Where we work · Montenegro
ISO and GRC certification consulting in Montenegro
Achieve ISO and GRC certification in Montenegro with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Montenegro
Clients include
In short
ISO and GRC certification in Montenegro at a glance
Montenegro's new Law on Personal Data Protection, published in Official Gazette No. 133/26, is supervised by the Agency for Personal Data Protection and Free Access to Information in Podgorica and replaces the earlier law. Beside it, the Law on Information Security (Official Gazette No. 113/2024) lists essential and important entities across energy, banking, health, digital infrastructure and manufacturing, and asks essential entities to meet MEST ISO/IEC 27001 with a certificate from an accredited legal person. Food businesses carry a HACCP duty under the Law on Food Safety (Official Gazette No. 59/2026), banks follow Central Bank decisions on information system risk and business continuity, and medical devices are registered with the Institute for Medicines and Medical Devices. EA's directory lists the Accreditation Body of Montenegro (ATCG) as an MLA signatory. Demand runs through tourism, energy, food, banking, ICT and public bodies. Sterling serves clients across Montenegro from its Frankfurt office, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement. Certificates come from accredited certification bodies, never from Sterling.
Explore
ISO and GRC standards Sterling delivers in Montenegro
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Montenegro (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama; the Agency) — the independent supervisory authority named in the Law, a legal person with its seat in Podgorica, competent to supervise processing by controllers and processors but not by courts acting in their judicial function | Applies to processing done wholly or partly by automated means and to personal data in, or meant for, a filing system, with exceptions for purely personal or household activity and for competent authorities acting to prevent, investigate or prosecute crime. It applies to controllers and processors established in Montenegro, and to those established elsewhere whose processing relates to offering goods or services to people in Montenegro or monitoring their behaviour there; such a controller or processor must appoint a representative in Montenegro in writing, with exceptions for occasional low-risk processing and for public bodies. Processing needs one of six bases: consent, a contract, a legal duty, vital interests, a public-interest task or official authority, or legitimate interests unless overridden by the person's rights (not open to public authorities in their tasks). The Law sets out the processing principles, notice and the rights of access, rectification, erasure, restriction, portability and objection, a processor contract and sub-processor authorisation, records of processing activities, security of processing, notification of a breach to the Agency without undue delay unless a risk is unlikely and to the person where the risk is high, an impact assessment before high-risk processing, and a data protection officer who is mandatory for public bodies, for core activities of regular and systematic large-scale monitoring and for large-scale special-category or criminal-offence data. Transfers abroad rely on an adequacy finding made by the Government after the Agency's opinion, or on safeguards such as binding corporate rules approved by the Agency, standard clauses adopted by the European Commission or adopted by the Agency and approved by the Commission, an approved code of conduct or an approved certification mechanism, or on the narrow exceptions the Law lists. Certification mechanisms are voluntary and do not reduce the controller's responsibility. | |
| Agency powers and transitional rules under the Law Agency for Personal Data Protection and Free Access to Information | The Agency advises public bodies and companies, decides on requests for protection of rights, carries out regular and extraordinary supervision, may require information and access to premises and data, warn, reprimand, order compliance, restrict or ban processing and supervise the certification process, and publishes lists of processing that does and does not need an impact assessment. The register of personal data filings kept under the earlier law stops being kept when the new Law starts to apply and is then handled under the rules for archival material. The Agency reviews its earlier approvals of transfers after the Law enters into force. Other laws that touch personal data are to be aligned with the Law by 1 December 2026, as the Law states. | |
| Agency for Cyber Security of Montenegro (Agencija za sajber bezbjednost Crne Gore), which protects the networks and information systems of public bodies and other entities other than state administration and carries out professional supervision of the measures; the ministry responsible for the information society and e-government (the Agency's page links the Ministry of Public Administration) acts as the single national point of contact and runs the CIRT of state administration Essential and important entities in energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management, public administration, food, chemicals, manufacturing and other listed sectors | Law on Information Security (Zakon o informacionoj bezbjednosti), Official Gazette of Montenegro No. 113/2024 of 27 November 2024, which the Agency's published text records as in force from 5 December 2024 and footnotes as aligned with Directive (EU) 2022/2555 (the NIS2 Directive). Essential entities (including critical infrastructure operators and sectors such as energy, transport, banking, health, water, digital infrastructure, ICT service management and public administration) and important entities (including postal services, waste, chemicals, food production, manufacturing of medical devices, electronics, machinery and motor vehicles, online marketplaces and research) are listed by Government decision. Entities must apply data protection and cyber protection measures, and essential and important entities must also manage cyber risk through a risk analysis, incident rules, a business continuity and cyber crisis plan, a supply chain security act, system development and maintenance rules, cryptography where needed and rules for assessing the measures. Incidents that may affect service continuity are notified to the Agency on a prescribed form. Essential entities must meet the requirements of the Montenegrin standard MEST ISO/IEC 27001, evidenced by a certificate from an accredited legal person, must ask for periodic verification, and must obtain the certificate within the period the Law's transitional provisions set after its entry into force. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Central Bank of Montenegro (Centralna banka Crne Gore; CBCG), which issues decisions for credit institutions under the Law on the Central Bank and the Law on Credit Institutions Banks and other credit institutions | Decision on minimum standards for risk management in credit institutions, adopted by the CBCG Council on 22 December 2021 and amended since, as CBCG's page on bank supervision regulations lists. It requires an organisation that manages the information system, information system risk and business continuity, an information security policy covering confidentiality, integrity and availability, logical and physical security, monitoring and testing of security, incident and problem management, controls over third-party IT services, and a business continuity process built on a business impact analysis, a business continuity plan and a disaster recovery plan that considers cyber-attack scenarios. A separate Decision on managing outsourcing and the risks arising from it (Official Gazette Nos. 127/20 and 112/25) asks banks to assess ICT and compliance risks and the provider's data protection, continuity and IT security standards. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Central Bank of Montenegro, which the Central Bank's payments page names as responsible for payment operations and authorised to regulate, supervise and improve them Payment services, payment institutions and electronic money | Law on Payment Operations (Zakon o platnom prometu), which the Central Bank describes as regulating payment services, information duties, the rights and duties of providers and users, and the work and supervision of payment institutions, electronic money institutions and payment systems; the Central Bank keeps registers of payment systems, payment institutions and their agents, and electronic money institutions and their agents. The page does not name PCI DSS, which card schemes and acquirers require by contract. | PCI DSS, ISO/IEC 27001 |
| Administration for Food Safety, Veterinary and Phytosanitary Affairs (Uprava za bezbjednost hrane, veterinu i fitosanitarne poslove), which organises and carries out official controls and inspection of food, feed and animal by-products and keeps the central register of registered and approved establishments Food business operators, food processing and food exports | Law on Food Safety (Zakon o bezbjednosti hrane), Official Gazette of Montenegro No. 59/2026 of 4 May 2026, which the Administration states entered into force and replaced the previous law. It covers every stage of production, processing and distribution from farm to table. A food business operator must establish, apply and keep up procedures based on HACCP principles at all stages after primary production, with hazard identification, critical control points, limits, monitoring, corrective action, verification and records, and must prove conformity to the competent authority on request; where no critical control point can be identified the operator must apply good hygiene practice instead. Establishments work only when registered or approved, and approval involves an inspection commission that checks the HACCP-based self-control system. | HACCP, ISO 22000, FSSC 22000 |
| Institute for Medicines and Medical Devices of Montenegro (CInMED; Institut za ljekove i medicinska sredstva), which describes itself as the independent regulatory body for medicines and medical devices Medical devices, medicines and pharmaceutical supply | Law on Medical Devices, under which CInMED registers a medical device for which conformity assessment has been carried out, by entry in the register of medical devices, before it is placed on the market or put into use. The applicant is a manufacturer established in Montenegro or its authorised representative, or, for a manufacturer without a seat in Montenegro, its authorised representative. CInMED also publishes notices on how it recognises declarations of conformity and EC certificates while national law moves from the EU directives on medical devices to the EU regulations, and runs an inspectorate for good manufacturing and distribution practice and a laboratory. Its pages do not name ISO 13485. | ISO 13485 |
| Agency for Prevention of Corruption (Agencija za sprječavanje korupcije), which its integrity pages present as the body receiving integrity plans Public bodies and their suppliers (integrity and anti-corruption) | Law on Prevention of Corruption (Official Gazette No. 54/24 of 11 June 2024) and the Rules on preparing and implementing the integrity plan (Official Gazette No. 100/24 of 18 October 2024): public authorities adopt an integrity plan based on an assessment of corruption risk in posts and processes, appoint an integrity manager and send the plan to the Agency. The pages do not name ISO 37001 or ISO 37301. | ISO 37001, ISO 37301 |
| Ministry of Energy and Mining (Ministarstvo energetike i rudarstva) Energy and large energy consumers | Law on Efficient Use of Energy, in the consolidated text published on the Government portal (Official Gazette Nos. 57/14, 3/15 and 25/19): a large consumer, defined by its main activity in manufacturing, trade or services and a primary energy consumption above the Law's threshold, must designate a person responsible for energy management, plan and carry out efficiency measures and report on them to the Ministry, and keep records of energy and water consumption. The Ministry's page also reports on energy investment projects, including a wind farm. The text does not name ISO 50001, and later changes to the Law should be checked with the Ministry. | ISO 50001, ISO 14001 |
| Ministry of Tourism (Ministarstvo turizma), whose tasks include tourism offer, conditions for doing business in tourism and its tourist inspection Tourism and hospitality | The Ministry reported on 13 October 2026 that priority tourism investment projects were presented at an investment forum and that a publication, Tourism Doing Business: Investing in Montenegro, was presented; the Ministry's pages list measures supporting infrastructure and service quality in rural tourism, camps and smart destinations. These pages describe policy and investment support and do not name a management system standard. | ISO 9001, ISO 14001, ISO 22000 |
| Customs Administration (Uprava carina) Exporters and importers using customs simplifications | The Customs Administration's portal lists simplified procedures, which it describes as measures that ease and speed up clearance for economic operators that meet conditions of reliability, and a page on the authorised economic operator (AEO) status. The portal does not name a management system standard. | |
| Institute for Standardisation of Montenegro (ISME; Institut za standardizaciju Crne Gore), established by a Government decision of 29 March 2007 (Official Gazette of the Republic of Montenegro No. 21/2007) as the national standardisation body Standards (Montenegrin national standards, MEST) | ISME adopts, develops, reviews, amends and withdraws Montenegrin (MEST) standards and related documents, keeps them in line with international and European standards, keeps the register of Montenegrin standards, takes part in European and international standardisation and makes standards available to the public and sells them. The Law on Information Security names the Montenegrin standard MEST ISO/IEC 27001. | ISO 9001, ISO 14001, ISO/IEC 27001 |
Accreditation and recognition
- Accreditation Body of Montenegro (ATCG): National accreditation body, listed in EA's directory under Montenegro.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Sterling in Montenegro
Sterling delivers in Montenegro from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Montenegro clients ask
Does Montenegro have a new personal data protection law and who supervises it?
Yes. The Law on Personal Data Protection was published in Official Gazette No. 133/26 of 11 September 2026 and ends the validity of the earlier law, except its video surveillance provisions. The Agency for Personal Data Protection and Free Access to Information, seated in Podgorica, supervises it. Ask the Agency or your counsel when the Law starts to apply to you.
Does Montenegrin law require ISO 27001 certification?
For essential entities, yes in effect. The Law on Information Security (Official Gazette No. 113/2024) says essential entities must meet MEST ISO/IEC 27001, hold a certificate from an accredited legal person, and request periodic verification, within the period its transitional provisions set. Other entities apply the protection measures without that certificate. Check with counsel whether you are listed as essential or important.
Who is the accreditation body in Montenegro and what does it cover?
The Accreditation Body of Montenegro (ATCG) is listed in EA's directory as an MLA signatory, with calibration, testing, medical examination, product certification and inspection among its scopes. Management system certification is not among the scopes listed, so ask a certification body for the accreditation certificate behind your certificate and check that the scope covers your standard and sector.
Is HACCP compulsory for food businesses in Montenegro?
Yes, as a legal duty rather than a voluntary certificate. A food business must keep its own written procedures built on the seven HACCP principles from the stage after primary production, show them to inspectors when asked, and fall back on good hygiene practice only if no critical control point exists. Premises sit in a central register. A HACCP certificate is a separate commercial option; the food safety administration can confirm your route.
Do medical devices have to be registered in Montenegro?
Yes. The Institute for Medicines and Medical Devices (CInMED) registers a device for which conformity assessment has been carried out, and the applicant is a manufacturer established in Montenegro or its authorised representative. CInMED's pages do not name ISO 13485, so ask the Institute what evidence it expects for your device class.
In which language is an ISO audit run in Montenegro?
Expect Montenegrin for dealings with authorities and English for many commercial audits. Documents may be in Latin or Cyrillic script. Before the stage one visit, tell the certification body which languages your records, procedures and staff use, so auditors and any interpreter are chosen to match. A buyer, regulator or contract can require a particular language, which overrides your preference.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) — azlp.me (accessed 18 Oct 2026)
- Agency powers and transitional rules under the Law — azlp.me (accessed 18 Oct 2026)
- Law on Information Security (Zakon o informacionoj bezbjednosti), Official Gazette of Montenegro No. 113/2024 of 27 November 2024, which the Agency's published text records as in force from 5 December 2024 and footnotes as aligned with Directive (EU) 2022/2555 (the NIS2 Directive). Essential entities (including critical infrastructure operators and sectors such as energy, transport, banking, health, water, digital infrastructure, ICT service management and public administration) and important entities (including postal services, waste, chemicals, food production, manufacturing of medical devices, electronics, machinery and motor vehicles, online marketplaces and research) are listed by Government decision. Entities must apply data protection and cyber protection measures, and essential and important entities must also manage cyber risk through a risk analysis, incident rules, a business continuity and cyber crisis plan, a supply chain security act, system development and maintenance rules, cryptography where needed and rules for assessing the measures. Incidents that may affect service continuity are notified to the Agency on a prescribed form. Essential entities must meet the requirements of the Montenegrin standard MEST ISO/IEC 27001, evidenced by a certificate from an accredited legal person, must ask for periodic verification, and must obtain the certificate within the period the Law's transitional provisions set after its entry into force — wapi.gov.me; gov.me (accessed 18 Oct 2026)
- Decision on minimum standards for risk management in credit institutions, adopted by the CBCG Council on 22 December 2021 and amended since, as CBCG's page on bank supervision regulations lists. It requires an organisation that manages the information system, information system risk and business continuity, an information security policy covering confidentiality, integrity and availability, logical and physical security, monitoring and testing of security, incident and problem management, controls over third-party IT services, and a business continuity process built on a business impact analysis, a business continuity plan and a disaster recovery plan that considers cyber-attack scenarios. A separate Decision on managing outsourcing and the risks arising from it (Official Gazette Nos. 127/20 and 112/25) asks banks to assess ICT and compliance risks and the provider's data protection, continuity and IT security standards — cbcg.me (accessed 18 Oct 2026)
- Law on Payment Operations (Zakon o platnom prometu), which the Central Bank describes as regulating payment services, information duties, the rights and duties of providers and users, and the work and supervision of payment institutions, electronic money institutions and payment systems; the Central Bank keeps registers of payment systems, payment institutions and their agents, and electronic money institutions and their agents. The page does not name PCI DSS, which card schemes and acquirers require by contract — cbcg.me (accessed 18 Oct 2026)
- Law on Food Safety (Zakon o bezbjednosti hrane), Official Gazette of Montenegro No. 59/2026 of 4 May 2026, which the Administration states entered into force and replaced the previous law. It covers every stage of production, processing and distribution from farm to table. A food business operator must establish, apply and keep up procedures based on HACCP principles at all stages after primary production, with hazard identification, critical control points, limits, monitoring, corrective action, verification and records, and must prove conformity to the competent authority on request; where no critical control point can be identified the operator must apply good hygiene practice instead. Establishments work only when registered or approved, and approval involves an inspection commission that checks the HACCP-based self-control system — wapi.gov.me; gov.me (accessed 18 Oct 2026)
- Law on Medical Devices, under which CInMED registers a medical device for which conformity assessment has been carried out, by entry in the register of medical devices, before it is placed on the market or put into use. The applicant is a manufacturer established in Montenegro or its authorised representative, or, for a manufacturer without a seat in Montenegro, its authorised representative. CInMED also publishes notices on how it recognises declarations of conformity and EC certificates while national law moves from the EU directives on medical devices to the EU regulations, and runs an inspectorate for good manufacturing and distribution practice and a laboratory. Its pages do not name ISO 13485 — cinmed.me (accessed 18 Oct 2026)
- Law on Prevention of Corruption (Official Gazette No. 54/24 of 11 June 2024) and the Rules on preparing and implementing the integrity plan (Official Gazette No. 100/24 of 18 October 2024): public authorities adopt an integrity plan based on an assessment of corruption risk in posts and processes, appoint an integrity manager and send the plan to the Agency. The pages do not name ISO 37001 or ISO 37301 — antikorupcija.me (accessed 18 Oct 2026)
- Law on Efficient Use of Energy, in the consolidated text published on the Government portal (Official Gazette Nos. 57/14, 3/15 and 25/19): a large consumer, defined by its main activity in manufacturing, trade or services and a primary energy consumption above the Law's threshold, must designate a person responsible for energy management, plan and carry out efficiency measures and report on them to the Ministry, and keep records of energy and water consumption. The Ministry's page also reports on energy investment projects, including a wind farm. The text does not name ISO 50001, and later changes to the Law should be checked with the Ministry — gov.me (accessed 18 Oct 2026)
- The Ministry reported on 13 October 2026 that priority tourism investment projects were presented at an investment forum and that a publication, Tourism Doing Business: Investing in Montenegro, was presented; the Ministry's pages list measures supporting infrastructure and service quality in rural tourism, camps and smart destinations. These pages describe policy and investment support and do not name a management system standard — gov.me (accessed 18 Oct 2026)
- The Customs Administration's portal lists simplified procedures, which it describes as measures that ease and speed up clearance for economic operators that meet conditions of reliability, and a page on the authorised economic operator (AEO) status. The portal does not name a management system standard — gov.me (accessed 18 Oct 2026)
- ISME adopts, develops, reviews, amends and withdraws Montenegrin (MEST) standards and related documents, keeps them in line with international and European standards, keeps the register of Montenegrin standards, takes part in European and international standardisation and makes standards available to the public and sells them. The Law on Information Security names the Montenegrin standard MEST ISO/IEC 27001 — isme.me (accessed 18 Oct 2026)
- Accreditation Body of Montenegro (ATCG) — european-accreditation.org (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice