Where we work · Norway
ISO and GRC certification consulting in Norway
Achieve ISO and GRC certification in Norway with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Norway
Clients include
ISO and GRC certification in Norway at a glance
Norway sits outside the European Union but inside the European Economic Area, so much of its compliance landscape matches that of EU member states. Datatilsynet supervises the GDPR, which has applied since 20 July 2018 alongside the Personal Data Act. Finanstilsynet enforces the DORA-loven, in force from 1 July 2025, while the Nasjonal sikkerhetsmyndighet (NSM) receives incident notifications under the Digital Security Act. Mattilsynet, Havtil, Arbeidstilsynet, Luftfartstilsynet and the Norwegian Medical Products Agency shape food, offshore, work environment, aviation and medical device work, and Nkom coordinates the AI Act. Public buyers follow the procurement rules explained by DFØ, which require them to accept equivalent EEA certificates. Demand is strongest in IT and digital services, financial services, the public sector, healthcare and medical technology, offshore energy supply chains, food and seafood, and aerospace and manufacturing suppliers. Certificates come from certification bodies accredited by Norsk akkreditering, the national accreditation body, never from Sterling. Sterling's Enschede office serves Norwegian clients on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Norway
Each page covers who needs the standard in Norway, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Norway (15)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) as applied in Norway through the EEA Agreement and the Personal Data Act Datatilsynet (the Norwegian Data Protection Authority) — an independent body set up in 1980, administratively subordinate to the Ministry of Digitalisation and Public Governance | Datatilsynet states that Norway is not an EU member but a member of the EEA, that the GDPR was incorporated into the EEA Agreement and became applicable in Norway on 20 July 2018, and that Norway is bound by it in the same manner as EU member states. The Personal Data Act (personopplysningsloven) contains the Norwegian adaptations. It applies when establishments in Norway process personal data, and directly to businesses outside the EU/EEA whose processing relates to offering goods or services to people in Norway or monitoring their behaviour, which must appoint a representative in the EU/EEA. Both the Act and the EEA Act give the GDPR priority over Norwegian law in a conflict. | |
| Codes of conduct and certification under the GDPR (Articles 40 to 43) Datatilsynet approves codes of conduct and certification criteria; certification and monitoring bodies are accredited by Datatilsynet or by Norsk akkreditering | Datatilsynet describes codes of conduct and certification mechanisms as voluntary tools to help organisations show compliance. Certification is mainly relevant at enterprise level and codes at industry level. Certification and monitoring bodies must be accredited by Datatilsynet or Norsk akkreditering (or by the equivalent authorities elsewhere in the EEA). This is the accreditation framework for GDPR certification bodies; it does not make the GDPR itself a certifiable standard. | |
| Nasjonal sikkerhetsmyndighet (NSM), with the sector supervisor of the provider's sector Providers of essential societal services and digital services — digital security | Digitalsikkerhetsloven and its regulation — NSM describes the law as aimed at two categories of provider, those offering essential societal services and those offering digital services; covered providers must notify incidents, and essential-service providers must register with NSM and their sector supervisor. | |
| Nasjonal sikkerhetsmyndighet (NSM) Public bodies and others protecting ICT systems | NSM's ICT security principles (Grunnprinsipper for IKT-sikkerhet) — NSM's list of management frameworks names ISO/IEC 27001 as an international standard for information security management, and ISO/IEC 27002 among control frameworks. | ISO/IEC 27001 |
| Helsedirektoratet, through the steering group for the Norm for informasjonssikkerhet og personvern i helse- og omsorgssektoren (Normen), version 7.0 Health and care sector — information security and privacy | Normen applies to any organisation that has committed by agreement to follow it; its annex of requirements is cross-referenced to ISO 27001 and ISO 27002, and Helsedirektoratet points to NS-ISO/IEC 27701 as a tool for integrating privacy into the management system. | ISO/IEC 27001, ISO/IEC 27701 |
| Finanstilsynet Financial entities — digital operational resilience | Lov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven) — Finanstilsynet states that it came into force on 1 July 2025, implements Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556, covers ICT risk management, incident reporting, testing, ICT service contracts and follow-up of ICT providers, and replaces the ICT regulation for many supervised firms. | |
| Mattilsynet (the Norwegian Food Safety Authority) Food businesses | Internal control (internkontroll) for food safety — Mattilsynet states that all food businesses must have internal control, that a hazard assessment based on HACCP is mandatory for all food businesses, that the requirement is flexible, and that Mattilsynet supervises it. | HACCP |
| Havtil (the Norwegian Ocean Industry Authority; the Petroleum Safety Authority Norway until it was renamed on 1 January 2024) Petroleum, offshore wind, carbon transport and storage, and seabed minerals — safety | Havtil states that it holds regulatory authority for carbon transport and storage (from 2018), offshore renewable energy (from 2020) and seabed minerals (from 2022), in addition to petroleum safety, with responsibilities under the Security Act added in 2023. | |
| Arbeidstilsynet Employers — systematic health, environment and safety work | Internkontrollforskriften (regulation on systematic health, environment and safety work in enterprises) — Arbeidstilsynet states that the head of the enterprise has a duty to follow up health, environment and safety requirements systematically, in cooperation with employees and their representatives. | |
| Direktoratet for medisinske produkter (the Norwegian Medical Products Agency, DMP) Medical device manufacturers and distributors | Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), applied through the EEA Agreement, with Norwegian provisions in section 6-16 of the regulation on medical devices; DMP states that the manufacturer is legally responsible for safety and efficacy and that a notified body assesses certain risk classes. | |
| Luftfartstilsynet (Civil Aviation Authority Norway) Aviation maintenance and airworthiness organisations | Luftfartstilsynet publishes the list of Part-145 approved maintenance organisations in Norway and handles Part-21 airworthiness matters. | |
| Forbrukertilsynet (the Norwegian Consumer Authority) Larger enterprises — supply chain due diligence | Åpenhetsloven (the Transparency Act) — Forbrukertilsynet states that it applies to larger enterprises resident in Norway and to larger foreign enterprises taxable to Norway, requiring due diligence in line with the OECD guidelines for multinational enterprises, a published account and answers to information requests; amendments took effect on 1 November 2024. | |
| Nasjonal kommunikasjonsmyndighet (Nkom) Artificial intelligence | Nkom's page of 24 March 2026 states that the Norwegian government has decided that Nkom is the coordinating market surveillance authority and national contact point for the EU AI Act in Norway. | |
| Enova Energy management | Enova's guidance on standards for energy management recommends NS-EN ISO 50001 and presents certification as a step for organisations that have already started; Standard Norge owns the Norsk Standard mark and runs the standardisation process. | ISO 50001 |
| Økokrim (the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime) Bribery and corruption | Straffeloven § 387 — Økokrim states that the provision defines corruption in criminal law as giving, offering, demanding, receiving or accepting an undue advantage in connection with a position, office or assignment, and that it does not distinguish between private and public corruption. |
Accreditation and recognition
- Norsk akkreditering (Norwegian Accreditation): National accreditation body — a governmental body established by the Ministry of Trade, Industry and Fisheries in accordance with EU Regulation 765; it accredits laboratories, inspection bodies, certification bodies, verification bodies, proficiency testing providers and reference material producers, and it accredits environmental verifiers under EMAS. It states that it has signed the EA multilateral agreements covering calibration and testing laboratories, certification bodies for products, personnel and management systems, inspection bodies, verification and validation bodies, proficiency testing providers and reference material producers, that EA evaluates it at intervals of at most four years, and that it is a member of ILAC and a signatory of the international arrangements for certification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Anskaffelsesforskriften § 16-7 — quality assurance and environmental management certificates (as explained in DFØ's guide to the procurement regulations) (DFØ (Direktoratet for forvaltning og økonomistyring), which publishes the guidance; contracting authorities apply the regulation): DFØ explains that a contracting authority may require certificates from independent bodies showing that a supplier meets stated quality assurance or environmental management standards, citing ISO 9001:2015 as an example of a quality assurance standard and EMAS, Eco-Lighthouse (Miljøfyrtårn) and EN ISO 14001 as environmental examples. For environmental management the authority must refer to EMAS, other recognised systems or standards based on European or international standards from accredited bodies, and must accept equivalent certificates from bodies in other EEA states. DFØ adds that such a requirement must be relevant and proportionate and can exclude small and medium-sized suppliers.
- Environmental management systems as a qualification requirement in public procurement (DFØ (Anskaffelser.no guidance)): DFØ's guide on environmental labels and environmental management systems states that an authority requiring an environmental management system or standard as such must refer to EMAS, ISO 14001 or Eco-Lighthouse, and must accept any of them even if it names only one, as well as other systems based on European or international standards. Each tender sets its own requirements.
Sterling in Norway
Sterling delivers in Norway from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Norway, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Norwegian clients ask
Are certification audits in Norway conducted in Norwegian or English?
Usually either, as agreed with the certification body when you apply. Public bodies work in Norwegian while English is common in business, so decide the language for the audit and for controlled documents at the outset. Certain sector rules divide the two, as the medical device provisions do, and any tender or contract language clause overrides what you would prefer.
Does the GDPR apply in Norway if Norway is not in the EU?
Yes. Datatilsynet explains that Norway belongs to the EEA rather than the EU, that the GDPR was incorporated into the EEA Agreement and has applied since 20 July 2018, and that Norway is bound by it in the same way as EU member states. The Personal Data Act adds the Norwegian adaptations. Confirm any edge case with counsel or Datatilsynet.
Which body accredits management-system certification bodies in Norway?
Norsk akkreditering, the national accreditation body established under EU Regulation 765. It states that it has signed the EA multilateral agreements for management-system certification bodies and is evaluated by EA at intervals of at most four years. Its public register shows the standards in each body's scope, so compare that scope with the standard you need.
Can a Norwegian public buyer require ISO certificates from suppliers?
It can, within limits. DFØ explains that an authority may ask for certificates from independent bodies for quality assurance or environmental management, must accept equivalent certificates from other EEA states, and must keep the requirement relevant and proportionate. For environmental systems it must accept EMAS, ISO 14001 or Eco-Lighthouse alike. Whether a certificate is required is for each tender to say.
Who coordinates enforcement of the EU AI Act in Norway?
Nkom has that role. According to its page of 24 March 2026 the government decided that Nkom coordinates market surveillance and serves as the national contact point under the AI Act, alongside sector supervisors. Datatilsynet remains the supervisor for personal data, including data used in AI systems, so one project can involve two regulators.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) as applied in Norway through the EEA Agreement and the Personal Data Act — datatilsynet.no (accessed 11 Oct 2026)
- Codes of conduct and certification under the GDPR (Articles 40 to 43) — datatilsynet.no (accessed 11 Oct 2026)
- Digitalsikkerhetsloven and its regulation — nsm.no (accessed 11 Oct 2026)
- NSM's ICT security principles (Grunnprinsipper for IKT-sikkerhet) — nsm.no (accessed 11 Oct 2026)
- Normen applies to any organisation that has committed by agreement to follow it; its annex of requirements is cross-referenced to ISO 27001 and ISO 27002, and Helsedirektoratet points to NS-ISO/IEC 27701 as a tool for integrating privacy into the management system — helsedirektoratet.no (accessed 11 Oct 2026)
- Lov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven) — finanstilsynet.no (accessed 11 Oct 2026)
- Internal control (internkontroll) for food safety — mattilsynet.no (accessed 11 Oct 2026)
- Havtil states that it holds regulatory authority for carbon transport and storage (from 2018), offshore renewable energy (from 2020) and seabed minerals (from 2022), in addition to petroleum safety, with responsibilities under the Security Act added in 2023 — havtil.no (accessed 11 Oct 2026)
- Internkontrollforskriften (regulation on systematic health, environment and safety work in enterprises) — arbeidstilsynet.no (accessed 11 Oct 2026)
- Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), applied through the EEA Agreement, with Norwegian provisions in section 6-16 of the regulation on medical devices; DMP states that the manufacturer is legally responsible for safety and efficacy and that a notified body assesses certain risk classes — dmp.no (accessed 11 Oct 2026)
- Luftfartstilsynet publishes the list of Part-145 approved maintenance organisations in Norway and handles Part-21 airworthiness matters — luftfartstilsynet.no (accessed 11 Oct 2026)
- Åpenhetsloven (the Transparency Act) — forbrukertilsynet.no (accessed 11 Oct 2026)
- Nkom's page of 24 March 2026 states that the Norwegian government has decided that Nkom is the coordinating market surveillance authority and national contact point for the EU AI Act in Norway — nkom.no (accessed 11 Oct 2026)
- Enova's guidance on standards for energy management recommends NS-EN ISO 50001 and presents certification as a step for organisations that have already started; Standard Norge owns the Norsk Standard mark and runs the standardisation process — enova.no (accessed 11 Oct 2026)
- Straffeloven § 387 — okokrim.no (accessed 11 Oct 2026)
- Norsk akkreditering (Norwegian Accreditation) — akkreditert.no (accessed 11 Oct 2026)
- Anskaffelsesforskriften § 16-7 — quality assurance and environmental management certificates (as explained in DFØ's guide to the procurement regulations) — anskaffelser.no (accessed 11 Oct 2026)
- Environmental management systems as a qualification requirement in public procurement — anskaffelser.no (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice