Where we work · Georgia
ISO and GRC certification consulting in Georgia
Achieve ISO and GRC certification in Georgia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Georgia
Clients include
ISO and GRC certification in Georgia at a glance
Georgia's procurement law gives accredited certificates a defined place: Article 62 of the Law on Public Procurement tells a contracting authority that examines a supplier's quality system to accept certificates from accredited organisations, and it lets environmental capability be shown by EMAS or an accredited certificate. The national accreditation body is the Georgian Accreditation Center (GAC), which Global ACI lists as a Full Member and signatory of its mutual recognition arrangement. Food businesses carry a separate duty, because the Food Code requires HACCP-based procedures outside primary production under the National Food Agency. Personal data falls under the 2023 Law on Personal Data Protection, which the consolidated text places with the State Audit Office. Geostat's 2025 export table puts motor cars first, followed by ores, ethyl alcohol, wine, ferro-alloys, mineral waters and hazelnuts, so food, drink and metals buyers shape much of the demand. Sterling's Dubai office serves Georgian organisations, drawing on 8,100+ client engagements in 60+ countries and 20+ years of practice, with Effivity and Sterling Academy included with the engagement. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Georgia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Georgia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of Georgia on Personal Data Protection The State Audit Office. The consolidated text, as amended by Law No 1289 of 17 December 2025, names the State Audit Office as the body that monitors the lawfulness of data processing in Georgia (Article 49); inspection decisions are taken by the Auditor General (Article 51) and subordinate acts are issued by the Auditor General (Article 40). A few provisions of the same text still refer to the Personal Data Protection Service. | Applies to processing wholly or partly by automated means within Georgia, to filing systems, and to controllers outside Georgia that use technical means available in Georgia (Article 2); purely personal or household activities and the other matters listed in Article 2 fall outside it. Duties include a lawful ground for each processing (Article 5), rules for special categories (Article 6), data subject rights (Articles 13–22), security measures (Article 27), written records of processing (Article 28), notice of an incident to the State Audit Office not later than 72 hours after identification unless significant damage is least expected (Article 29), impact assessments (Article 31), a data protection officer for listed sectors and large-scale processors (Article 33), a special representative for controllers registered outside Georgia (Article 34), processor agreements (Article 36) and conditions for transfers abroad (Articles 37–38). | |
| National Food Agency, a legal entity under public law under the state control of the Ministry of Environmental Protection and Agriculture, under the Food Products/Animal Feed Safety, Veterinary and Plant Protection Code, Law No 6155-Iს of 8 May 2012 Food producers, processors and distributors | Article 17¹ requires food business operators to introduce food safety procedures in accordance with the principles of the Hazard Analysis and Critical Control Points (HACCP) system, keep records, and update the system when food or its production changes; the system is not required for primary production, and the Government fixes by ordinance the types of production for which it is introduced. The Code treats audit of HACCP-based procedures as a mechanism of state control. | HACCP |
| National Bank of Georgia Banks, microbanks, payment service providers and other supervised financial firms | The National Bank's own pages say a commercial bank is a legal entity licensed by the National Bank and that the requirements for supervision and regulation of banks are set by the Organic Law on the National Bank of Georgia, the Law on the Activities of Commercial Banks and subordinate acts. The same site lists supervision of microbanks, non-bank institutions, payment service providers and capital markets. The Law on Payment Systems and Payment Services (No 6304-Iს of 25 May 2012) provides for payment service providers registered by the National Bank. | |
| The competent agency named in the Law of Georgia on Medicines and Pharmaceutical Activities, No 659 of 17 April 1997 Pharmaceutical manufacturers, importers and distributors | Article 12 puts the manufacturing of a pharmaceutical product under a permit regime issued by the Agency and provides that Georgia selectively recognises a list of international, regional and national Good Manufacturing Practice standards, which the Government recognises. The Law also sets regimes for granting marketing authorisation and a departmental registry. | gmp |
| Data Exchange Agency, a legal entity under public law within the governance of the Ministry of Justice, under the Law of Georgia on Information Security, No 6391-Iს of 5 June 2012 Critical information system subjects and organisations that opt in | Article 4 obliges a critical information system subject to adopt internal rules for information security and says the minimum requirements, set by the Data Exchange Agency by criticality class, follow standards and requirements laid down by the International Organisation for Standardisation (ISO) and the Information Systems Audit and Control Association (ISACA). The Government lists the subjects by ordinance (Article 3(2)), and any other legal person may voluntarily assume the Law's obligations (Article 3(4)). The Law does not name a specific ISO standard. | |
| The competent state bodies under the Organic Law of Georgia on Occupational Safety, No 4283-IIს of 19 February 2019 Employers (occupational safety and health) | Article 5 sets employer obligations scaled to enterprise size and risk, Article 6 requires the employer to assess risks, update a risk assessment document and take preventive measures, and Article 7 requires one or more occupational safety specialists or an occupational safety service. The Law does not name ISO 45001. | |
| Legal entity under public law National Agency for Standards and Metrology of Georgia (standards role only) and the Georgian Accreditation Center, under the Product Safety and Free Movement Code, Law No 6157-Iს of 8 May 2012 Standards, technical regulations, conformity assessment and accreditation | The Code says the use of a standard is voluntary (Article 66), lists among the Agency's functions the registry of standards and representation of Georgia in international standardisation and metrology bodies (Article 72), and sets up the national accreditation system, in which accreditation is voluntary unless a legislative act makes it obligatory (Article 96). Technical regulations are the binding acts (Article 56). | |
| Parties to the Association Agreement between the EU, Euratom and their Member States, of the one part, and Georgia, of the other part (OJ L 261, 30.8.2014) Exporters of goods to the European Union | The Agreement's preamble commits the parties to economic integration through a Deep and Comprehensive Free Trade Area, and Chapter 3 of its trade title covers technical barriers to trade, standardisation, metrology, accreditation and conformity assessment. It is a trade framework and does not make any ISO standard compulsory. | |
| National Wine Agency, a legal entity under public law controlled by the Ministry of Environmental Protection and Agriculture, under the Law of Georgia on Vine and Wine, No 1438 of 12 June 1998 Winemakers and producers of alcoholic beverages | The Agency regulates activities in the viticulture and wine sector (Article 3¹), carries out state control over wines and alcoholic beverages with a protected appellation of origin or geographical indication, and supervises production, storage and sale of alcoholic beverages (Article 3²). Appellations are registered with Sakpatenti on a production specification that names a controlling body (Article 16). | |
| The competent environmental authority under the Environmental Assessment Code, Law of Georgia No 1770-Vმს-XIმპ of 24 June 2026 Businesses whose activities may significantly affect the environment | The Code regulates strategic environmental assessment and environmental impact assessment of public and private activities, and defines environmental audit as a comprehensive analysis of the technical, ecological and social indicators of an activity. Article 51 sets staged commencement of its provisions. It does not name ISO 14001. |
Accreditation and recognition
- Georgian Accreditation Center (GAC) — the Unified National Body of Accreditation: National accreditation body — a legal entity under public law within the system of the Ministry of Economy and Sustainable Development. The Product Safety and Free Movement Code (Articles 96–99) makes accreditation an expert assessment by GAC, voluntary unless a legislative act makes it obligatory, performed on a non-commercial basis.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law of Georgia on Public Procurement, No 2549-XIმს-Xმპ of 9 February 2023 (Contracting authorities, under the State Procurement Agency): Article 62 says that where a contracting authority requires examination of a supplier's quality system, it applies quality assurance systems that meet certification standards and are certified by accredited organisations, and it accepts a certificate issued by an organisation accredited under the law of the relevant country or other documents proving equivalent quality assurance. It allows environmental management capability to be shown by registration in EMAS, by a certificate from an accredited body certifying compliance with European or international environmental standards, or by an equivalent assessment. The Law does not make any certificate compulsory for every tender; each procurement states its own conditions.
Economic zones
- Free industrial zones under the Law of Georgia on Free Industrial Zones, No 5175 of 3 July 2007: manufacturing, processing of goods, services
Sterling in Georgia
Sterling delivers in Georgia from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Georgia clients ask
Is Georgia's personal data law in force, and who supervises it?
Yes. The Law on Personal Data Protection (No 3144-XIმს-Xმპ of 14 June 2023) is published on Matsne in a consolidated version listed as of 10 June 2026, and Article 90 sets commencement dates, 1 March 2024 for most articles. The consolidated text, as amended in December 2025, names the State Audit Office as the body that monitors the lawfulness of processing. Check the current institutional arrangements with the regulator or counsel.
Who accredits ISO certification bodies in Georgia, and is that recognised abroad?
The Georgian Accreditation Center (GAC) is the national accreditation body. Global ACI's member page lists it as a Full Member and signatory of its mutual recognition arrangement, with management system scopes that include ISO 9001, ISO 14001, ISO 22000, ISO/IEC 27001 and ISO 45001. Accreditation is voluntary unless a legislative act requires it, so ask your customer which accreditation it accepts.
Do Georgian public tenders require ISO 9001 or ISO 14001?
Not as a blanket rule, but the procurement law gives certificates a defined role. Article 62 says a contracting authority that examines a supplier's quality system accepts certificates from accredited organisations, and environmental capability can be shown by EMAS or an accredited certificate against European or international standards. Each tender states its own conditions, so read the documents and ask the contracting authority.
Is HACCP compulsory for food businesses in Georgia?
For most food businesses, yes. The Food Code requires food business operators to have food safety procedures based on HACCP principles, with records, but not for primary production, and the Government fixes by ordinance which types of production must introduce the system. The National Food Agency audits these procedures as part of state control. Confirm your category with the Agency or counsel.
Which sectors drive ISO and compliance demand in Georgia?
Food, drink and metals buyers stand out. Geostat's 2025 export table ranks motor cars first, then precious metal ores, ethyl alcohol, wine, ferro-alloys, mineral waters and hazelnuts, and medicaments also appear. Tourism adds hospitality demand, with 7,803,239 visits by international travellers in 2025 according to the Georgian National Tourism Administration. Your own customers decide which certificate they ask for.
In which language are ISO audits run in Georgia?
Agree the language with the certification body when you apply. Georgian laws are published in Georgian on Matsne, with English translations of many acts, so documents may exist in two languages. Decide early which language controlled documents, interviews and the audit report will use, and whether an interpreter is needed on shop-floor visits. Customer contracts may also set a language.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of Georgia on Personal Data Protection — matsne.gov.ge (accessed 18 Oct 2026)
- Article 17¹ requires food business operators to introduce food safety procedures in accordance with the principles of the Hazard Analysis and Critical Control Points (HACCP) system, keep records, and update the system when food or its production changes; the system is not required for primary production, and the Government fixes by ordinance the types of production for which it is introduced. The Code treats audit of HACCP-based procedures as a mechanism of state control. — matsne.gov.ge (accessed 18 Oct 2026)
- The National Bank's own pages say a commercial bank is a legal entity licensed by the National Bank and that the requirements for supervision and regulation of banks are set by the Organic Law on the National Bank of Georgia, the Law on the Activities of Commercial Banks and subordinate acts. The same site lists supervision of microbanks, non-bank institutions, payment service providers and capital markets. The Law on Payment Systems and Payment Services (No 6304-Iს of 25 May 2012) provides for payment service providers registered by the National Bank. — nbg.gov.ge; matsne.gov.ge (accessed 18 Oct 2026)
- Article 12 puts the manufacturing of a pharmaceutical product under a permit regime issued by the Agency and provides that Georgia selectively recognises a list of international, regional and national Good Manufacturing Practice standards, which the Government recognises. The Law also sets regimes for granting marketing authorisation and a departmental registry. — matsne.gov.ge (accessed 18 Oct 2026)
- Article 4 obliges a critical information system subject to adopt internal rules for information security and says the minimum requirements, set by the Data Exchange Agency by criticality class, follow standards and requirements laid down by the International Organisation for Standardisation (ISO) and the Information Systems Audit and Control Association (ISACA). The Government lists the subjects by ordinance (Article 3(2)), and any other legal person may voluntarily assume the Law's obligations (Article 3(4)). The Law does not name a specific ISO standard. — matsne.gov.ge (accessed 18 Oct 2026)
- Article 5 sets employer obligations scaled to enterprise size and risk, Article 6 requires the employer to assess risks, update a risk assessment document and take preventive measures, and Article 7 requires one or more occupational safety specialists or an occupational safety service. The Law does not name ISO 45001. — matsne.gov.ge (accessed 18 Oct 2026)
- The Code says the use of a standard is voluntary (Article 66), lists among the Agency's functions the registry of standards and representation of Georgia in international standardisation and metrology bodies (Article 72), and sets up the national accreditation system, in which accreditation is voluntary unless a legislative act makes it obligatory (Article 96). Technical regulations are the binding acts (Article 56). — matsne.gov.ge (accessed 18 Oct 2026)
- The Agreement's preamble commits the parties to economic integration through a Deep and Comprehensive Free Trade Area, and Chapter 3 of its trade title covers technical barriers to trade, standardisation, metrology, accreditation and conformity assessment. It is a trade framework and does not make any ISO standard compulsory. — eur-lex.europa.eu (accessed 18 Oct 2026)
- The Agency regulates activities in the viticulture and wine sector (Article 3¹), carries out state control over wines and alcoholic beverages with a protected appellation of origin or geographical indication, and supervises production, storage and sale of alcoholic beverages (Article 3²). Appellations are registered with Sakpatenti on a production specification that names a controlling body (Article 16). — matsne.gov.ge (accessed 18 Oct 2026)
- The Code regulates strategic environmental assessment and environmental impact assessment of public and private activities, and defines environmental audit as a comprehensive analysis of the technical, ecological and social indicators of an activity. Article 51 sets staged commencement of its provisions. It does not name ISO 14001. — matsne.gov.ge (accessed 18 Oct 2026)
- Georgian Accreditation Center (GAC) — the Unified National Body of Accreditation — global-aci.org; gac.gov.ge; matsne.gov.ge (accessed 18 Oct 2026)
- Public procurement under the Law of Georgia on Public Procurement, No 2549-XIმს-Xმპ of 9 February 2023 — matsne.gov.ge (accessed 18 Oct 2026)
- Free industrial zones under the Law of Georgia on Free Industrial Zones, No 5175 of 3 July 2007 — matsne.gov.ge (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice