Where we work · Mexico
ISO and GRC certification consulting in Mexico
Achieve ISO and GRC certification in Mexico with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Mexico
Clients include
ISO and GRC certification in Mexico at a glance
Mexico rewrote its private-sector data protection law in 2025, and the Secretaría Anticorrupción y Buen Gobierno, successor to the former institute INAI, now supervises it. Around that sits a quality infrastructure built on the Ley de Infraestructura de la Calidad, mandatory NOMs, and the Entidad Mexicana de Acreditación, which Global ACI lists as a mutual recognition signatory. COFEPRIS treats an accredited ISO 13485 certificate as equivalent to part of its medical device norm, PROFEPA and STPS run voluntary environmental and safety programmes, and bank outsourcing rules let the CNBV inspect service providers. Demand comes from automotive and aerospace suppliers, medical device and food makers, electronics firms, banks and fintechs, BPO and software providers serving overseas clients, and public-sector suppliers, many shipping under the T-MEC. Certificates come from accredited certification bodies, never from Sterling. Sterling's New York office serves clients in Mexico on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Mexico
Each page covers who needs the standard in Mexico, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Mexico (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — Federal Law on the Protection of Personal Data Held by Private Parties Secretaría Anticorrupción y Buen Gobierno (the 'Secretaría' of the law). The decree's transitional provisions provide that mentions of the former Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) are read as mentions of the public bodies that take over its functions, and that its staff and resources pass to the Secretaría. | Applies throughout the national territory to private individuals and private legal entities that process personal data; credit information companies (under their own law) and purely personal collection are excepted. Sets the principles of lawfulness, purpose, fairness, consent, quality, proportionality, information and accountability; consent is tacit by default, express for financial or patrimonial data and express and in writing for sensitive data; requires a privacy notice with listed contents, administrative, technical and physical security measures, a duty of confidentiality and prompt notice to data subjects of breaches that significantly affect their patrimonial or moral rights; gives data subjects access, rectification, cancellation and objection rights (ARCO) and requires each controller to designate a person or department to handle requests; regulates transfers and lets parties agree binding self-regulation schemes such as codes of conduct and trust seals. The Secretaría verifies compliance, resolves rights-protection procedures, imposes sanctions and publishes international information-security standards and good practices; the law also has a chapter of criminal offences. It cites no ISO standard and creates no certificate of compliance. Penalties are set in the law and are not restated here. | |
| Secretaría de Economía and the national quality infrastructure system Standardisation, accreditation and conformity assessment (all sectors) | Ley de Infraestructura de la Calidad (new law published in the DOF on 1 July 2020). It defines an accreditation entity as a legal person authorised by the Secretaría de Economía to process and decide accreditation applications, defines a Norma Oficial Mexicana (NOM) as a mandatory technical regulation, and lets the competent authority approve accredited conformity assessment bodies to assess against NOMs. | |
| Comisión Federal para la Protección contra Riesgos Sanitarios (COFEPRIS), Secretaría de Salud Medical devices (manufacture, storage and distribution) | NOM-241-SSA1-2021, Buenas prácticas de fabricación de dispositivos médicos, published in the DOF on 20 December 2021, replacing NOM-241-SSA1-2012. It states that it is partially concordant with ISO 13485:2016 and that an establishment certified to the current ISO 13485 by a body authorised by a national or internationally recognised accreditation entity is treated as equivalent to the requirements of its quality management system chapter, with inspection taking a reduced approach on the rest. | ISO 13485, ISO 9001 |
| Secretaría de Salud (COFEPRIS) Food, beverage and food-supplement processing | NOM-251-SSA1-2009, Prácticas de higiene para el proceso de alimentos, bebidas o suplementos alimenticios (DOF 1 March 2010). It makes hygiene practices mandatory for processing establishments and says establishments may implement a HACCP system, using its appendix as a guide, with HACCP becoming mandatory only where the NOM for the product being processed requires it. | HACCP |
| Comisión Nacional Bancaria y de Valores (CNBV), with Banco de México for some fintech rules Banks, fintech institutions and their service providers | Ley de Instituciones de Crédito: credit institutions may contract third parties for services, and the CNBV may inspect those service providers or order the institution to audit them, with the contract binding the provider to the law's terms. Ley para Regular las Instituciones de Tecnología Financiera: the CNBV, and for electronic payment fund institutions the CNBV and Banco de México jointly, issue general provisions on information security and operational continuity. | |
| Procuraduría Federal de Protección al Ambiente (PROFEPA) Industry and any activity with environmental impact | Programa Nacional de Auditoría Ambiental (PNAA): PROFEPA's page describes voluntary environmental auditing and self-regulation schemes that lead to an environmental certificate, with requirements set in the regulation on self-regulation and environmental audits and in the Mexican standards NMX-AA-162-SCFI-2012 and NMX-AA-163-SCFI-2012; companies choose an environmental auditor from PROFEPA's approved register and the procedure with PROFEPA is free of charge. | ISO 14001 |
| Secretaría del Trabajo y Previsión Social (STPS) Employers (occupational safety and health) | Programa de Autogestión en Seguridad y Salud en el Trabajo (PASST): STPS describes a voluntary programme that promotes safety and health management systems based on national and international standards, with 'Empresa Segura' recognition levels, and says participating workplaces are not subject to federal labour inspections. | ISO 45001 |
| Comisión Nacional para el Uso Eficiente de la Energía (CONUEE) and Secretaría de Economía Energy users, industry and public buildings | CONUEE publishes its Manual para la Implementación de un Sistema de Gestión de la Energía (second edition, 25 July 2016, with GIZ). The Secretaría de Economía declared the Mexican standard NMX-J-SAA-50001-ANCE-IMNC-2019, Sistemas de gestión de la energía — Requisitos con orientación para su uso, in force by a declaration published in the DOF on 7 February 2020, cancelling the 2011 version. | ISO 50001 |
| Secretaría Anticorrupción y Buen Gobierno Companies exposed to corruption risk, including public contractors | Ley General de Responsabilidades Administrativas (published 18 July 2016; text consolidated to the amendment of 15 December 2025): in judging the liability of a legal person the authority weighs whether it has an integrity policy, defined by minimum elements such as an organisation manual, a published code of conduct with real enforcement mechanisms, control and audit systems, reporting channels with disciplinary consequences, and training. The law also lets the Secretarías sign collaboration agreements with persons taking part in public contracting and with business chambers on self-regulation, internal controls and integrity programmes. | ISO 37001, ISO 37301 |
| Secretaría de Relaciones Exteriores (promulgation); Secretaría de Economía (trade policy) Exporters in North American supply chains | Decree promulgating the protocol that replaces NAFTA with the Treaty between Mexico, the United States of America and Canada (T-MEC, known in English as USMCA), published in the DOF on 29 June 2020 and entering into force on 1 July 2020. The Treaty text has a rules-of-origin chapter with product-specific rules, including regional value content rules for vehicles. It sets origin rules and does not certify management systems; customers decide which certificates they require. |
Accreditation and recognition
- Entidad Mexicana de Acreditación, A.C. (EMA): National accreditation entity — EMA states on its own site that it is the first privately managed accreditation entity in Mexico, operating since the authorisation published in the DOF on 15 January 1999, and that it accredits testing, calibration and clinical laboratories, inspection units, certification bodies, proficiency testing providers, reference material producers and greenhouse-gas validation and verification bodies; its legal basis includes the Ley de Infraestructura de la Calidad. It publishes catalogues of accredited bodies on its site.
- Mexicana de Acreditación, MAAC, A.C. (MAAC): Accreditation body listed by Global ACI as an associate member — Global ACI describes associate members as accreditation bodies not yet accepted as Global ACI MRA signatories that self-declare conformity with ISO/IEC 17011; MAAC's entry shows a code of conduct adopted on 24 February 2026.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Federal public procurement and the Plataforma Digital de Contrataciones Públicas (Secretaría Anticorrupción y Buen Gobierno and the contracting dependencies and entities, under the Ley de Adquisiciones, Arrendamientos y Servicios del Sector Público (new law published in the DOF on 16 April 2025)): The law says annual purchasing programmes consider the norms applicable under the Ley de Infraestructura de la Calidad or, failing those, international norms, and that each tender notice states whether conformity assessment under that law is needed to verify the specifications. It does not require ISO certificates as a blanket condition; each tender notice sets its own technical and quality requirements.
- Integrity programmes for companies taking part in public contracting (Secretaría Anticorrupción y Buen Gobierno, under the Ley General de Responsabilidades Administrativas): The law lets the Secretarías sign collaboration agreements with persons taking part in public contracting and with business chambers to guide self-regulation mechanisms including internal controls and an integrity programme, to be designed with international good practice on controls, ethics and integrity, reporting tools and protection for people who report.
Economic zones
- Polos de Desarrollo Económico para el Bienestar:
- Recintos fiscalizados estratégicos (strategic bonded premises):
- IMMEX export manufacturing programme (a customs programme, not a physical zone): export manufacturing, maquila and export services
Sterling in Mexico
Sterling delivers in Mexico from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Mexico, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Mexican clients ask
Who regulates personal data held by private companies in Mexico?
The Secretaría Anticorrupción y Buen Gobierno supervises it under the new Federal Law on the Protection of Personal Data Held by Private Parties, published in the Diario Oficial on 20 March 2025 and in force from the following day. The law passes the functions of the former data protection institute, INAI, to the Secretaría Anticorrupción y Buen Gobierno and related bodies. Confirm current duties with your counsel or the authority.
Which body accredits certification bodies in Mexico?
The Entidad Mexicana de Acreditación, EMA, is the established accreditation entity, and Global ACI lists it as a mutual recognition signatory. Its recognition entries run from ISO 9001 in 2001 to ISO 37001 in December 2025, but ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701, ISO/IEC 42001 and IATF 16949 are not shown there, so ask any certification body for its accreditation scope.
Are certification audits in Mexico conducted in English?
Often yes for exporters and multinationals, but Spanish is the language of Mexican law, tenders and regulatory filings, and Spanish and the indigenous languages are national languages with equal validity. Agree the audit language, any interpreter and the language of controlled documents when you apply, and mention early if shop-floor interviews will run in Spanish.
Do Mexican federal tenders require ISO certificates?
Not as a blanket rule. The 2025 federal procurement law says each tender notice states whether conformity assessment is needed to verify the specifications, and annual programmes consider Mexican quality-infrastructure norms or, failing those, international ones. A particular notice may still ask for a certificate, so read the technical requirements of each tender before deciding.
Does COFEPRIS accept an ISO 13485 certificate?
Partly. NOM-241-SSA1-2021, the medical device manufacturing practices norm, treats an establishment certified to the current ISO 13485 by a body authorised by a national or internationally recognised accreditation entity as equivalent to its quality management chapter, with a reduced inspection approach on the rest. It does not replace the norm's other requirements or product registration.
Are PROFEPA's environmental audit and the STPS safety programme the same as ISO 14001 and ISO 45001?
No. PROFEPA's national environmental audit programme and STPS's workplace safety self-management programme are voluntary government schemes with their own recognitions, set out in Mexican regulation and standards. ISO 14001 and ISO 45001 certificates come from accredited certification bodies. One can support the other, but a government recognition does not replace a customer-required certificate.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — Federal Law on the Protection of Personal Data Held by Private Parties — diputados.gob.mx; dof.gob.mx (accessed 11 Oct 2026)
- Ley de Infraestructura de la Calidad (new law published in the DOF on 1 July 2020). It defines an accreditation entity as a legal person authorised by the Secretaría de Economía to process and decide accreditation applications, defines a Norma Oficial Mexicana (NOM) as a mandatory technical regulation, and lets the competent authority approve accredited conformity assessment bodies to assess against NOMs. — diputados.gob.mx (accessed 11 Oct 2026)
- NOM-241-SSA1-2021, Buenas prácticas de fabricación de dispositivos médicos, published in the DOF on 20 December 2021, replacing NOM-241-SSA1-2012. It states that it is partially concordant with ISO 13485:2016 and that an establishment certified to the current ISO 13485 by a body authorised by a national or internationally recognised accreditation entity is treated as equivalent to the requirements of its quality management system chapter, with inspection taking a reduced approach on the rest. — dof.gob.mx; gob.mx (accessed 11 Oct 2026)
- NOM-251-SSA1-2009, Prácticas de higiene para el proceso de alimentos, bebidas o suplementos alimenticios (DOF 1 March 2010). It makes hygiene practices mandatory for processing establishments and says establishments may implement a HACCP system, using its appendix as a guide, with HACCP becoming mandatory only where the NOM for the product being processed requires it. — dof.gob.mx (accessed 11 Oct 2026)
- Ley de Instituciones de Crédito: credit institutions may contract third parties for services, and the CNBV may inspect those service providers or order the institution to audit them, with the contract binding the provider to the law's terms. Ley para Regular las Instituciones de Tecnología Financiera: the CNBV, and for electronic payment fund institutions the CNBV and Banco de México jointly, issue general provisions on information security and operational continuity. — diputados.gob.mx (accessed 11 Oct 2026)
- Programa Nacional de Auditoría Ambiental (PNAA): PROFEPA's page describes voluntary environmental auditing and self-regulation schemes that lead to an environmental certificate, with requirements set in the regulation on self-regulation and environmental audits and in the Mexican standards NMX-AA-162-SCFI-2012 and NMX-AA-163-SCFI-2012; companies choose an environmental auditor from PROFEPA's approved register and the procedure with PROFEPA is free of charge. — gob.mx (accessed 11 Oct 2026)
- Programa de Autogestión en Seguridad y Salud en el Trabajo (PASST): STPS describes a voluntary programme that promotes safety and health management systems based on national and international standards, with 'Empresa Segura' recognition levels, and says participating workplaces are not subject to federal labour inspections. — autogestionsst.stps.gob.mx; gob.mx (accessed 11 Oct 2026)
- CONUEE publishes its Manual para la Implementación de un Sistema de Gestión de la Energía (second edition, 25 July 2016, with GIZ). The Secretaría de Economía declared the Mexican standard NMX-J-SAA-50001-ANCE-IMNC-2019, Sistemas de gestión de la energía — gob.mx; dof.gob.mx (accessed 11 Oct 2026)
- Ley General de Responsabilidades Administrativas (published 18 July 2016; text consolidated to the amendment of 15 December 2025): in judging the liability of a legal person the authority weighs whether it has an integrity policy, defined by minimum elements such as an organisation manual, a published code of conduct with real enforcement mechanisms, control and audit systems, reporting channels with disciplinary consequences, and training. The law also lets the Secretarías sign collaboration agreements with persons taking part in public contracting and with business chambers on self-regulation, internal controls and integrity programmes. — diputados.gob.mx (accessed 11 Oct 2026)
- Decree promulgating the protocol that replaces NAFTA with the Treaty between Mexico, the United States of America and Canada (T-MEC, known in English as USMCA), published in the DOF on 29 June 2020 and entering into force on 1 July 2020. The Treaty text has a rules-of-origin chapter with product-specific rules, including regional value content rules for vehicles. It sets origin rules and does not certify management systems; customers decide which certificates they require. — dof.gob.mx (accessed 11 Oct 2026)
- Entidad Mexicana de Acreditación, A.C. (EMA) — global-aci.org; ema.org.mx (accessed 11 Oct 2026)
- Mexicana de Acreditación, MAAC, A.C. (MAAC) — global-aci.org (accessed 11 Oct 2026)
- Federal public procurement and the Plataforma Digital de Contrataciones Públicas — diputados.gob.mx (accessed 11 Oct 2026)
- Integrity programmes for companies taking part in public contracting — diputados.gob.mx (accessed 11 Oct 2026)
- Polos de Desarrollo Económico para el Bienestar — dof.gob.mx
- Recintos fiscalizados estratégicos (strategic bonded premises) — diputados.gob.mx
- IMMEX export manufacturing programme (a customs programme, not a physical zone) — snice.gob.mx
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice