 (quality assurance standards and environmental management standards) (European Union (applied by French contracting authorities)): Where contracting authorities require certificates from independent bodies attesting that the economic operator complies with quality assurance standards, they refer to quality assurance systems based on the relevant European standards series certified by accredited bodies, and recognise equivalent certificates from bodies in other Member States. For environmental management they refer to EMAS, other systems recognised under Regulation (EC) No 1221/2009, or other environmental management standards based on European or international standards, certified by accredited bodies. The Directive does not make a certificate mandatory; each tender sets its own criteria.
Sterling in France
Sterling delivers in France from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in France, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions French clients ask
Are certification audits in France conducted in French or English?
Usually either, by agreement. French is the official language, while international groups and technology firms often work in English. Settle the audit language and the language of your controlled documents with the certification body at application. A customer contract, tender or regulator may impose French, and ANSSI, the CNIL and the AFA all correspond in that language.
Which accreditation should a certification body hold in France?
Look for accreditation by Cofrac, the Comité français d'accréditation, which is France's sole national accreditation body. It accredits management-system certification bodies, laboratories and inspection bodies. Cofrac says its mission includes wide acceptance of the attestations of the bodies it accredits through mutual recognition agreements. Check that the accreditation scope names your standard and sector.
Is the French NIS 2 law in force yet?
Not as French law yet. ANSSI states that transposition of the NIS 2 Directive is under way, and the Sénat adopted the bill in March 2025 while the Assemblée nationale stage continues. ANSSI invites future essential and important entities to prepare now and has published its ReCyF working document. Confirm the current stage with ANSSI or your counsel.
Which authority supervises GDPR compliance in France?
The Commission nationale de l'informatique et des libertés (CNIL). The Loi n° 78-17 of 6 January 1978 makes it an independent administrative authority and the national supervisory authority for the GDPR. It informs organisations of their obligations, checks compliance and publishes guidelines and reference frameworks. Take specific questions about your processing to the CNIL or your counsel.
What is HDS certification and who needs it?
HDS is French certification for health-data hosts. Certification bodies, accredited by Cofrac, certify the management system of a host against the reference of the Agence du Numérique en Santé. Cofrac's requirements document covers it alongside ISO/IEC 27001 certification. Whether your service counts as health-data hosting is a legal question to settle with the ANS or your counsel.
Do French public tenders require ISO certificates?
No general rule requires them. The EU procurement directive leaves certificates optional and lets every contracting authority set its own criteria. When an authority does request independent certificates for quality assurance, it points to systems certified by accredited bodies and must recognise equivalents from other Member States. The tender documents settle your case, so read them closely.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR; in French RGPD) and the Loi Informatique et Libertés — cnil.fr; eur-lex.europa.eu (accessed 7 Oct 2026)
- Designation of a data protection officer (délégué à la protection des données, DPO) — cnil.fr (accessed 7 Oct 2026)
- Projet de loi Résilience (Résilience des infrastructures critiques et renforcement de la cybersécurité, Texte n° 33 (2024-2025)) — messervices.cyber.gouv.fr; senat.fr (accessed 7 Oct 2026)
- NIS 1 transposed in France on 26 February 2018; the rules apply to any operator designated Opérateur de service essentiel by arrêté of the Prime Minister under the décret n° 2018-384 du 23 mai 2018 relatif à la sécurité des réseaux et systèmes d'information des opérateurs de services essentiels et des fournisseurs de service numérique; ANSSI supports operators and controls compliance as national authority. A separate dispositif protects vital information systems (SIIV). — cyber.gouv.fr (accessed 7 Oct 2026)
- Référentiel Cyber France (ReCyF) — cyber.gouv.fr (accessed 7 Oct 2026)
- SecNumCloud — cyber.gouv.fr (accessed 7 Oct 2026)
- HDS certification — tools.cofrac.fr (accessed 7 Oct 2026)
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) — eur-lex.europa.eu (accessed 7 Oct 2026)
- Article 17 of the Sapin II law — agence-francaise-anticorruption.gouv.fr (accessed 7 Oct 2026)
- Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law — eur-lex.europa.eu (accessed 7 Oct 2026)
- Qualiopi quality certification — paca.dreets.gouv.fr (accessed 7 Oct 2026)
- IATF 16949 — iatf-france.fr (accessed 7 Oct 2026)
- Regulation (EC) No 852/2004, Article 5 — eur-lex.europa.eu (accessed 7 Oct 2026)
- Regulation (EU) 2017/745 on medical devices — eur-lex.europa.eu (accessed 7 Oct 2026)
- Directive (EU) 2023/1791 on energy efficiency (recast), Article 11 — eur-lex.europa.eu (accessed 7 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act); the CNIL runs an artificial intelligence section with guidance and tools, and the Loi n° 78-17 charges it to promote privacy-respecting AI innovation through its guidelines and reference frameworks. — eur-lex.europa.eu; cnil.fr (accessed 7 Oct 2026)
- MASE certification — mase-asso.fr (accessed 7 Oct 2026)
- Council Directive 89/391/EEC — eur-lex.europa.eu (accessed 7 Oct 2026)
- Comité français d'accréditation (Cofrac) — cofrac.fr (accessed 7 Oct 2026)
- ANSSI — cyber.gouv.fr (accessed 7 Oct 2026)
- Directive 2014/24/EU on public procurement — Article 62 (quality assurance standards and environmental management standards) — eur-lex.europa.eu (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice