Where we work · Monaco
ISO and GRC certification consulting in Monaco
Achieve ISO and GRC certification in Monaco with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Monaco
Clients include
ISO and GRC certification in Monaco at a glance
A small Principality with a dense rulebook explains demand for ISO and GRC work in Monaco. Law No. 1.565 of 3 December 2024 gave the Autorité de Protection des Données Personnelles a new rulebook on records, processors, breaches and transfers. Food businesses must run HACCP-based procedures under Sovereign Ordinance No. 1.940, the Commission de Contrôle des Activités Financières supervises banks, managers and funds, and the Agence Monégasque de Sécurité Numérique oversees vital operators and qualifies health data hosts. State tenders may ask for quality certificates from independent bodies, and the Environment Code treats ISO 14001 certification as proof of compliance for waste incineration plants. According to IMSEE, in 2024 scientific, technical and support services made up 23.5% of GDP, financial and insurance activities 17.6% and construction 9.6%. Certificates come from accredited certification bodies, never from Sterling. Sterling serves Monaco from its Netherlands office in Enschede, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Monaco
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Monaco (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles Autorité de Protection des Données Personnelles (APDP), the independent administrative authority created by Article 37 of the Law | Applies to automated and non-automated processing by a controller or processor established in Monaco, whether or not the processing takes place there, and to processing about people in the Principality by a controller or processor established elsewhere where it relates to offering goods or services to them or monitoring their behaviour; such a controller or processor must normally appoint a representative in Monaco or, failing that, in an EU Member State. Controllers must show compliance, build in data protection by design and by default, put a written contract in place with each processor, keep a record of processing (organisations in Monaco with fewer than 50 employees are exempt unless the processing carries risk, is not occasional or involves sensitive data), appoint a data protection officer in the cases the Law lists (public bodies and bodies with a public service mission, core activities needing regular and systematic large-scale monitoring, and core large-scale processing of sensitive or criminal data), secure the data, notify a breach to the APDP in the best time and if possible within 72 hours, and carry out an impact assessment for high-risk processing. Transfers outside the Principality are allowed to EU Member States, which the Law treats as adequate, to countries on the adequacy list adopted by ministerial order, or on the safeguards the Law lists. Beyond the Law's general rules, certain processing needs the APDP's prior opinion or authorisation, and CCTV systems in places not open to the public must be brought to its attention without delay. The Law cites no ISO standard. | |
| Autorité de Protection des Données Personnelles (APDP) guidance and enforcement Autorité de Protection des Données Personnelles (APDP) | The APDP describes itself as the independent administrative authority that checks and verifies that personal data is processed in line with the applicable laws and regulations, and as the successor to the Commission de Contrôle des Informations Nominatives. It meets in a plenary formation, which carries out checks and investigations and can issue formal notices, and in a restricted formation, which decides sanctions after an adversarial procedure; its site publishes practical sheets, a model register of processing and a model breach register. | |
| The State authority designated as competent authority under Article 29 of Law No. 1.330 on food safety; establishments are approved by the Minister of State after an on-site inspection Food businesses: production, processing, retail, storage, transport and catering | Loi n° 1.330 du 8 janvier 2007 relative à la sécurité alimentaire; Ordonnance Souveraine n° 1.940 du 6 novembre 2008 relative à l'hygiène des denrées alimentaires, whose Article 5 requires permanent procedures based on the HACCP principles; Arrêté Ministériel n° 2017-102 du 1er mars 2017 on hygiene rules for retail, storage and transport, which refers to HACCP-based hygiene guides and validated hazard analyses. HACCP is a legal duty here, not an optional certificate. The ordinance applies at every stage of production, processing and distribution and to exports, requires the cold chain to be maintained and requires operators to notify each establishment to the authority. | HACCP |
| Commission de Contrôle des Activités Financières (CCAF) Credit institutions, management companies, funds and multi family offices | The CCAF's site describes it as the independent administrative authority supervising financial activities in the Principality, covering portfolio and fund management, advice, order reception and transmission, and custody account keeping. It grants approvals to credit institutions, management companies, multi family offices and domestic funds, checks them off-site and on site, and can sanction. Its site lists Law No. 1.338 and Sovereign Ordinance No. 1.284 among its governing texts and names no ISO standard on its mission page. | |
| Agence Monégasque de Sécurité Numérique (AMSN), the national authority for information systems security, created by Ordonnance Souveraine n° 5.664 du 23 décembre 2015 Operators of vital importance and State information systems | Loi n° 1.435 du 8 novembre 2016 relative à la lutte contre la criminalité technologique; Arrêté Ministériel n° 2018-1053 du 8 novembre 2018 on security rules for the information systems of operators of vital importance; Arrêté Ministériel n° 2023-394 du 3 juillet 2023 listing the vital sectors and the designation criteria. Operators and State services must tell AMSN without delay of incidents affecting their information systems. The AMSN page names no ISO standard. | |
| Agence Monégasque de Sécurité Numérique (AMSN) Hosts of personal health data and the health establishments and professionals that use them | Ordonnance Souveraine n° 8.337 du 5 novembre 2020 on personal health data produced or received by health professionals and establishments, and Arrêté Ministériel n° 2020-764 du 5 novembre 2020, which sets the requirements to qualify health data hosts. The AMSN Director qualifies a host after checks against the AMSN PINH referential at advanced level, made by an information-security audit provider, and against the French HDS referential, verified by a certification body accredited by the French accreditation committee and approved by AMSN. An annual surveillance audit follows. The order names these referentials, not an ISO standard. | |
| The Labour Inspectorate of the Government of Monaco All employers, building sites, premises open to the public, and industrial and commercial premises | Loi n° 537 du 12 mai 1951 relative à l'inspection du travail: labour inspection ensures that the legal provisions on working conditions and the protection of workers are applied. The Government's service page says inspectors enforce labour law and the law on health and safety at work, help prevent accidents, and carry out inspection visits on building sites, in premises open to the public, in industrial and commercial premises and at the scene of serious accidents at work. No ISO standard is cited. | |
| The Government of Monaco, under the Environment Code (the Code names the Direction de l'Aménagement Urbain and the Direction de l'Environnement in its operating provisions) Waste incineration installations and other operators with environmental obligations | Code de l'environnement, created by Loi n° 1.456 du 12 décembre 2017. For incineration and co-incineration installations, article O. 414-2-12 (created by Ordonnance Souveraine n° 11.931 du 21 mai 2026) requires the operator to apply an environmental management system; installations whose system is certified to NF EN ISO 14001 by an accredited body are treated as meeting those requirements. The provision is specific to that installation type. | ISO 14001 |
| The Government of Monaco, through its Energy Transition Mission Owners and managers of existing buildings, and developers of new buildings | Arrêté Ministériel n° 2018-613 du 26 juin 2018 on the thermal characteristics of new buildings, refurbishments and extensions, amended in December 2020. The Government's energy transition site describes the building energy audit: a detailed analysis of a building's energy performance, carried out by a company holding the stated qualification or an equivalent, whose summary or full report accompanies sale and lease contracts on a schedule by building age. No ISO standard is cited. | |
| Autorité Monégasque de Sécurité Financière (AMSF) Professionals within the scope of the anti-money-laundering framework | The AMSF's site publishes guidelines, practical guides and training for the professionals it supervises, a yachting practical guide for 2026 and an annual activity report for 2025, and describes a national coordination committee for the strategy against money laundering and corruption. It names no ISO standard. |
Accreditation and recognition
- Comité français d'accréditation (the French accreditation committee), as named in Monaco's own rules: Accreditation body that Monaco's health data hosting order names for the certification bodies verifying the French HDS referential, and that article O. 414-2-8 of the Environment Code names for bodies making emission measurements at waste incineration installations; these are Monegasque regulations, not an accreditation arrangement for Monaco as a whole.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- State public procurement under Ordonnance Souveraine n° 7.264 du 20 décembre 2018 (State contracting departments of the Government of Monaco): Candidates file documents that let the State assess experience and professional, technical and financial capacity; the State may require a minimum annual turnover, adequate references from earlier contracts and, under Article 30, quality certificates issued by independent bodies. Calls for competition are published in the Journal de Monaco, and each tender sets its own requirements.
- Pre-selection register for State building and public works contractors under Arrêté Ministériel n° 2022-708 (The Government of Monaco (a classification commission examines candidates and advises the Minister of State)): Contractors apply to a register; files include staff qualifications, references with client certificates and a French building-trades qualification or an equivalent national certificate. For each completed State works contract a quality sheet rates the quality and conformity of the work and respect for environmental good practice, and unfavourable sheets can reduce a contractor's ceiling.
Sterling in Monaco
Sterling delivers in Monaco from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Monaco clients ask
Does Monaco have a data protection law?
Yes. Law No. 1.565 of 3 December 2024 on the protection of personal data replaced the 1993 law on nominative information. It applies to controllers and processors established in Monaco and to some established elsewhere that serve people in the Principality. It covers records of processing, processor contracts, security, breach notification and transfers. Confirm how it applies to your processing with your counsel or the APDP.
Who regulates data protection in Monaco?
The Autorité de Protection des Données Personnelles, known as the APDP, is the independent administrative authority that checks that personal data is processed lawfully. Its plenary formation investigates and can issue formal notices, while a separate restricted formation decides sanctions after an adversarial procedure. The APDP also publishes practical sheets, forms and model registers for organisations.
Are certification audits in Monaco conducted in French?
Often, yes, though it depends on the certification body and the people interviewed. French is the State's official language under Article 8 of the Constitution, and legislation and regulator guidance appear in French, so controlled documents are usually French. Agree the audit language and any interpreter with the certification body at application.
Is HACCP a legal requirement for Monaco food businesses?
Yes, for businesses working after primary production. The 2008 hygiene ordinance, in its Article 5, makes hazard-based permanent procedures a legal duty, with written records the competent authority can inspect. Establishments are approved by the Minister of State after an on-site inspection.
Which authority supervises banks and fund managers in Monaco?
The Commission de Contrôle des Activités Financières is the independent authority supervising financial activities in the Principality. It grants approvals to credit institutions, management companies, multi family offices and domestic funds, and carries out off-site and on-site checks. Its mission page names no ISO standard, so ask the CCAF what evidence it expects from your firm.
Which accreditation do certificates for Monaco organisations usually carry?
No Monegasque accreditation body is recorded in this file, so certification bodies serving Monaco usually hold accreditation from a body in another economy within the international mutual recognition arrangements. Monaco's health data hosting order, for example, names the French accreditation committee for certification bodies verifying the French HDS referential, and the Environment Code names it for emission measurements at incineration plants. The buyer or regulator decides which accreditation it accepts.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles — legimonaco.mc; apdp.mc (accessed 18 Oct 2026)
- Autorité de Protection des Données Personnelles (APDP) guidance and enforcement — apdp.mc (accessed 18 Oct 2026)
- Loi n° 1.330 du 8 janvier 2007 relative à la sécurité alimentaire; Ordonnance Souveraine n° 1.940 du 6 novembre 2008 relative à l'hygiène des denrées alimentaires, whose Article 5 requires permanent procedures based on the HACCP principles; Arrêté Ministériel n° 2017-102 du 1er mars 2017 on hygiene rules for retail, storage and transport, which refers to HACCP-based hygiene guides and validated hazard analyses. HACCP is a legal duty here, not an optional certificate. The ordinance applies at every stage of production, processing and distribution and to exports, requires the cold chain to be maintained and requires operators to notify each establishment to the authority. — legimonaco.mc; journaldemonaco.gouv.mc (accessed 18 Oct 2026)
- The CCAF's site describes it as the independent administrative authority supervising financial activities in the Principality, covering portfolio and fund management, advice, order reception and transmission, and custody account keeping. It grants approvals to credit institutions, management companies, multi family offices and domestic funds, checks them off-site and on site, and can sanction. Its site lists Law No. 1.338 and Sovereign Ordinance No. 1.284 among its governing texts and names no ISO standard on its mission page. — ccaf.mc (accessed 18 Oct 2026)
- Loi n° 1.435 du 8 novembre 2016 relative à la lutte contre la criminalité technologique; Arrêté Ministériel n° 2018-1053 du 8 novembre 2018 on security rules for the information systems of operators of vital importance; Arrêté Ministériel n° 2023-394 du 3 juillet 2023 listing the vital sectors and the designation criteria. Operators and State services must tell AMSN without delay of incidents affecting their information systems. The AMSN page names no ISO standard. — amsn.gouv.mc (accessed 18 Oct 2026)
- Ordonnance Souveraine n° 8.337 du 5 novembre 2020 on personal health data produced or received by health professionals and establishments, and Arrêté Ministériel n° 2020-764 du 5 novembre 2020, which sets the requirements to qualify health data hosts. The AMSN Director qualifies a host after checks against the AMSN PINH referential at advanced level, made by an information-security audit provider, and against the French HDS referential, verified by a certification body accredited by the French accreditation committee and approved by AMSN. An annual surveillance audit follows. The order names these referentials, not an ISO standard. — amsn.gouv.mc; legimonaco.mc (accessed 18 Oct 2026)
- Loi n° 537 du 12 mai 1951 relative à l'inspection du travail: labour inspection ensures that the legal provisions on working conditions and the protection of workers are applied. The Government's service page says inspectors enforce labour law and the law on health and safety at work, help prevent accidents, and carry out inspection visits on building sites, in premises open to the public, in industrial and commercial premises and at the scene of serious accidents at work. No ISO standard is cited. — legimonaco.mc; monservicepublic.gouv.mc (accessed 18 Oct 2026)
- Code de l'environnement, created by Loi n° 1.456 du 12 décembre 2017. For incineration and co-incineration installations, article O. 414-2-12 (created by Ordonnance Souveraine n° 11.931 du 21 mai 2026) requires the operator to apply an environmental management system; installations whose system is certified to NF EN ISO 14001 by an accredited body are treated as meeting those requirements. The provision is specific to that installation type. — legimonaco.mc (accessed 18 Oct 2026)
- Arrêté Ministériel n° 2018-613 du 26 juin 2018 on the thermal characteristics of new buildings, refurbishments and extensions, amended in December 2020. The Government's energy transition site describes the building energy audit: a detailed analysis of a building's energy performance, carried out by a company holding the stated qualification or an equivalent, whose summary or full report accompanies sale and lease contracts on a schedule by building age. No ISO standard is cited. — transition-energetique.gouv.mc; legimonaco.mc (accessed 18 Oct 2026)
- The AMSF's site publishes guidelines, practical guides and training for the professionals it supervises, a yachting practical guide for 2026 and an annual activity report for 2025, and describes a national coordination committee for the strategy against money laundering and corruption. It names no ISO standard. — amsf.mc (accessed 18 Oct 2026)
- Comité français d'accréditation (the French accreditation committee), as named in Monaco's own rules — legimonaco.mc (accessed 18 Oct 2026)
- State public procurement under Ordonnance Souveraine n° 7.264 du 20 décembre 2018 — legimonaco.mc (accessed 18 Oct 2026)
- Pre-selection register for State building and public works contractors under Arrêté Ministériel n° 2022-708 — legimonaco.mc (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice