Where we work · Ireland
ISO and GRC certification consulting in Ireland
Achieve ISO and GRC certification in Ireland with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- London office team
- Effivity and Academy included
Sectors that ask for certification in Ireland
Clients include
ISO and GRC certification in Ireland at a glance
Ireland's compliance agenda is shaped by EU law applied through Irish institutions. The Data Protection Commission is the Irish supervisory authority for the GDPR under the Data Protection Act 2018, the Central Bank of Ireland supervises financial entities under DORA, and the HPRA oversees medical devices under the MDR. NIS2 is still on its way: the National Cyber Security Bill, which will transpose the directive, is listed in the Government's Autumn 2026 legislation programme for priority publication. Food businesses answer to the Food Safety Authority of Ireland on HACCP, employers to the Health and Safety Authority under the Safety, Health and Welfare at Work Act 2005, and larger energy users to SEAI. Public tenders under S.I. No. 284 of 2016 may ask for accredited quality or environmental certificates. Demand is strongest in technology, financial services, medtech, biopharma and food. Certificates come from certification bodies accredited by INAB, the Irish National Accreditation Board, not from Sterling. Sterling's London office supports Irish organisations on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Ireland
Each page covers who needs the standard in Ireland, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Ireland (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Data Protection Act 2018 Data Protection Commission (DPC) — section 11 of the Data Protection Act 2018 provides that the Commission is the supervisory authority within the meaning of the GDPR; the DPC describes itself as the Irish supervisory authority for the GDPR | The GDPR applies to controllers and processors established in the EU and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. The Data Protection Act 2018 establishes the Data Protection Commission and sets out its functions. The DPC also holds functions under the Irish ePrivacy Regulations (2011) and the Law Enforcement Directive. | |
| Central Bank of Ireland Financial entities — banks, insurers, investment firms and other regulated financial service providers | Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) and the Central Bank's Cross Industry Guidance on Operational Resilience (published December 2021, updated and republished July 2025 for alignment with DORA). The Central Bank states that it withdrew its September 2016 Cross Industry Guidance on Information Technology and Cybersecurity Risk Management because DORA now provides a harmonised minimum standard. Neither document names ISO/IEC 27001 or ISO 22301. | |
| National Cyber Security Centre (NCSC) as lead competent authority; the Central Bank of Ireland for financial entities and ComReg for digital infrastructure, as the Central Bank describes the allocation Essential and important entities under NIS2, and public administration | Directive (EU) 2022/2555 (NIS 2 Directive), to be transposed by the National Cyber Security Bill. The Government Legislation Programme Autumn 2026 lists the Bill under legislation for priority publication, Department of Justice, Home Affairs and Migration, with the status 'Work is ongoing', and states that it will transpose the directive and put the NCSC on a statutory basis. The Central Bank's DORA FAQ (page last updated 12 February 2026) speaks of the national transposition as still to be completed. The draft National Cyber Security Strategy states that the NCSC will be the competent authority for public administration entities and the majority of important entities in Annex II of the directive. The NCSC states that the NIS2 registration and incident reporting portals will open once the legislation is implemented. | |
| Health Products Regulatory Authority (HPRA) Medical device manufacturers, authorised representatives, importers and distributors | Regulation (EU) 2017/745 on medical devices (MDR), Regulation (EU) 2017/746 (IVDR) and the Medical Devices Regulations 2021 (S.I. No. 261 of 2021) with the Medical Devices (Registration) Regulations 2021 (S.I. No. 691 of 2021). The HPRA publishes MDR and IVDR guidance, registers Irish-based manufacturers and authorised representatives through Eudamed, inspects, and states that manufacturers need a quality management system in accordance with Article 10(9) of the MDR. The HPRA pages do not name ISO 13485. | |
| Food Safety Authority of Ireland (FSAI) Food businesses — preparation, processing, manufacturing, packaging, storage, transport, distribution and retail | Regulation (EC) No 852/2004 on the hygiene of foodstuffs. The FSAI states that since 1998 it has been a legal requirement for all food businesses to have a food safety management system based on the principles of HACCP, with flexibility where prerequisite programmes are sufficient for low-risk activities. | HACCP |
| Health and Safety Authority (HSA) All employers | Safety, Health and Welfare at Work Act 2005 — section 19 requires every employer to identify hazards, assess risks and hold a written risk assessment; section 20 requires a written safety statement based on it. The Act does not name ISO 45001. | |
| Sustainable Energy Authority of Ireland (SEAI) Large companies and public bodies above the thresholds on the SEAI page | Energy Auditing Compliance Scheme under S.I. 426 of 2014 as amended by S.I. 646 of 2016 and S.I. 599 of 2019. SEAI monitors compliance. An organisation with a valid certified energy or environmental management system (ISO 50001, ISO 14001 or equivalent) can ask a Registered Energy Auditor to confirm in writing that the system meets the audit requirement; certification does not exempt the organisation from the scheme. | ISO 50001, ISO 14001 |
| Oifig IS na hÉireann (established by the Regulation of Artificial Intelligence Act 2026) together with the market surveillance authorities the Act provides for Providers and deployers of artificial intelligence systems | Regulation of Artificial Intelligence Act 2026 (Number 31 of 2026, enacted 21 July 2026), which gives further effect to Regulation (EU) 2024/1689 (Artificial Intelligence Act). ISO/IEC 42001 is not cited. | |
| Criminal law, enforced through the courts Companies exposed to bribery and corruption offences | Criminal Justice (Corruption Offences) Act 2018 (Number 9 of 2018) — section 18 makes a body corporate guilty where listed persons commit an offence to obtain or retain business or an advantage, and gives it a defence if it took all reasonable steps and exercised all due diligence to avoid the offence. The Act does not name ISO 37001. | |
| Protected Disclosures Commissioner and the courts Employers with workers who may report wrongdoing | Protected Disclosures (Amendment) Act 2022 (Number 27 of 2022) — section 9 inserts section 6A into the Protected Disclosures Act, setting out what internal reporting channels and procedures must include: secure channels, written acknowledgement, an impartial designated person and diligent follow-up. ISO 37301 is not cited. | |
| National Cyber Security Centre (NCSC), with the Irish National Accreditation Board (INAB) Organisations in scope of the forthcoming national cyber certification scheme | The NCSC describes a forthcoming Irish Cyber Security Measures Certification scheme that will include NIS2-aligned measures and a level for SMEs, and its Cyber Fundamentals (CyFun) framework with three levels of maturity — Basic, Important and Essential. The draft National Cyber Security Strategy states that the NCSC, through the Department of Justice, Home Affairs and Migration and with INAB, will implement a cyber security certification scheme. ISO/IEC 27001 is not named in these passages. | |
| Irish Aviation Authority (IAA) Aircraft maintenance organisations | The IAA publishes the directory of Part 145 approved maintenance organisations in Ireland, with approval numbers and ratings. The page does not name AS9100 or any other quality management standard. | |
| Environmental Protection Agency (EPA) Facilities carrying on specified industrial and agricultural activities | Integrated Pollution Control (IPC) licensing under the EPA Act 1992 — the EPA states that an IPC licence is a single integrated licence covering all emissions from a facility and its environmental management, that the licensable activities are listed in the First Schedule to the Act, and that it is an offence to carry on a licensable activity without a licence. The page does not name ISO 14001. |
Accreditation and recognition
- Irish National Accreditation Board (INAB): National accreditation body — the national body with responsibility for the accreditation of laboratories, certification bodies and inspection bodies; accredits management systems certification bodies to ISO/IEC 17021-1 and testing and calibration laboratories to EN ISO/IEC 17025:2017.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- European Union (Award of Public Authority Contracts) Regulations 2016 (S.I. No. 284 of 2016) — regulation 62, quality assurance and environmental management standards (Irish legislature (contracting authorities apply it)): Where a contracting authority requires certificates from independent bodies on quality assurance standards, it must refer to quality assurance systems based on the relevant European standards series certified by accredited bodies, recognise equivalent certificates from bodies in other Member States and accept other evidence of equivalent measures where the operator could not obtain a certificate in time for reasons not its own. For environmental management it must refer to EMAS, to other systems recognised under the EMAS Regulation, or to other environmental management standards based on European or international standards certified by accredited bodies.
- S.I. No. 284 of 2016 — regulation 57, exclusion grounds (Irish legislature (contracting authorities apply it)): A contracting authority excludes an economic operator that it knows has been convicted of listed offences, which include corruption as the regulation defines it; the regulation does not mention ISO 37001 or any certificate.
Economic zones
- International Financial Services Centre (IFSC), Dublin: international financial services, asset management and funds
- Mid-West region (Limerick and Shannon): medical technology, semiconductors, engineering, financial services
- Southwest region (Cork): pharmaceuticals and life sciences, medical technology, technology and cybersecurity, financial services
Sterling in Ireland
Sterling delivers in Ireland from its London office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Ireland, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Irish clients ask
Are certification audits in Ireland conducted in English?
Usually yes, since English is how business is done in Ireland, but the language is agreed with the certification body rather than fixed. State your preference for the audit and for controlled documents when you apply, and honour any language clause in a tender or contract. The Constitution names Irish as the first official language and recognises English as the second.
Which accreditation should a certification body hold for Ireland?
Look for accreditation from INAB, the Irish National Accreditation Board, which accredits management systems certification bodies to ISO/IEC 17021-1. INAB signs the EA and Global ACI multilateral agreements, so an accreditation body within those arrangements is also recognised. Recognition is not blanket: confirm that the certification body's scope covers your standard and sector.
Is Ireland's NIS2 law in force?
Not yet. The National Cyber Security Bill, which will transpose the NIS2 Directive and place the National Cyber Security Centre on a statutory footing, appears in the Government's Autumn 2026 legislation programme under bills for priority publication, with the status 'Work is ongoing'. Confirm the current stage with your counsel or the NCSC before relying on any date.
Which body supervises the GDPR in Ireland?
The Data Protection Commission. Section 11 of the Data Protection Act 2018 makes the Commission the supervisory authority for the GDPR, and the DPC itself describes its role as the Irish supervisory authority. Irish organisations deal with it on complaints, breach reports and inquiries into how personal data is handled.
Do Irish public tenders require ISO certificates?
Only where the contracting authority chooses to ask for them. Under regulation 62 of S.I. No. 284 of 2016, an authority that wants independent certificates on quality or environmental management must refer to systems certified by accredited bodies and accept equivalent certificates from other Member States. Each tender sets its own requirements, so read the documents for the competition.
Can Sterling support organisations in Ireland?
Yes. Irish organisations are served from Sterling's London office, on-site where the work needs it and remotely otherwise, with Effivity software and Sterling Academy training included in the engagement. Sterling prepares the organisation; certificates are issued by accredited certification bodies and attestation reports by licensed CPA firms.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Data Protection Act 2018 — eur-lex.europa.eu; irishstatutebook.ie; dataprotection.ie (accessed 7 Oct 2026)
- Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) and the Central Bank's Cross Industry Guidance on Operational Resilience (published December 2021, updated and republished July 2025 for alignment with DORA). The Central Bank states that it withdrew its September 2016 Cross Industry Guidance on Information Technology and Cybersecurity Risk Management because DORA now provides a harmonised minimum standard. Neither document names ISO/IEC 27001 or ISO 22301. — centralbank.ie (accessed 7 Oct 2026)
- Directive (EU) 2022/2555 (NIS 2 Directive), to be transposed by the National Cyber Security Bill. The Government Legislation Programme Autumn 2026 lists the Bill under legislation for priority publication, Department of Justice, Home Affairs and Migration, with the status 'Work is ongoing', and states that it will transpose the directive and put the NCSC on a statutory basis. The Central Bank's DORA FAQ (page last updated 12 February 2026) speaks of the national transposition as still to be completed. The draft National Cyber Security Strategy states that the NCSC will be the competent authority for public administration entities and the majority of important entities in Annex II of the directive. The NCSC states that the NIS2 registration and incident reporting portals will open once the legislation is implemented. — eur-lex.europa.eu; assets.gov.ie; ncsc.gov.ie; centralbank.ie (accessed 7 Oct 2026)
- Regulation (EU) 2017/745 on medical devices (MDR), Regulation (EU) 2017/746 (IVDR) and the Medical Devices Regulations 2021 (S.I. No. 261 of 2021) with the Medical Devices (Registration) Regulations 2021 (S.I. No. 691 of 2021). The HPRA publishes MDR and IVDR guidance, registers Irish-based manufacturers and authorised representatives through Eudamed, inspects, and states that manufacturers need a quality management system in accordance with Article 10(9) of the MDR. The HPRA pages do not name ISO 13485. — hpra.ie (accessed 7 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs. The FSAI states that since 1998 it has been a legal requirement for all food businesses to have a food safety management system based on the principles of HACCP, with flexibility where prerequisite programmes are sufficient for low-risk activities. — fsai.ie (accessed 7 Oct 2026)
- Safety, Health and Welfare at Work Act 2005 — hsa.ie; irishstatutebook.ie (accessed 7 Oct 2026)
- Energy Auditing Compliance Scheme under S.I. 426 of 2014 as amended by S.I. 646 of 2016 and S.I. 599 of 2019. SEAI monitors compliance. An organisation with a valid certified energy or environmental management system (ISO 50001, ISO 14001 or equivalent) can ask a Registered Energy Auditor to confirm in writing that the system meets the audit requirement; certification does not exempt the organisation from the scheme. — seai.ie (accessed 7 Oct 2026)
- Regulation of Artificial Intelligence Act 2026 (Number 31 of 2026, enacted 21 July 2026), which gives further effect to Regulation (EU) 2024/1689 (Artificial Intelligence Act). ISO/IEC 42001 is not cited. — irishstatutebook.ie; assets.gov.ie (accessed 7 Oct 2026)
- Criminal Justice (Corruption Offences) Act 2018 (Number 9 of 2018) — irishstatutebook.ie (accessed 7 Oct 2026)
- Protected Disclosures (Amendment) Act 2022 (Number 27 of 2022) — irishstatutebook.ie (accessed 7 Oct 2026)
- The NCSC describes a forthcoming Irish Cyber Security Measures Certification scheme that will include NIS2-aligned measures and a level for SMEs, and its Cyber Fundamentals (CyFun) framework with three levels of maturity — ncsc.gov.ie; assets.gov.ie (accessed 7 Oct 2026)
- The IAA publishes the directory of Part 145 approved maintenance organisations in Ireland, with approval numbers and ratings. The page does not name AS9100 or any other quality management standard. — iaa.ie (accessed 7 Oct 2026)
- Integrated Pollution Control (IPC) licensing under the EPA Act 1992 — epa.ie (accessed 7 Oct 2026)
- Irish National Accreditation Board (INAB) — inab.ie (accessed 7 Oct 2026)
- European Union (Award of Public Authority Contracts) Regulations 2016 (S.I. No. 284 of 2016) — regulation 62, quality assurance and environmental management standards — irishstatutebook.ie (accessed 7 Oct 2026)
- S.I. No. 284 of 2016 — regulation 57, exclusion grounds — irishstatutebook.ie (accessed 7 Oct 2026)
- International Financial Services Centre (IFSC), Dublin — ifsc.ie (accessed 7 Oct 2026)
- Mid-West region (Limerick and Shannon) — idaireland.com (accessed 7 Oct 2026)
- Southwest region (Cork) — idaireland.com (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the London team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uk@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice