Where we work · Italy
ISO and GRC certification consulting in Italy
Achieve ISO and GRC certification in Italy with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Italy
Clients include
ISO and GRC certification in Italy at a glance
Proof of control is built into Italian procurement and regulation. The Codice dei contratti pubblici reduces tender guarantees for operators holding accredited quality-system certification, public-works contractors need an SOA attestation that relies on such a certificate, and the ACN's cloud rules for public administrations ask private suppliers for ISO/IEC 27001 or CSA STAR certification. Data protection sits with the Garante per la protezione dei dati personali under the GDPR and the Codice in materia di protezione dei dati personali, the Agenzia per la cybersicurezza nazionale supervises NIS2 duties under Legislative Decree 138/2024, and the Banca d'Italia oversees DORA for financial intermediaries. Demand is strongest among manufacturing and engineering firms, automotive and aerospace suppliers, IT and cloud providers, banks and fintech, construction contractors, food producers, medical device makers and energy users. Certificates come from certification bodies accredited by Accredia, Italy's national accreditation body; Sterling does not certify. Clients in Italy are served from Sterling's Frankfurt office, which draws on 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Italy
Each page covers who needs the standard in Italy, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Italy (17)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| EU General Data Protection Regulation (GDPR) Garante per la protezione dei dati personali | Directly applicable EU regulation. The Garante describes itself as an independent administrative authority and states that it is the supervisory authority responsible for monitoring application of the GDPR (Article 51 of the Regulation); the Codice in materia di protezione dei dati personali (art. 2-bis) identifies the Garante as that authority. | |
| Codice in materia di protezione dei dati personali Garante per la protezione dei dati personali | Italy's national law adapting the legal system to the GDPR. Art. 1 provides that processing follows the Regulation and the Code; art. 2-quinquies sets the rule on a minor's consent to information society services and requires clear, simple information for minors; art. 2-sexies covers special categories of data processed for substantial public interest; art. 153 constitutes the Garante, whose Collegio has four members elected by the Chamber of Deputies and the Senate. | |
| GDPR certification and accreditation (voluntary) Garante per la protezione dei dati personali and Accredia | The Garante states that the GDPR establishes certification mechanisms and that certification bodies are accredited by the supervisory authority, the national accreditation body or both; where the national accreditation body accredits to ISO/IEC 17065, the supervisory authority's additional requirements also apply. Accredia lists ISDP 10003 as a voluntary, proprietary scheme accredited by Accredia to determine conformity with the GDPR, issued by product-certification bodies accredited under ISO/IEC 17065. | |
| Agenzia per la cybersicurezza nazionale (ACN) Essential and important entities under NIS2 (18 sectors) | Decreto legislativo 4 settembre 2024, n. 138 transposing Directive (EU) 2022/2555 (GU n. 230 of 1 October 2024; in force 16 October 2024). ACN is the competent national NIS Authority and single point of contact; nine ministries act as sectoral authorities. ACN states that the decree identifies ten areas for security measures, a fuller incident-reporting process and accountability for top management, and that entities in scope register or update their registration on ACN's platform. ACN has adopted basic specifications by Decision No. 379907/2025. No certification standard is named on ACN's legislation page. | |
| Banca d'Italia Financial entities (banks, investment firms, payment and e-money institutions and others) and their ICT third-party providers | Digital Operational Resilience Act, Regulation (EU) 2022/2554 — in force 16 January 2023, applicable from 17 January 2025. The Banca d'Italia communication covers ICT risk management, incident reporting, resilience testing, third-party ICT risk and information sharing. It names no certification standard. | |
| Agenzia per la cybersicurezza nazionale (ACN) Cloud service providers to public administrations | ACN Unified Regulation for digital infrastructures and cloud services for the Public Administration, adopted by Directorate Decree n. 21007/24 of 27 June 2024 and applicable from 1 August 2024. Annex 4 asks private suppliers seeking the lowest qualification level for a self-declaration of ISO 9001 conformity and ISO/IEC 27001 certification with ISO/IEC 27017 and ISO/IEC 27018 extensions (alternatively CSA STAR Level 2), issued by a body accredited by an EU national accreditation body or one with a mutual recognition arrangement with Accredia. Annex 3 refers to ISO 9001 and ISO/IEC 20000-1 for quality and IT service management and, for data-centre energy and environmental management, to ISO 14064, ISO 50001 and ISO 14001 or equivalents. | ISO/IEC 27001, ISO 9001, ISO/IEC 20000-1, ISO 14001, ISO 50001, csa-star |
| Agenzia per la cybersicurezza nazionale (ACN) Operators in the national cybersecurity perimeter (government, interior, defence, space and aerospace, energy, telecommunications, economy and finance, transport, digital services, critical technologies, social security and labour) | Decree-law n. 105/2019, converted with amendments by Law n. 133/2019 (GU n. 272 of 20 November 2019), establishing the Perimetro di Sicurezza Nazionale Cibernetica; entities are identified by an administrative act of the President of the Council of Ministers and informed by ACN. No certification standard is named in ACN's FAQ. | |
| AgID (Agenzia per l'Italia digitale) and ACN Providers and deployers of artificial intelligence | Law 23 September 2025, n. 132, Disposizioni e deleghe al Governo in materia di intelligenza artificiale (GU n. 223 of 25 September 2025). Art. 20 designates AgID and ACN as the national artificial intelligence authorities: AgID as notifying authority under Regulation (EU) 2024/1689 and ACN as market surveillance authority, with the Banca d'Italia, CONSOB and IVASS keeping the market surveillance role for financial uses and the Garante's powers unaffected. | |
| Ministero della giustizia (approves associations' codes of conduct) Legal entities seeking an effective organisation and management model against criminal liability | Decreto legislativo 8 giugno 2001, n. 231 on the administrative liability of legal entities; art. 6 lets models be adopted on the basis of codes of conduct drawn up by representative associations and communicated to the Ministry of Justice. The Ministry published guiding criteria for such codes, with specific attention to international corruption. Accredia notes that attestation of a model under d.lgs. 231/2001 cannot be issued under accreditation. | ISO 37001, ISO 37301 |
| Ministero del lavoro e delle politiche sociali (Testo Unico) and INAIL Employers and workplace health and safety management | Decreto legislativo 9 aprile 2008, n. 81, art. 30: a model of organisation and management able to have an exempting effect from the liability of legal entities under d.lgs. 231/2001 must cover the listed legal duties; models defined in line with the UNI-INAIL guidelines (2001) or BS OHSAS 18001:2007 are presumed to conform for the corresponding parts. INAIL describes the occupational health and safety management system (SGSL) as able to have exempting effect and lists the UNI-INAIL guidelines and OHSAS 18001 as reference frameworks. | ISO 45001 |
| ENEA (with the Ministry of Environment and Energy Security) Large enterprises and energy-intensive businesses (energy audits and energy management) | Decreto legislativo 4 luglio 2014, n. 102, art. 8 on energy audits. ENEA publishes guidelines and operating instructions for the audit obligation, a system matrix for organisations whose energy management system is certified to ISO 50001, and, under art. 7(8), takes communication of energy savings reported by enterprises operating an ISO 50001 system. | ISO 50001 |
| Competent official food control authorities Food business operators | Regulation (EC) No 852/2004 on the hygiene of foodstuffs, art. 5: food business operators put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. The Regulation does not make a certificate mandatory. | HACCP |
| Ministero della Salute (Direzione generale dei dispositivi medici) Medical device manufacturers and the bodies that assess them | Decreto legislativo 5 agosto 2022, n. 137, adapting national law to Regulation (EU) 2017/745 on medical devices; the Ministry of Health publishes information on notified bodies and device vigilance. | ISO 13485 |
| IATF Oversight Office for Italy, run by ANFIA (Torino) Automotive suppliers | IATF 16949 is overseen through IATF's Oversight Offices, which are located in five countries including Italy; IATF also publishes an Italian IATF Auditor Guide for IATF 16949. | IATF 16949 |
| IAQG (scheme owner of the 9100 series and the OASIS database) Aerospace and defence suppliers | OASIS is the online resource listing suppliers certified or registered under IAQG rules against the 9100-series quality management system requirements; it records the accreditation bodies, certification bodies and authenticated aerospace auditors involved. | AS9100 |
| Comitato per l'Ecolabel e l'Ecoaudit (EMAS Committee) Organisations pursuing EMAS registration | EMAS is governed by Regulation (EC) No 1221/2009; registration rests on independent control at two levels: an accredited environmental verifier and, in Italy, the Committee for Ecolabel and Ecoaudit. | ISO 14001 |
| Accredia (Dipartimenti Laboratori di prova and Laboratori di taratura) Testing and calibration laboratories | Laboratories are accredited against ISO/IEC 17025 by Accredia; Accredia's international-role page lists the European and international mutual recognition arrangements it covers for testing and calibration. A ministerial decree of 13 June 2017 (n. 282), as reported in Accredia's tender guide, requires speed-measurement equipment to be calibrated by laboratories operating to ISO/IEC 17025 and accredited by Accredia or a signatory body. | ISO/IEC 17025 |
Accreditation and recognition
- Accredia — Ente Italiano di Accreditamento: National accreditation body (Ente Unico), designated by the Italian Government under Regulation (EC) No 765/2008; operates under the supervision of the Ministry of Enterprises and Made in Italy, the national accreditation authority; accredits management-system certification bodies (ISO/IEC 17021-1) and testing and calibration laboratories (ISO/IEC 17025).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Codice dei contratti pubblici — Decreto legislativo 31 marzo 2023, n. 36, art. 106 (guarantees for participation) and Allegato II.13 (Italian State (applied by all contracting authorities)): The tender guarantee is reduced for operators holding quality-system certification issued by accredited bodies; further reductions apply for SMEs and for certifications or marks that the contracting authority selects, within a stated ceiling, from those listed in Allegato II.13 and names in the tender documents. The operator declares the certification when bidding and documents it. Accredia notes that its database covers only certificates issued under accreditation.
- Codice dei contratti pubblici, art. 100 and Allegato II.12 — qualification of public-works contractors (SOA) (Italian State (SOA qualification bodies issue the attestation)): Contractors for public works above the value set in the Codice obtain a qualification attestation from an SOA. Allegato II.12 requires, for qualification in the higher classes, a company quality system certified by accredited bodies (read by Accredia as ISO 9001); the SOA checks the certificate against the official lists. Accredia reports ANAC's position that, for services and supplies, a contracting authority cannot make quality certification a mandatory selection requirement.
- Codice dei contratti pubblici, art. 57(2) — Criteri Ambientali Minimi (CAM) (Ministry of the Environment and Energy Security (adopts the CAM decrees)): Contracting authorities include in design and tender documents at least the technical specifications and contract clauses of the CAM decrees. Accredia notes that accredited conformity assessments are often cited in award criteria, specifications and clauses to prove sound environmental practice.
- Codice dei contratti pubblici, art. 108 — award criteria (Italian State (applied by contracting authorities)): Art. 108 no longer lists example quality criteria, but accredited certifications can still be used in technical scoring under best price-quality awards. It names gender-equality certification as a rewarding element and requires contracting authorities buying IT goods and services always to consider cybersecurity elements.
Economic zones
- ZES unica per il Mezzogiorno:
Sterling in Italy
Sterling delivers in Italy from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Italy, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Italian clients ask
Are certification audits in Italy conducted in Italian or English?
Either can be used. Italian is the official language, while English is common in international groups and technology firms, so settle the audit language and the language of controlled documents with the certification body when you apply. If a tender, regulator filing or customer contract asks for Italian, that requirement takes precedence over your own preference.
Which accreditation should our certification body hold in Italy?
Look for Accredia, Italy's single national accreditation body, designated by the Government under Regulation (EC) No 765/2008 and supervised by the Ministry of Enterprises and Made in Italy. Accredia states that it is a signatory of the European and international mutual recognition agreements, which is what gives its mark recognition abroad. Ask to see the accredited scope in writing before you commit.
Do Italian public tenders require ISO certificates?
Not as a blanket rule. Accredited quality-system certification reduces the guarantee for tender participation under the Codice dei contratti pubblici, and public-works contractors rely on it for SOA qualification. For services and supplies, ANAC's position, as Accredia reports it, is that a contracting authority cannot make quality certification a mandatory selection requirement. Read each tender and confirm with counsel.
Which authority supervises data protection in Italy?
The Garante per la protezione dei dati personali, an independent administrative authority, is Italy's supervisory authority under the GDPR. The Codice in materia di protezione dei dati personali, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, identifies it as such and supplements the Regulation nationally. Ask your counsel or the Garante how the rules apply to your processing.
Is the NIS2 Directive in force in Italy?
Yes. Italy transposed Directive (EU) 2022/2555 through Legislative Decree 138/2024, published in the Gazzetta Ufficiale on 1 October 2024 and in force from 16 October 2024. The Agenzia per la cybersicurezza nazionale is the competent national NIS Authority. Whether your own organisation is in scope is something to confirm with counsel or the ACN.
Is there a GDPR certificate in Italy?
Yes, but only as a voluntary option. The GDPR provides for certification mechanisms, and Accredia lists the ISDP 10003 scheme as one accredited by Accredia to assess conformity with the Regulation, issued by product-certification bodies accredited under ISO/IEC 17065. Nobody must obtain it, so ask counsel what weight a certificate would carry with the Garante for your processing.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- EU General Data Protection Regulation (GDPR) — garanteprivacy.it (accessed 7 Oct 2026)
- Codice in materia di protezione dei dati personali — normattiva.it; garanteprivacy.it (accessed 7 Oct 2026)
- GDPR certification and accreditation (voluntary) — garanteprivacy.it; accredia.it (accessed 7 Oct 2026)
- Decreto legislativo 4 settembre 2024, n. 138 transposing Directive (EU) 2022/2555 (GU n. 230 of 1 October 2024; in force 16 October 2024). ACN is the competent national NIS Authority and single point of contact; nine ministries act as sectoral authorities. ACN states that the decree identifies ten areas for security measures, a fuller incident-reporting process and accountability for top management, and that entities in scope register or update their registration on ACN's platform. ACN has adopted basic specifications by Decision No. 379907/2025. No certification standard is named on ACN's legislation page. — gazzettaufficiale.it (accessed 7 Oct 2026)
- Digital Operational Resilience Act, Regulation (EU) 2022/2554 — bancaditalia.it (accessed 7 Oct 2026)
- ACN Unified Regulation for digital infrastructures and cloud services for the Public Administration, adopted by Directorate Decree n. 21007/24 of 27 June 2024 and applicable from 1 August 2024. Annex 4 asks private suppliers seeking the lowest qualification level for a self-declaration of ISO 9001 conformity and ISO/IEC 27001 certification with ISO/IEC 27017 and ISO/IEC 27018 extensions (alternatively CSA STAR Level 2), issued by a body accredited by an EU national accreditation body or one with a mutual recognition arrangement with Accredia. Annex 3 refers to ISO 9001 and ISO/IEC 20000-1 for quality and IT service management and, for data-centre energy and environmental management, to ISO 14064, ISO 50001 and ISO 14001 or equivalents. — acn.gov.it (accessed 7 Oct 2026)
- Decree-law n. 105/2019, converted with amendments by Law n. 133/2019 (GU n. 272 of 20 November 2019), establishing the Perimetro di Sicurezza Nazionale Cibernetica; entities are identified by an administrative act of the President of the Council of Ministers and informed by ACN. No certification standard is named in ACN's FAQ. — acn.gov.it (accessed 7 Oct 2026)
- Law 23 September 2025, n. 132, Disposizioni e deleghe al Governo in materia di intelligenza artificiale (GU n. 223 of 25 September 2025). Art. 20 designates AgID and ACN as the national artificial intelligence authorities: AgID as notifying authority under Regulation (EU) 2024/1689 and ACN as market surveillance authority, with the Banca d'Italia, CONSOB and IVASS keeping the market surveillance role for financial uses and the Garante's powers unaffected. — gazzettaufficiale.it (accessed 7 Oct 2026)
- Decreto legislativo 8 giugno 2001, n. 231 on the administrative liability of legal entities; art. 6 lets models be adopted on the basis of codes of conduct drawn up by representative associations and communicated to the Ministry of Justice. The Ministry published guiding criteria for such codes, with specific attention to international corruption. Accredia notes that attestation of a model under d.lgs. 231/2001 cannot be issued under accreditation. — giustizia.it (accessed 7 Oct 2026)
- Decreto legislativo 9 aprile 2008, n. 81, art. 30: a model of organisation and management able to have an exempting effect from the liability of legal entities under d.lgs. 231/2001 must cover the listed legal duties; models defined in line with the UNI-INAIL guidelines (2001) or BS OHSAS 18001:2007 are presumed to conform for the corresponding parts. INAIL describes the occupational health and safety management system (SGSL) as able to have exempting effect and lists the UNI-INAIL guidelines and OHSAS 18001 as reference frameworks. — lavoro.gov.it (accessed 7 Oct 2026)
- Decreto legislativo 4 luglio 2014, n. 102, art. 8 on energy audits. ENEA publishes guidelines and operating instructions for the audit obligation, a system matrix for organisations whose energy management system is certified to ISO 50001, and, under art. 7(8), takes communication of energy savings reported by enterprises operating an ISO 50001 system. — efficienzaenergetica.enea.it (accessed 7 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, art. 5: food business operators put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. The Regulation does not make a certificate mandatory. — eur-lex.europa.eu (accessed 7 Oct 2026)
- Decreto legislativo 5 agosto 2022, n. 137, adapting national law to Regulation (EU) 2017/745 on medical devices; the Ministry of Health publishes information on notified bodies and device vigilance. — gazzettaufficiale.it (accessed 7 Oct 2026)
- IATF 16949 is overseen through IATF's Oversight Offices, which are located in five countries including Italy; IATF also publishes an Italian IATF Auditor Guide for IATF 16949. — iatfglobaloversight.org (accessed 7 Oct 2026)
- OASIS is the online resource listing suppliers certified or registered under IAQG rules against the 9100-series quality management system requirements; it records the accreditation bodies, certification bodies and authenticated aerospace auditors involved. — iaqg.org (accessed 7 Oct 2026)
- EMAS is governed by Regulation (EC) No 1221/2009; registration rests on independent control at two levels: an accredited environmental verifier and, in Italy, the Committee for Ecolabel and Ecoaudit. — mase.gov.it (accessed 7 Oct 2026)
- Laboratories are accredited against ISO/IEC 17025 by Accredia; Accredia's international-role page lists the European and international mutual recognition arrangements it covers for testing and calibration. A ministerial decree of 13 June 2017 (n. 282), as reported in Accredia's tender guide, requires speed-measurement equipment to be calibrated by laboratories operating to ISO/IEC 17025 and accredited by Accredia or a signatory body. — accredia.it (accessed 7 Oct 2026)
- Accredia — Ente Italiano di Accreditamento — accredia.it (accessed 7 Oct 2026)
- Codice dei contratti pubblici — Decreto legislativo 31 marzo 2023, n. 36, art. 106 (guarantees for participation) and Allegato II.13 — gazzettaufficiale.it; accredia.it (accessed 7 Oct 2026)
- Codice dei contratti pubblici, art. 100 and Allegato II.12 — qualification of public-works contractors (SOA) — accredia.it (accessed 7 Oct 2026)
- Codice dei contratti pubblici, art. 57(2) — Criteri Ambientali Minimi (CAM) — accredia.it (accessed 7 Oct 2026)
- Codice dei contratti pubblici, art. 108 — award criteria — accredia.it (accessed 7 Oct 2026)
- ZES unica per il Mezzogiorno — politichecoesione.governo.it (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice