Where we work · Lithuania
ISO and GRC certification consulting in Lithuania
Achieve ISO and GRC certification in Lithuania with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Lithuania
Clients include
ISO and GRC certification in Lithuania at a glance
Lithuanian demand for ISO and GRC certification comes from three directions: EU law, a fast-moving fintech and services economy, and manufacturers selling into European supply chains. The State Data Protection Inspectorate supervises the GDPR under the Law on Legal Protection of Personal Data, and the National Cyber Security Centre oversees the updated Law on Cyber Security, in force since 18 October 2024 and described by the Centre as carrying the NIS2 provisions into national law. The Bank of Lithuania supervises financial firms, including electronic money and payment institutions that now work under DORA. Invest Lithuania highlights fintech, life sciences, advanced manufacturing, business services and cleantech, and seven free economic zones offer industrial sites. Certificates come from certification bodies accredited by the National Accreditation Bureau, part of the Lithuanian Accreditation and Standardization Agency, never from Sterling. Sterling serves Lithuanian clients from its Frankfurt office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Lithuania
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Lithuania (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data Valstybinė duomenų apsaugos inspekcija (the State Data Protection Inspectorate) — the Law says it monitors the application of the Regulation and the Law, is independent in performing its supervisory tasks and has the powers of the supervisory authority set out in the Regulation; the Inspector of Journalist Ethics holds the tasks assigned to that office | The Law sets how personal data is processed, the status and powers of the Inspectorate, the powers of the Inspector of Journalist Ethics and the procedure for investigating infringements and imposing fines. The Inspectorate publishes its decisions, including fines and orders, on its website. | |
| Companion law on personal data processed by competent authorities for criminal-law purposes Valstybinė duomenų apsaugos inspekcija (the State Data Protection Inspectorate) | It governs processing by public authorities for the purposes described and so rarely concerns commercial organisations, except as suppliers to those authorities. | |
| Standard contractual clauses for the data processing agreement Valstybinė duomenų apsaugos inspekcija (the State Data Protection Inspectorate) | The Inspectorate publishes the approved clauses beside its legislation page. They give controllers and processors a regulator-issued starting point for processor contracts. | |
| Nacionalinis kibernetinio saugumo centras (the National Cyber Security Centre, NCSC) — it describes itself as the main Lithuanian cyber security institution, responsible for unified management of cyber incidents, monitoring and control of the implementation of cyber security requirements, and accreditation of information resources Essential and important entities under the updated cyber security law, together with public bodies that must meet its requirements | The updated Law on Cyber Security (Kibernetinio saugumo įstatymas). The NCSC's FAQ says the updated Law has been in force since 18 October 2024 and that it carries the provisions of the NIS2 Directive into national law. It distinguishes two groups, essential and important entities: essential entities face supervision before and after an incident, important entities after an incident only. Entities are entered in a register of cyber security entities, and the NCSC runs the Cyber Security Information System (KSIS). The FAQ refers to European and international standards generally and does not name ISO/IEC 27001. | |
| Lietuvos bankas (the Bank of Lithuania), which supervises financial market participants and licenses fintech firms such as electronic money and payment institutions Financial entities (banks, insurance undertakings, electronic money and payment institutions, investment firms and others in DORA's scope) | Regulation (EU) 2022/2554 (DORA). The Bank's DORA page says it entered into force on 16 January 2023 and applies from 17 January 2025, and lists ICT incident reporting and ICT third-party risk monitoring among its requirements. The page does not name ISO/IEC 27001 or any other ISO standard. | |
| Valstybinė maisto ir veterinarijos tarnyba (the State Food and Veterinary Service), whose site lists veterinary and food safety among its areas Food business operators after primary production | Regulation (EC) No 852/2004 on the hygiene of foodstuffs requires operators at stages after primary production to put in place, implement and maintain a permanent procedure or procedures based on HACCP principles, and to show the competent authority that they comply. It does not require a certificate; approval of certain establishments by the competent authority is a separate process. | HACCP, ISO 22000 |
| Valstybinė vaistų kontrolės tarnyba (the State Medicines Control Agency of Lithuania) Medicines manufacturers and distributors | The Agency's site lists licensing of pharmaceutical activity and supervision of manufacturing and distribution, with separate pages for good manufacturing practice and good distribution practice. Its pages do not name ISO 13485 or ISO 9001. | |
| EU framework; national competent authorities and notified bodies act as the Regulation provides Medical device manufacturers | Regulation (EU) 2017/745 (the Medical Devices Regulation). Its recitals say all manufacturers should have a quality management system and a post-market surveillance system in place, and refer to harmonised standards generally. The text does not name ISO 13485. | ISO 13485 |
| Lietuvos Respublikos valstybinė darbo inspekcija (the State Labour Inspectorate of the Republic of Lithuania), whose site has sections on occupational safety and health at work, rules for inspections and posting of workers Employers in all sectors (occupational health and safety) | Inspection and guidance on occupational safety and health. The Inspectorate's site does not make a management system standard compulsory and does not name ISO 45001. | |
| EU framework; the national supervisory arrangements are for the competent Lithuanian authorities to confirm Providers and deployers of AI systems | Regulation (EU) 2024/1689 (the Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme. |
Accreditation and recognition
- The National Accreditation Bureau (LA), part of the Lithuanian Accreditation and Standardization Agency (LASA): National accreditation body — LASA's own page says LA accredits testing, calibration and medical laboratories, product certification bodies, certification bodies for quality and environmental management systems, inspection bodies and persons.
- Lithuanian Accreditation and Standardization Agency (LASA) — standardisation section: Standards role only — LASA's site has a standardisation section with services, technical committees, a work programme, international relations and a read-only portal to adopted harmonised European standards.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Directive 2014/24/EU and the national Public Procurement Office's electronic system (Contracting authorities, with the Public Procurement Office (Viešųjų pirkimų tarnyba) running guidance and the central electronic system): Each contracting authority sets its own conditions. The Directive's recitals say that where a European standard is referred to, equivalent tenders must be considered and contracting authorities may require third-party verified evidence, and that environmental management schemes, whether or not registered under Union instruments, can show technical capability. The Public Procurement Office's site refers to a new public procurement system valid from 2024-12-01 and links to guidance on green public procurement and eco-labels.
Economic zones
- Lithuania's seven free economic zones: advanced manufacturing, business services, cleantech
- Fintech and financial services cluster: electronic money, payment services, financial technology
- Advanced manufacturing base: electronics, industrial machinery and components, automation and IoT equipment
- Life sciences, biotechnology and MedTech: biotechnology, medical technology, life sciences
Sterling in Lithuania
Sterling delivers in Lithuania from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Lithuania clients ask
Are certification audits in Lithuania conducted in Lithuanian or English?
The audit language is agreed with the certification body when you apply. Lithuanian is the official language, so say early whether auditors must read your records and controlled documents in Lithuanian, in English or in both. Follow any language rule set in a customer contract or by a regulator, because those override a preference.
Which authority supervises the GDPR in Lithuania?
The State Data Protection Inspectorate, Valstybinė duomenų apsaugos inspekcija. The Law on Legal Protection of Personal Data, recast in 2018, says it monitors the application of the Regulation and the Law and acts independently. It publishes decisions, including fines and orders. For a specific processing question, ask the Inspectorate or your counsel.
Is the Lithuanian NIS2 law in force?
Yes, according to the National Cyber Security Centre. Its FAQ says the updated Law on Cyber Security has been in force since 18 October 2024 and carries the NIS2 provisions into national law. It splits entities into essential and important groups and keeps a register of cyber security entities. Whether your organisation is covered is for the Centre or your counsel to confirm.
Which body accredits certification bodies in Lithuania?
The National Accreditation Bureau, known as LA, which sits within the Lithuanian Accreditation and Standardization Agency. LASA says LA accredits certification bodies for quality and environmental management systems, among others, and holds EA MLA signatory status. Accreditation is by scope, so ask your certification body for its certificate and check the standard is covered.
What does DORA mean for financial firms in Lithuania?
DORA applies from 17 January 2025 to banks, insurance undertakings, electronic money and payment institutions, investment firms and other financial entities, according to the Bank of Lithuania's page. It adds duties on ICT incident reporting and ICT third-party risk monitoring. The Bank supervises financial market participants. Confirm which duties reach your licence type with the Bank or your counsel.
Can Lithuanian public buyers ask for ISO certificates?
They can set evidence conditions, within the EU procurement rules. The Directive's recitals say equivalent tenders must be considered where a European standard is cited, that third-party verified evidence may be required, and that environmental management schemes can show technical capability. Each contracting authority writes its own conditions, so read the tender documents and take advice on a specific bid.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data — vdai.lrv.lt (accessed 18 Oct 2026)
- Companion law on personal data processed by competent authorities for criminal-law purposes — vdai.lrv.lt (accessed 18 Oct 2026)
- Standard contractual clauses for the data processing agreement — vdai.lrv.lt (accessed 18 Oct 2026)
- The updated Law on Cyber Security (Kibernetinio saugumo įstatymas). The NCSC's FAQ says the updated Law has been in force since 18 October 2024 and that it carries the provisions of the NIS2 Directive into national law. It distinguishes two groups, essential and important entities: essential entities face supervision before and after an incident, important entities after an incident only. Entities are entered in a register of cyber security entities, and the NCSC runs the Cyber Security Information System (KSIS). The FAQ refers to European and international standards generally and does not name ISO/IEC 27001. — nksc.lt; digital-strategy.ec.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA). The Bank's DORA page says it entered into force on 16 January 2023 and applies from 17 January 2025, and lists ICT incident reporting and ICT third-party risk monitoring among its requirements. The page does not name ISO/IEC 27001 or any other ISO standard. — lb.lt; investlithuania.com (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs requires operators at stages after primary production to put in place, implement and maintain a permanent procedure or procedures based on HACCP principles, and to show the competent authority that they comply. It does not require a certificate; approval of certain establishments by the competent authority is a separate process. — eur-lex.europa.eu; vmvt.lrv.lt (accessed 18 Oct 2026)
- The Agency's site lists licensing of pharmaceutical activity and supervision of manufacturing and distribution, with separate pages for good manufacturing practice and good distribution practice. Its pages do not name ISO 13485 or ISO 9001. — vvkt.lrv.lt (accessed 18 Oct 2026)
- Regulation (EU) 2017/745 (the Medical Devices Regulation). Its recitals say all manufacturers should have a quality management system and a post-market surveillance system in place, and refer to harmonised standards generally. The text does not name ISO 13485. — eur-lex.europa.eu (accessed 18 Oct 2026)
- Inspection and guidance on occupational safety and health. The Inspectorate's site does not make a management system standard compulsory and does not name ISO 45001. — vdi.lrv.lt (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (the Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme. — eur-lex.europa.eu (accessed 18 Oct 2026)
- The National Accreditation Bureau (LA), part of the Lithuanian Accreditation and Standardization Agency (LASA) — lasa.lrv.lt; european-accreditation.org (accessed 18 Oct 2026)
- Lithuanian Accreditation and Standardization Agency (LASA) — standardisation section — lasa.lrv.lt (accessed 18 Oct 2026)
- Public procurement under Directive 2014/24/EU and the national Public Procurement Office's electronic system — eur-lex.europa.eu; vpt.lrv.lt (accessed 18 Oct 2026)
- Lithuania's seven free economic zones — investlithuania.com (accessed 18 Oct 2026)
- Fintech and financial services cluster — investlithuania.com (accessed 18 Oct 2026)
- Advanced manufacturing base — investlithuania.com (accessed 18 Oct 2026)
- Life sciences, biotechnology and MedTech — investlithuania.com (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice