Where we work · Portugal
ISO and GRC certification consulting in Portugal
Achieve ISO and GRC certification in Portugal with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Portugal
Clients include
ISO and GRC certification in Portugal at a glance
Portuguese demand for ISO and GRC certification is shaped by a new cyber regime and an established accreditation system. The Centro Nacional de Cibersegurança administers the Regime Jurídico da Cibersegurança, approved by Decreto-Lei n.º 125/2025 as the NIS2 transposition, and its 2026 regulation lets an ISO/IEC 27001 certificate from an accredited body support a presumption of compliance. The Comissão Nacional de Proteção de Dados supervises the GDPR under Lei n.º 58/2019. Banco de Portugal, the CMVM and the insurance supervisor act on DORA, Infarmed oversees medical devices, and DGAV expects HACCP-based procedures in food businesses. IPAC, the national accreditation body, stands behind accredited certificates, which only certification bodies issue. Demand is strongest among shared-services and digital firms working for foreign clients, automotive component makers, food producers, health and aerospace suppliers and renewable energy businesses. Sterling serves Portuguese clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Portugal
Each page covers who needs the standard in Portugal, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Portugal (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and Lei n.º 58/2019 Comissão Nacional de Proteção de Dados (CNPD) — the Act makes it the national supervisory authority for the GDPR and for the Act | The Act gives the GDPR effect in Portugal. It describes the CNPD as an independent administrative body with public-law powers that works alongside the Assembleia da República and monitors compliance with the GDPR, the Act and other data protection rules. Beyond the tasks the GDPR lists, the Act has the CNPD publish a list of processing that needs an impact assessment and encourage codes of conduct. | |
| Accreditation of data protection certification bodies IPAC as the authority competent to accredit data protection certification bodies; the CNPD sets additional requirements that IPAC must take into account | The Act names IPAC as the accrediting authority for bodies that certify data protection processing, says the accreditation must reflect the GDPR and the CNPD's additional requirements, and says certification, seals and marks are issued by bodies accredited in that way. The GDPR itself says such certification is voluntary and does not reduce a controller's or processor's responsibility. | |
| Centro Nacional de Cibersegurança (CNCS), within the Gabinete Nacional de Segurança, as national cybersecurity authority, national certification authority and host of the national CSIRT; ANACOM as sector authority for electronic communications and postal services and the GNS for trust services Essential, important and relevant public entities under the cybersecurity legal regime (the NIS2 transposition) | Decreto-Lei n.º 125/2025, de 4 de dezembro (Diário da República, 1.ª série, n.º 234, 4 December 2025), which approves the Regime Jurídico da Cibersegurança and transposes Directive (EU) 2022/2555; it has entered into force under its final article. The CNCS implementing Regulamento n.º 756/2026 (2.ª série, n.º 118, 22 June 2026) entered into force the day after publication. Under the decree-law's article on effects, the provisions on cybersecurity measures, supply-chain security, residual risk, the annual report and the measures for relevant public entities take effect only a set period after the implementing regulation is published. Its voluntary-certification provision lets essential and important entities benefit from a presumption of compliance when they present a certificate from a duly accredited certification body: ISO/IEC 27001 is listed where the scope fully covers the networks and information systems behind the regulated services, alongside the national scheme EC QNRCS and other schemes the national authority approves. The national reference framework QNRCS draws on NIST CSF 2.0, CyFun, ISO/IEC 27001:2022, ISO/IEC 27002:2022, CIS Controls v8.1 and NIST SP 800-53 Rev.5. | ISO/IEC 27001 |
| Banco de Portugal, the Comissão do Mercado de Valores Mobiliários (CMVM) and the Autoridade de Supervisão de Seguros e Fundos de Pensões, named as special cybersecurity authorities for the digital operational resilience of the financial sector Financial entities (banks, payment and e-money institutions, insurers and other entities in DORA's scope) | Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 according to its final article, and the allocation of authorities in Decreto-Lei n.º 125/2025. DORA covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. It does not name ISO/IEC 27001 or ISO 22301. | |
| INFARMED — Autoridade Nacional do Medicamento e Produtos de Saúde, I.P. Medical device manufacturers, importers and distributors | Regulations (EU) 2017/745 and 2017/746 on medical devices and in vitro diagnostic devices. Infarmed says CE marking is a precondition for placing a device on the EU market, that higher-risk classes need a notified body, that a manufacturer may choose any designated notified body whatever its Member State, and that Infarmed itself is the designating authority for notified bodies based in Portugal. Some conformity routes rest on a quality management system. The pages do not name ISO 13485. | |
| Direção-Geral de Alimentação e Veterinária (DGAV) Food businesses | Regulation (CE) n.º 852/2004 on food hygiene. DGAV's page says food business operators create, apply and maintain permanent procedures based on the HACCP principles and points to the European Commission's notice on implementing food safety management systems, including flexibility for some businesses. The page does not mention a third-party certificate. | HACCP |
| Direção-Geral de Energia e Geologia (DGEG) Large energy users and non-SME companies (energy audits and management systems) | Decreto-Lei n.º 71/2008, de 15 de abril (SGCIE), amended by Lei n.º 7/2013 and Decreto-Lei n.º 68-A/2015, de 30 de abril. DGEG says the SGCIE applies to installations consuming at or above 500 tep a year and requires periodic energy audits and rationalisation plans. Decreto-Lei n.º 68-A/2015 releases companies that are not SMEs from the periodic energy-audit duty when they run an energy or environmental management system certified by a body accredited under Regulation (CE) n.º 765/2008, provided the system's audits meet the decree's minimum criteria. Neither text names ISO 50001 or ISO 14001. | |
| Autoridade para as Condições do Trabalho (ACT) Employers (occupational safety and health) | Lei n.º 102/2009, de 10 de setembro, the legal regime for promoting occupational safety and health. It sets employer duties and the ways safety and health services are organised, and names the ACT. It does not name ISO 45001. | |
| Mecanismo Nacional Anticorrupção (MENAC), an independent administrative entity with powers of initiative, control and sanction Entities with 50 or more workers (corruption prevention and whistleblowing channels) | Decreto-Lei n.º 109-E/2021, de 9 de dezembro, which creates MENAC and the regime geral de prevenção da corrupção, and Lei n.º 93/2021, de 20 de dezembro, on whistleblower protection. The regime requires a compliance programme with a risk prevention plan, a code of conduct, a training programme and a whistleblowing channel, under a compliance officer. Neither law names ISO 37001, ISO 37301 or ISO 37002. | |
| ANACOM, listed by the European Commission as Portugal's single point of contact for AI Act market surveillance Providers and deployers of AI systems | The EU AI Regulation. The Commission's list, last updated in September 2026, shows ANACOM for Portugal and marks the national designation decision as still pending final adoption. The list does not name ISO/IEC 42001. |
Accreditation and recognition
- IPAC (Instituto Português de Acreditação, I.P.): National accreditation body — IPAC's general regulation says it holds that role under Regulation (EC) No 765/2008, with an organic law in Decreto-Lei n.º 81/2012, and accredits testing and calibration laboratories, clinical laboratories, inspection bodies, certification bodies and validation and verification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Código dos Contratos Públicos (public procurement code) and the Base portal (IMPIC (Instituto dos Mercados Públicos, do Imobiliário e da Construção) and contracting authorities): IMPIC publishes the updated Código dos Contratos Públicos, reflecting Decreto-Lei n.º 177/2026, on its portal and on the Base portal. Each tender sets its own qualification and award criteria, so whether ISO certificates count depends on the tender documents.
Economic zones
- Madeira's International Business Centre: international services, industrial free trade zone, ship registry
- Port of Sines and the Algarve ports: container handling, general cargo, port logistics
- Shared services and global business services sites: finance and procurement support, customer service, IT services, compliance and legal support
- Automotive components and mobility industry: automotive components, mobility
- Food and beverage industry: food and beverage manufacturing, agri-food
- Health industry: health products, medical technology, research and production
- Aerospace industry: aircraft and space components, maintenance activities
Sterling in Portugal
Sterling delivers in Portugal from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Portugal, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Portuguese clients ask
Are certification audits in Portugal conducted in Portuguese or English?
Either can be used, and the choice is settled with the certification body when you apply. Portuguese is the official language and English is widely used in international business. State early which language the audit and the controlled documents will use, and follow any rule in a contract or a regulator's procedure, so that the audit team can be assigned to match.
Who supervises the GDPR in Portugal?
The CNPD, short for Comissão Nacional de Proteção de Dados, is the national supervisory authority under Lei n.º 58/2019. The Act presents it as an independent administrative body with public-law powers, attached to the Assembleia da República, and it also keeps the list of processing activities that call for an impact assessment. Specific questions belong with the CNPD or your counsel.
Has Portugal transposed the NIS2 Directive?
Yes. Decreto-Lei n.º 125/2025, published on 4 December 2025, approves the Regime Jurídico da Cibersegurança and transposes Directive (EU) 2022/2555. It has entered into force under its final article, though its article on effects delays some provisions, such as those on security measures, until a set period after the CNCS regulation of June 2026. Confirm your exact position with the CNCS or counsel.
Which body accredits certification bodies in Portugal?
IPAC, the Instituto Português de Acreditação, holds that role under Regulation (EC) No 765/2008, and the EA directory shows it as a signatory of the multilateral agreement for management system certification, among other scopes. Accreditation is granted for defined scopes, so look up your certification body's IPAC scope for your standard and sector before you apply.
Does an ISO/IEC 27001 certificate count under Portugal's cybersecurity regulation?
In part. The CNCS's 2026 regulation lets essential and important entities rely on a presumption of compliance if they hand the competent authority a certificate from a duly accredited certification body. ISO/IEC 27001 is a listed reference, provided its scope covers in full the networks and systems behind the regulated services. The authority determines the practical effect.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and Lei n.º 58/2019 — data.dre.pt; cnpd.pt; eur-lex.europa.eu (accessed 11 Oct 2026)
- Accreditation of data protection certification bodies — data.dre.pt; cnpd.pt; eur-lex.europa.eu (accessed 11 Oct 2026)
- Decreto-Lei n.º 125/2025, de 4 de dezembro (Diário da República, 1.ª série, n.º 234, 4 December 2025), which approves the Regime Jurídico da Cibersegurança and transposes Directive (EU) 2022/2555; it has entered into force under its final article. The CNCS implementing Regulamento n.º 756/2026 (2.ª série, n.º 118, 22 June 2026) entered into force the day after publication. Under the decree-law's article on effects, the provisions on cybersecurity measures, supply-chain security, residual risk, the annual report and the measures for relevant public entities take effect only a set period after the implementing regulation is published. Its voluntary-certification provision lets essential and important entities benefit from a presumption of compliance when they present a certificate from a duly accredited certification body: ISO/IEC 27001 is listed where the scope fully covers the networks and information systems behind the regulated services, alongside the national scheme EC QNRCS and other schemes the national authority approves. The national reference framework QNRCS draws on NIST CSF 2.0, CyFun, ISO/IEC 27001:2022, ISO/IEC 27002:2022, CIS Controls v8.1 and NIST SP 800-53 Rev.5. — data.dre.pt; eur-lex.europa.eu; files.diariodarepublica.pt; diariodarepublica.pt (accessed 11 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 according to its final article, and the allocation of authorities in Decreto-Lei n.º 125/2025. DORA covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. It does not name ISO/IEC 27001 or ISO 22301. — eur-lex.europa.eu; data.dre.pt (accessed 11 Oct 2026)
- Regulations (EU) 2017/745 and 2017/746 on medical devices and in vitro diagnostic devices. Infarmed says CE marking is a precondition for placing a device on the EU market, that higher-risk classes need a notified body, that a manufacturer may choose any designated notified body whatever its Member State, and that Infarmed itself is the designating authority for notified bodies based in Portugal. Some conformity routes rest on a quality management system. The pages do not name ISO 13485. — infarmed.pt (accessed 11 Oct 2026)
- Regulation (CE) n.º 852/2004 on food hygiene. DGAV's page says food business operators create, apply and maintain permanent procedures based on the HACCP principles and points to the European Commission's notice on implementing food safety management systems, including flexibility for some businesses. The page does not mention a third-party certificate. — dgav.pt (accessed 11 Oct 2026)
- Decreto-Lei n.º 71/2008, de 15 de abril (SGCIE), amended by Lei n.º 7/2013 and Decreto-Lei n.º 68-A/2015, de 30 de abril. DGEG says the SGCIE applies to installations consuming at or above 500 tep a year and requires periodic energy audits and rationalisation plans. Decreto-Lei n.º 68-A/2015 releases companies that are not SMEs from the periodic energy-audit duty when they run an energy or environmental management system certified by a body accredited under Regulation (CE) n.º 765/2008, provided the system's audits meet the decree's minimum criteria. Neither text names ISO 50001 or ISO 14001. — dgeg.gov.pt; data.dre.pt (accessed 11 Oct 2026)
- Lei n.º 102/2009, de 10 de setembro, the legal regime for promoting occupational safety and health. It sets employer duties and the ways safety and health services are organised, and names the ACT. It does not name ISO 45001. — data.dre.pt (accessed 11 Oct 2026)
- Decreto-Lei n.º 109-E/2021, de 9 de dezembro, which creates MENAC and the regime geral de prevenção da corrupção, and Lei n.º 93/2021, de 20 de dezembro, on whistleblower protection. The regime requires a compliance programme with a risk prevention plan, a code of conduct, a training programme and a whistleblowing channel, under a compliance officer. Neither law names ISO 37001, ISO 37301 or ISO 37002. — data.dre.pt (accessed 11 Oct 2026)
- The EU AI Regulation. The Commission's list, last updated in September 2026, shows ANACOM for Portugal and marks the national designation decision as still pending final adoption. The list does not name ISO/IEC 42001. — digital-strategy.ec.europa.eu (accessed 11 Oct 2026)
- IPAC (Instituto Português de Acreditação, I.P.) — ipac.pt; european-accreditation.org; ipq.pt (accessed 11 Oct 2026)
- Código dos Contratos Públicos (public procurement code) and the Base portal — impic.pt (accessed 11 Oct 2026)
- Madeira's International Business Centre — ibc-madeira.com (accessed 11 Oct 2026)
- Port of Sines and the Algarve ports — apsinesalgarve.pt (accessed 11 Oct 2026)
- Shared services and global business services sites — portugalglobal.pt (accessed 11 Oct 2026)
- Automotive components and mobility industry — portugalglobal.pt; afia.pt (accessed 11 Oct 2026)
- Food and beverage industry — portugalglobal.pt (accessed 11 Oct 2026)
- Health industry — portugalglobal.pt (accessed 11 Oct 2026)
- Aerospace industry — portugalglobal.pt (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice