Where we work · Mali
ISO and GRC certification consulting in Mali
Achieve ISO and GRC certification in Mali with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Mali
- Mining and quarrying companies and their contractors
- Agriculture and agri-food processors
- Energy and infrastructure contractors bidding for public works
- Banks, electronic money issuers and payment firms
- Telecommunications operators and ICT service companies
- Pharmaceutical and health-product importers, makers and distributors
Clients include
ISO and GRC certification in Mali at a glance
Mali's certification market is steered by named public bodies. Law No. 2013-015 of 21 May 2013 created the Autorité de Protection des Données à Caractère Personnel (APDP), which receives declarations of processing, authorises transfers abroad and handles complaints. The Agence Nationale de la Sécurité Sanitaire des Aliments (ANSSA) coordinates food safety, and the 2023 Mining Code ties mine permits to impact studies, safety and hygiene rules and transparency principles. The AMRTP regulates telecommunications and ICT, the BCEAO sets payment and banking rules for the West African monetary union, and public buyers publish tenders on the DGMP-DSP portal under the ARMDS. AMANORM develops national standards. Accreditation is regional: SOAC is recognised for laboratories, so management-system certificates usually carry accreditation from another economy. The Chamber of Commerce and Industry points investors to agriculture, mines, energy, infrastructure and ICT. Sterling's Casablanca office supports Malian organisations, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Mali
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Mali (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali Autorité de Protection des Données à Caractère Personnel (APDP), the independent administrative authority that the law itself creates | Applies to any processing of personal data carried out wholly or partly on national territory, including by the State, local authorities and private bodies, and to controllers established abroad whose means of processing are used in Mali, apart from purely personal or household use. Data must be collected fairly and lawfully for specified purposes, kept adequate, accurate and no longer than needed, and protected by the controller, who must also make sure processors give sufficient security guarantees. Sensitive data is barred except in listed cases and under safeguards set by the Authority. Transfers abroad rely on an adequate level of protection recognised by the Authority or on its decision. People have rights to information, access, correction and objection, and no decision with legal effect may rest only on automated profiling. Controllers declare their processing to the Authority. | |
| Duties and powers of the APDP under the 2013 law Autorité de Protection des Données à Caractère Personnel (APDP) | The Authority sets the norms and purposes for collecting and keeping personal data, receives declarations of processing and keeps a public list of them, gives prior approval to data interconnection, authorises transfers, receives and investigates complaints, carries out checks, advises on draft texts and can impose administrative penalties such as a warning, a formal notice, an order to stop processing or withdrawal of approval. Its acts can be challenged through administrative and court procedures, and the law also provides for criminal and financial penalties under the conditions it sets. | |
| Cybercrime law and telecommunications ordinances Not a single regulator; the cybercrime law fixes offences and procedure, and the telecommunications regulator publishes the two ordinances | The cybercrime law defines offences committed through information and communication technologies on Malian territory or with effects there, and states that it transposes the ECOWAS directive on combating cybercrime. These texts form the legal setting around information security work. They are context for ISO/IEC 27001, not a security standard. | |
| Autorité malienne de Régulation des Télécommunications/TIC et des Postes (AMRTP) Telecommunications, ICT and postal services | Created by Ordonnance n°2011-024/P-RM of 28 September 2011 as an independent administrative authority with legal personality and financial and administrative autonomy, replacing the earlier Comité de Régulation des Télécommunications. Its site publishes the ordinances, authorisation and declaration regimes, type-approval (homologation) certificates and the documents needed for installer approval. | |
| Agence des Technologies de l'Information et de la Communication (AGETIC) Government digital services, ICT infrastructure and the .ml domain | AGETIC describes itself as responsible for building and maintaining ICT infrastructure for the public administration, supporting the national ICT strategy and managing the .ml domain name. Its stated vision includes securing digital infrastructure and data, protecting personal information and resilience of systems. The page does not name ISO/IEC 27001. | |
| Banque Centrale des Etats de l'Afrique de l'Ouest (BCEAO), the common central bank of the Union, which lists Mali among its member states Banks, electronic money issuers and payment service providers in the West African Economic and Monetary Union | The BCEAO publishes the Union's payment-system regulation, including Règlement n°15/2002/CM/UEMOA on payment systems, Instruction n°008-05-2015 on electronic money issuers, Instruction N°001-03-2021 on oversight of financial market infrastructures, payment means and services, and the uniform law on offences involving cheques, bank cards and other electronic payment instruments. | |
| Agence Nationale de la Sécurité Sanitaire des Aliments (ANSSA) Food safety | Loi N°03-043 du 30 décembre 2003 portant création de l'Agence Nationale de la Sécurité Sanitaire des Aliments, printed in the Journal officiel of 10 January 2004, creates ANSSA as a scientific and technological public establishment under the Minister of Health. It coordinates food-safety actions, gives technical and scientific support to control bodies and to the drafting of food-safety rules, assesses health risks from food, water, production, processing, storage and transport conditions, additives, residues and food-contact materials, and handles risk communication. The law does not name ISO 22000 or HACCP. | |
| Ministère de la Santé et du Développement Social Medicines and health products | The Ministry's site states that it prepares and carries out government policy on public health, public hygiene, pharmacy and medicines, among other areas, and that it works to ensure the availability and quality of medicines and health products; its powers rest on Décret n°2023-0392/PM-RM of 19 July 2023. The page does not name ISO 13485. | |
| The ministry responsible for mines, under the Mining Code Mining and quarrying | Loi n°2023-040 du 29 août 2023 portant Code minier en République du Mali, with Loi n°2023-041 relative au contenu local dans le secteur minier, both printed in the Journal officiel of 1 September 2023. The Code requires holders of research permits and their subcontractors to follow safety and hygiene rules and to apply protection and prevention rules in line with accepted national or international standards, requires applicants for mine permits to submit an environmental and social impact study, a closure and rehabilitation plan and a community development plan, asks permit holders to follow the principles of the Extractive Industries Transparency Initiative and the Kimberley Process, and says sample analyses are carried out in Mali unless a justified exception applies. | |
| The administration in charge of the environment, under the impact-assessment decree Environmental impact assessment for projects | Décret n°2018-0991/P-RM du 31 décembre 2018 relatif à l'étude et à la notice d'impacts environnemental et social sets the rules and procedures for the full impact study and the lighter notice. The study aims to prevent environmental degradation, include climate-change issues, reduce or repair damage through mitigation and compensation measures and involve the people and organisations concerned. The decree does not name ISO 14001. | |
| Agence Malienne de Normalisation et de Promotion de la Qualité (AMANORM) National standards and quality promotion | Created by Ordonnance N°2012-016/P-RM of 19 March 2012 as a public administrative establishment to carry out national policy on standardisation and quality promotion; the ISO member directory lists AMANORM as Mali's member body. Its role here is standards development and quality promotion only. | |
| Agence pour la Promotion des Investissements au Mali (API-MALI) Investors and enterprise creation | API-MALI presents itself as the investment promotion agency, with a one-stop window for formalities, company creation and approval under the investment code. Its site lists tax incentives and personalised support among its services. |
Accreditation and recognition
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation): Regional accreditation body; UNIDO lists Mali among the nine ECOWAS member states it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Portail Malien des Marchés Publics (DGMP-DSP) and the procurement regulator ARMDS (Direction Générale des Marchés Publics et des Délégations de Service Public (DGMP-DSP) and the Autorité de Régulation des Marchés Publics et des Délégations de Service Public (ARMDS)): The DGMP-DSP prepares and monitors national public-procurement policy and publishes tender notices, expressions of interest and award lists on its portal. The ARMDS regulates the procurement system, can investigate irregularities and impose penalties, and hears non-judicial appeals from bidders who consider a procedure unfair. Each tender document sets its own qualification criteria; the portal does not make ISO certification a general condition.
Sterling in Mali
Sterling delivers in Mali from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Mali clients ask
Which body accredits ISO certification bodies for Malian companies?
Accreditation for Mali is regional. SOAC, the West African Accreditation System, serves nine ECOWAS member states including Mali, and its recognitions in 2022 cover testing, calibration and medical laboratories rather than management-system certification. For an ISO management-system certificate, ask the certification body which accreditation body covers the standard and your sector, and whether your buyer or lender accepts it.
Does Mali have a personal data protection law, and who enforces it?
Yes. Law No. 2013-015 of 21 May 2013 protects personal data and creates the Autorité de Protection des Données à Caractère Personnel (APDP). The Authority receives declarations of processing, authorises transfers abroad, handles complaints and can impose administrative penalties. The law covers processing carried out wholly or partly in Mali. Check with counsel or the APDP which formalities apply to your processing.
Are certification audits in Mali carried out in French?
Mostly in French. Mali's laws, its Journal officiel and its agency websites are published in French, which makes French the working language for reviewing documents and signing contracts. Before you apply, settle with the certification body who will interpret, which language controlled documents use and whether shop-floor interviews will be in a national language.
Who regulates food safety in Mali?
ANSSA, the Agence Nationale de la Sécurité Sanitaire des Aliments, created by Loi N°03-043 of 30 December 2003 and placed under the Minister of Health. It coordinates food-safety actions, supports control bodies and rule-making, and assesses health risks in food, water and production conditions. The law does not name ISO 22000 or HACCP, so buyers and importers usually decide which certificates they expect.
Do mining companies in Mali need an environmental impact study?
Yes, before mining starts. The 2023 Mining Code requires applicants for mine permits to carry out an environmental and social impact study and to submit closure and rehabilitation and community development plans, and the 2018 decree on impact studies and notices sets the procedure. The Code also asks permit holders and subcontractors to follow safety and hygiene rules in line with accepted standards. Confirm the exact steps with the ministry responsible for mines.
Where do suppliers find public tenders in Mali?
On the DGMP-DSP portal, which publishes tender notices, expressions of interest and award lists for public buyers. The ARMDS regulates the procurement system and hears appeals from bidders. Each tender sets its own qualification criteria, so a certificate helps only where the document asks for it. Read the qualification clause of every bid and ask the contracting authority what evidence it accepts.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali — sgg-mali.ml (accessed 18 Oct 2026)
- Duties and powers of the APDP under the 2013 law — sgg-mali.ml (accessed 18 Oct 2026)
- Cybercrime law and telecommunications ordinances — sgg-mali.ml; amrtp.ml (accessed 18 Oct 2026)
- Created by Ordonnance n°2011-024/P-RM of 28 September 2011 as an independent administrative authority with legal personality and financial and administrative autonomy, replacing the earlier Comité de Régulation des Télécommunications. Its site publishes the ordinances, authorisation and declaration regimes, type-approval (homologation) certificates and the documents needed for installer approval. — amrtp.ml (accessed 18 Oct 2026)
- AGETIC describes itself as responsible for building and maintaining ICT infrastructure for the public administration, supporting the national ICT strategy and managing the .ml domain name. Its stated vision includes securing digital infrastructure and data, protecting personal information and resilience of systems. The page does not name ISO/IEC 27001. — agetic.gouv.ml (accessed 18 Oct 2026)
- The BCEAO publishes the Union's payment-system regulation, including Règlement n°15/2002/CM/UEMOA on payment systems, Instruction n°008-05-2015 on electronic money issuers, Instruction N°001-03-2021 on oversight of financial market infrastructures, payment means and services, and the uniform law on offences involving cheques, bank cards and other electronic payment instruments. — bceao.int (accessed 18 Oct 2026)
- Loi N°03-043 du 30 décembre 2003 portant création de l'Agence Nationale de la Sécurité Sanitaire des Aliments, printed in the Journal officiel of 10 January 2004, creates ANSSA as a scientific and technological public establishment under the Minister of Health. It coordinates food-safety actions, gives technical and scientific support to control bodies and to the drafting of food-safety rules, assesses health risks from food, water, production, processing, storage and transport conditions, additives, residues and food-contact materials, and handles risk communication. The law does not name ISO 22000 or HACCP. — sgg-mali.ml (accessed 18 Oct 2026)
- The Ministry's site states that it prepares and carries out government policy on public health, public hygiene, pharmacy and medicines, among other areas, and that it works to ensure the availability and quality of medicines and health products; its powers rest on Décret n°2023-0392/PM-RM of 19 July 2023. The page does not name ISO 13485. — sante.gov.ml (accessed 18 Oct 2026)
- Loi n°2023-040 du 29 août 2023 portant Code minier en République du Mali, with Loi n°2023-041 relative au contenu local dans le secteur minier, both printed in the Journal officiel of 1 September 2023. The Code requires holders of research permits and their subcontractors to follow safety and hygiene rules and to apply protection and prevention rules in line with accepted national or international standards, requires applicants for mine permits to submit an environmental and social impact study, a closure and rehabilitation plan and a community development plan, asks permit holders to follow the principles of the Extractive Industries Transparency Initiative and the Kimberley Process, and says sample analyses are carried out in Mali unless a justified exception applies. — sgg-mali.ml (accessed 18 Oct 2026)
- Décret n°2018-0991/P-RM du 31 décembre 2018 relatif à l'étude et à la notice d'impacts environnemental et social sets the rules and procedures for the full impact study and the lighter notice. The study aims to prevent environmental degradation, include climate-change issues, reduce or repair damage through mitigation and compensation measures and involve the people and organisations concerned. The decree does not name ISO 14001. — sgg-mali.ml (accessed 18 Oct 2026)
- Created by Ordonnance N°2012-016/P-RM of 19 March 2012 as a public administrative establishment to carry out national policy on standardisation and quality promotion; the ISO member directory lists AMANORM as Mali's member body. Its role here is standards development and quality promotion only. — sgg-mali.ml; iso.org (accessed 18 Oct 2026)
- API-MALI presents itself as the investment promotion agency, with a one-stop window for formalities, company creation and approval under the investment code. Its site lists tax incentives and personalised support among its services. — apimali.gov.ml (accessed 18 Oct 2026)
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation) — hub.unido.org; wacomp.ecowas.int; ilac.org (accessed 18 Oct 2026)
- Portail Malien des Marchés Publics (DGMP-DSP) and the procurement regulator ARMDS — dgmp.gouv.ml (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice