Where we work · Luxembourg
ISO and GRC certification consulting in Luxembourg
Achieve ISO and GRC certification in Luxembourg with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Luxembourg
Clients include
ISO and GRC certification in Luxembourg at a glance
Luxembourg's demand for certification and compliance work comes from a small number of supervisors with real reach. The Commission nationale pour la protection des données supervises the GDPR under the Act of 1 August 2018. The Institut luxembourgeois de régulation enforces the NIS2 law of 5 May 2026, in force since 10 May 2026, across energy, transport, health, digital infrastructure, ICT service management and other sectors, while the CSSF and the Commissariat aux Assurances apply DORA to banks, investment firms, payment institutions and insurers. Medical device manufacturers register with the Direction de la santé, and food businesses work from a validated HACCP guide under Regulation (EC) No 852/2004. Certificates come from certification bodies accredited by OLAS or by a body within the international arrangements, never from Sterling. Financial services, cloud and managed services, health technologies, space and trust services generate most enquiries. Sterling serves Luxembourg clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Luxembourg
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Luxembourg (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Luxembourg Act of 1 August 2018 on the organisation of the CNPD Commission nationale pour la protection des données (CNPD, the National Commission for Data Protection) — an independent public institution with legal personality, financially and administratively autonomous, which verifies the legality of personal data processing | The CNPD says the Act of 1 August 2018 repeals the earlier data protection act (the amended Act of 2 August 2002) and completes the GDPR at national level. The CNPD checks processing against the GDPR, that Act, the Act of 1 August 2018 on criminal matters, the amended Act of 30 May 2005 on electronic communications and other texts with data protection provisions. Its site accepts complaints through an online form. | |
| Amended Act of 30 May 2005 on the protection of the individual in the electronic communications sector Commission nationale pour la protection des données (CNPD) | The CNPD says the Act transposes Directive 2002/58/EC, governs the protection of personal data in telecommunications and electronic communications and takes account of recent developments in services and technologies. | |
| Institut luxembourgeois de régulation (ILR) for the large majority of sectors, with the CSSF for the banking and financial market infrastructure sectors; the Haut-Commissariat à la Protection nationale (HCPN) is the single point of contact, and GOVCERT.LU and CIRCL are the CSIRTs, as the Chamber of Deputies' committee report on the bill sets out Essential and important entities under NIS2 (energy, transport, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, digital providers and research) | Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, which the ILR says transposes Directive (EU) 2022/2555, entered into force on 10 May 2026 and repealed the NIS1 law. The Chamber's file 8364 shows it published in Mémorial A n° 225. Essential entities send the ILR each year a description of their measures, a risk-scenario questionnaire and a multi-year action plan; important entities are supervised after the event. The choice of risk-analysis method is the entity's, and the ILR's pages on security measures do not name ISO/IEC 27001. | |
| Commission de surveillance du secteur financier (CSSF), and the Commissariat aux Assurances for insurance Financial entities (credit institutions, investment firms, payment and e-money institutions, specialised and support PFS, insurers) | DORA (Regulation (EU) 2022/2554), which the CSSF says has applied to financial entities since 17 January 2025, with the CSSF as threat-led penetration testing authority (TIBER-LU) and as recipient of major ICT-related incident notifications under Circular CSSF 25/893. Circular CSSF 20/750 on ICT and security risk management, as amended by Circulars CSSF 22/828, 25/881 and 26/915, applies to credit institutions, data reporting service providers, investment firms, payment and e-money institutions and specialised and support PFS. Neither CSSF page names ISO/IEC 27001 or any other standard. | |
| Organisme luxembourgeois de la confiance numérique (OLCN), within ILNAS — the national supervisory body under the eIDAS Regulation Trust service providers (electronic signatures, seals, time stamps, registered delivery, website authentication) | Regulation (EU) No 910/2014 (eIDAS), as amended, including by Regulation (EU) 2024/1183. The OLCN checks that trust service providers and their services meet the Regulation and publishes the national trusted list. ILNAS also hosts the national cybersecurity certification authority under the Cybersecurity Act (Regulation (EU) 2019/881). | |
| Direction de la santé Medical devices (manufacturers, authorised representatives and economic operators) | Regulation (EU) 2017/745 (MDR), applicable since 26 May 2021, and Regulation (EU) 2017/746 (IVDR), applicable since 26 May 2022. Manufacturers that place devices on the market in their own name, and EU authorised representatives established in Luxembourg, register with the Direction de la santé; class I and in vitro diagnostic devices are registered there when the manufacturer or its representative is established in Luxembourg. The guichet.lu page does not name ISO 13485. | |
| The competent authority for food hygiene, which validated the HACCP good practice guide for food trades (a government communiqué of December 2021 names the Ministry of Consumer Protection) Food businesses | Regulation (EC) No 852/2004 on the hygiene of foodstuffs, which the government communiqué says encourages food-sector branches to draw up and apply national good hygiene practice guides so that procedures based on HACCP principles become general practice. The Chambre des Métiers updated its guide for food trades in 2021 and the competent authority validated the update. The communiqué does not require a HACCP certificate. | HACCP |
Accreditation and recognition
- OLAS (Office luxembourgeois d'accréditation et de surveillance), within ILNAS: National accreditation body — ILNAS' quality portal describes OLAS' quality system as meeting ISO/IEC 17011 and the requirements of the international accreditation organisations.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Portail des marchés publics (public procurement portal) and the public procurement legislation (Direction des marchés publics and contracting authorities): The portal publishes current tender notices, procedures and the legislation. Each contracting authority sets its own selection and award criteria, so whether a tender asks for ISO certificates depends on the tender documents.
Economic zones
- Health technologies ecosystem (Luxinnovation focus area): connected medical devices, AI-powered diagnostics, digital health, biotech applications, advanced manufacturing
- Space and aerospace ecosystem (Luxembourg Space Agency and SpaceResources.lu): space, aerospace, space resources
Sterling in Luxembourg
Sterling delivers in Luxembourg from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Luxembourg clients ask
Are certification audits in Luxembourg conducted in English, French or German?
It is settled with the certification body when you apply. The country has three official languages, Luxembourgish, French and German, and English is common in business, so say early which one the audit and the controlled documents will use. A contract or a regulator's procedure may fix the language, and that wording prevails.
Which body accredits certification bodies in Luxembourg?
The national accreditation body is OLAS, the Office luxembourgeois d'accréditation et de surveillance, housed in ILNAS. European co-operation for Accreditation shows it as an MLA signatory covering management system certification. A public OLAS directory records each accredited body's scope by standard, which is the place to check a prospective certification body.
Is the Luxembourg NIS2 law already in force?
Yes, the ILR reports so. Its NIS2 page records that the Law of 5 May 2026 transposed Directive (EU) 2022/2555, took effect on 10 May 2026 and repealed the NIS1 law. Whether you count as an essential or important entity turns on the law's tests, which the ILR or your counsel can apply to your case.
Which authority supervises the GDPR in Luxembourg?
The Commission nationale pour la protection des données, known as the CNPD. It is an independent public institution that verifies the legality of personal data processing under the GDPR and the Act of 1 August 2018, which completes the GDPR nationally. Complaints go through an online form on its site. Ask the CNPD or your counsel about a specific processing activity.
Does DORA require ISO/IEC 27001 for Luxembourg financial entities?
Neither text names it. According to the CSSF, DORA has covered financial entities since 17 January 2025, yet its DORA page and Circular CSSF 20/750 on ICT and security risk management make no mention of ISO/IEC 27001. A certificate may still help as supplier evidence; what a supervised firm must demonstrate is for the CSSF or the Commissariat aux Assurances.
Do Luxembourg food businesses need a HACCP certificate?
Not according to the government communiqué on the subject, which asks for no certificate. It explains that Regulation (EC) No 852/2004 encourages national good hygiene practice guides to make HACCP-based procedures general practice, and that the competent authority validated the updated Chambre des Métiers guide for food trades. Customers may still want certification, so ask them.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Luxembourg Act of 1 August 2018 on the organisation of the CNPD — cnpd.public.lu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Amended Act of 30 May 2005 on the protection of the individual in the electronic communications sector — cnpd.public.lu (accessed 18 Oct 2026)
- Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, which the ILR says transposes Directive (EU) 2022/2555, entered into force on 10 May 2026 and repealed the NIS1 law. The Chamber's file 8364 shows it published in Mémorial A n° 225. Essential entities send the ILR each year a description of their measures, a risk-scenario questionnaire and a multi-year action plan; important entities are supervised after the event. The choice of risk-analysis method is the entity's, and the ILR's pages on security measures do not name ISO/IEC 27001. — ilr.lu; chd.lu; wdocs-pub.chd.lu (accessed 18 Oct 2026)
- DORA (Regulation (EU) 2022/2554), which the CSSF says has applied to financial entities since 17 January 2025, with the CSSF as threat-led penetration testing authority (TIBER-LU) and as recipient of major ICT-related incident notifications under Circular CSSF 25/893. Circular CSSF 20/750 on ICT and security risk management, as amended by Circulars CSSF 22/828, 25/881 and 26/915, applies to credit institutions, data reporting service providers, investment firms, payment and e-money institutions and specialised and support PFS. Neither CSSF page names ISO/IEC 27001 or any other standard. — cssf.lu (accessed 18 Oct 2026)
- Regulation (EU) No 910/2014 (eIDAS), as amended, including by Regulation (EU) 2024/1183. The OLCN checks that trust service providers and their services meet the Regulation and publishes the national trusted list. ILNAS also hosts the national cybersecurity certification authority under the Cybersecurity Act (Regulation (EU) 2019/881). — portail-qualite.public.lu (accessed 18 Oct 2026)
- Regulation (EU) 2017/745 (MDR), applicable since 26 May 2021, and Regulation (EU) 2017/746 (IVDR), applicable since 26 May 2022. Manufacturers that place devices on the market in their own name, and EU authorised representatives established in Luxembourg, register with the Direction de la santé; class I and in vitro diagnostic devices are registered there when the manufacturer or its representative is established in Luxembourg. The guichet.lu page does not name ISO 13485. — guichet.public.lu (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs, which the government communiqué says encourages food-sector branches to draw up and apply national good hygiene practice guides so that procedures based on HACCP principles become general practice. The Chambre des Métiers updated its guide for food trades in 2021 and the competent authority validated the update. The communiqué does not require a HACCP certificate. — mpc.gouvernement.lu (accessed 18 Oct 2026)
- OLAS (Office luxembourgeois d'accréditation et de surveillance), within ILNAS — european-accreditation.org; portail-qualite.public.lu (accessed 18 Oct 2026)
- Portail des marchés publics (public procurement portal) and the public procurement legislation — marches.public.lu (accessed 18 Oct 2026)
- Health technologies ecosystem (Luxinnovation focus area) — luxinnovation.lu (accessed 18 Oct 2026)
- Space and aerospace ecosystem (Luxembourg Space Agency and SpaceResources.lu) — portail-qualite.public.lu; luxinnovation.lu (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice