Where we work · San Marino
ISO and GRC certification consulting in San Marino
Achieve ISO and GRC certification in San Marino with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in San Marino
- High-tech manufacturing (mechatronics, industrial automation, electronic household appliances)
- Nutraceuticals, food supplements and cosmetics
- Digital services, including applications for banking and finance
- Financial services and payment institutions
- Food, wine and agri-food production
- Tourism and hospitality
Clients include
ISO and GRC certification in San Marino at a glance
A small jurisdiction can still carry a full rulebook, and San Marino's is easy to trace. The Autorità Garante per la Protezione dei Dati Personali supervises Law 171 of 21 December 2018, which also reaches organisations outside the country that offer goods or services to people there. The Social Security Institute's Prevention Department approves HACCP-based self-control manuals for food businesses and supervises workplace safety, while the Authority Sanitaria is the competent authority for medical devices and medicines. Banca Centrale della Repubblica di San Marino sets operational and security-risk rules for payment institutions, and suppliers to public bodies register in the Registro Unico dei Fornitori. The national accreditation body, SMAS, joined European co-operation for Accreditation in 2023; certificates come from accredited certification bodies, never from Sterling. Demand comes from high-tech manufacturing, food supplements and cosmetics, digital services, finance, food, tourism and care providers. Sterling's Frankfurt office serves San Marino clients, drawing on 8,100+ client engagements in 60+ countries and 20+ years of practice, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in San Marino
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in San Marino (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Legge 21 dicembre 2018 n.171 — Protezione delle persone fisiche con riguardo al trattamento dei dati personali (Law No. 171 of 21 December 2018 on the protection of natural persons with regard to the processing of personal data) Autorità Garante per la Protezione dei Dati Personali (the San Marino Data Protection Authority), an independent administrative authority set up by the Law and operating from 1 February 2019 | Applies to processing by automated means and to filing-system processing by anyone established in San Marino, and to controllers or processors outside it that offer goods or services to people in San Marino or monitor their behaviour there. It sets principles, lawful bases and consent conditions, information duties, data subject rights including the right not to be subject to solely automated decisions, controller and processor duties, records of processing, privacy by design and by default, security of processing, notification of a breach to the Authority without undue delay and where feasible not later than 72 hours after becoming aware, impact assessments with prior consultation, designation of a data protection officer in listed cases, a voluntary data protection certification mechanism, and rules for transfers to other countries. It also has sector chapters on health, employment, research, electronic communications and unsolicited communications. The Authority's powers cover investigation, correction, authorisation and advice, with administrative fines under the Law. The Law does not cite any ISO standard. | |
| Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data and its amending Protocol (CETS 223) Autorità Garante per la Protezione dei Dati Personali | Records the international data protection commitments that sit behind Law 171/2018; the Authority's website also reports its admission as a permanent member of the Conference of the European Data Protection Authorities. The decrees set no obligations on businesses beyond those in Law 171/2018. | |
| Istituto per la Sicurezza Sociale (ISS), Dipartimento di Prevenzione, UOC Sanità Veterinaria e Igiene Alimentare Food businesses: production, processing, storage, distribution, catering, retail and export of foodstuffs, including food supplements | The unit's hygiene pages list hygiene and health control across the food chain, inspection of the public slaughterhouse, authorisations for food activities and for vehicles carrying foods of animal origin, approval of SSOP-HACCP self-control manuals with checks on their application, health certificates for products intended for export, vigilance over establishments with European Union and United States recognition and an official list of establishments approved under Regulation (EC) 853/2004. Food supplements are governed by Delegated Decree of 21 April 2008 on their production and marketing, amended by Delegated Decree 43 of 1 March 2024, and a cooperation protocol with Italy on supplements is published. The pages do not name ISO 22000 or FSSC 22000. | HACCP |
| Authority Sanitaria (the Authority for the authorisation, accreditation and quality of health, social-health and socio-educational services), competent authority for medical devices Medical devices, medicines, wholesale of medicines and manufacturers of medical devices | The Authority supervises the manufacture and sale of medical devices, issues free-sale certificates to San Marino manufacturers operating in compliance with Regulation (EU) 2017/745, and collects incident reports. Because of gaps in the national rules it issued a device-vigilance circular, presented on 12 March 2025, that follows the European MDR and IVDR framework. For medicines it authorises imports and exports on a documentary basis, gives the authorising opinion for wholesalers and inspects their premises. The pages name no ISO standard. | |
| Authority Sanitaria, acting as Organismo Tecnicamente Accreditante (technical accrediting body) under Law 69/2004; the Congress of State grants the accreditation Health, social-health and socio-educational facilities, including private clinics and early-childhood services | Law 69/2004 and Law 165/2004 reorganised the health system and set up the Authority in 2004. It carries out authorisation and accreditation of health, social-health and socio-educational facilities and clinical-risk vigilance, and publishes the documents and procedures that govern its technical evaluation. This is a national institutional accreditation of facilities and is separate from an ISO 9001 certificate. | |
| ISS Dipartimento di Prevenzione, UOC Sicurezza sul Lavoro and UOS Sicurezza Antinfortunistica nei luoghi di lavoro Employers, construction sites and workplaces | The unit supervises workplace safety in companies and building sites under the laws of 2 July 1969 n.40 and n.41, Decree of 17 October 1991 n.124, Law 18 February 1998 n.31 and their implementing decrees, can issue immediately enforceable requirements up to suspension of work, investigates accidents with the judicial authority, and gives opinions on safety for preliminary authorisations such as the start of production activity. Its information and guidance work is addressed to companies, clients, works managers and safety coordinators, the last under Article 25 of Law 31/1998. The pages do not cite ISO 45001. | |
| Ufficio Prevenzione Ambiente e Vigilanza del Territorio (UPAV), with its environmental management unit as the competent authority for waste shipments Industry and developers: emissions, discharges, waste, energy and environmental permits | UPAV controls discharges to water, air, soil and subsoil and noise and electromagnetic emissions, issues opinions and authorisations on discharges and on new productive settlements, can impose prescriptions and orders, and keeps the waste observatory. Its environmental management unit handles prior authorisations for cross-border waste exports under Regulation (EC) 1013/2006, keeps the waste register under Article 27 of Delegated Decree 44/2012 and the list of firms qualified for asbestos remediation under Article 45(2). Its energy desk manages incentives for renewable plants and sets by parameters when an energy audit is mandatory. None of these pages cites ISO 14001 or ISO 50001. | |
| Banca Centrale della Repubblica di San Marino (BCSM) Payment institutions, electronic money institutions and crypto-asset firms supervised by the central bank | Regulation 2020-04 on payment services and electronic money (consolidated text of 29 January 2026, Update VIII) requires institutions to manage operational and security risk with a contingency and business-continuity plan that is tested periodically, incident-handling procedures, restricted access to sensitive payment data, an annual security-policy document to the BCSM with a risk assessment, prompt reporting of serious incidents, and prior communication of outsourcing of strategic operational functions. Regulation 2024-03 on crypto-assets covers information-security risk, disaster recovery and business continuity. Neither regulation cites ISO/IEC 27001, ISO 22301 or PCI DSS. | |
| Criminal-law provisions added to the Criminal Code and applied by the judicial authority; not a sector regulator Operators of computer and telematic systems, and their customers | Legge 23 agosto 2016 n.114 — Disciplina dei reati informatici (Law on computer crimes) introduces criminal protection against offences committed through electronic and telematic systems, among them unauthorised access to a system protected by security measures. It sets no management-system requirement and does not cite ISO/IEC 27001. | |
| Judicial and police authorities; reports from obliged parties under Law 92/2008 go to them Companies and financial intermediaries exposed to corruption, accounting and reporting duties | Decree-Law 90 of 16 June 2014 — Urgent provisions to prevent and combat corruption offences (English text on the Council's site) lets anyone report facts on the corruption offences in the Criminal Code, obliges the parties named in Law 92 of 17 June 2008 to report suspicious transactions without delay, adds an offence for failing to keep or for falsifying accounting records and cites GRECO recommendations. It does not cite ISO 37001 or ISO 37301. | |
| Ufficio Gestione Risorse Ambientali ed Agricole (UGRAA) Agriculture, wine, olive oil, agri-food and agritourism businesses | UGRAA's stated mission is to support the agricultural, livestock, agri-food and agritourism businesses on the territory, to check their activities and produce under the rules in force and to promote organic production and marketing. Its committees include a wine protection commission under Law 127/1986 and a tasting commission for virgin olive oils under Delegated Decree 114 of 6 August 2009. | |
| Dipartimento Turismo and Ufficio del Turismo Hotels, guesthouses, rural tourism and other tourist companies | Law 22 of 27 January 2006, the framework law on tourism, is implemented for accommodation companies by Regulation 3 of 8 June 2010, amended by Regulation 12 of 2 December 2010 and Regulation 6 of 19 August 2020 (English titles on the Council's site), and rural tourism has its own Law 23 of 27 January 2006. These texts set the rules for accommodation companies; they are not recorded as citing ISO 9001 or ISO 22000. | |
| Ufficio Attività Economiche (UAE), Dipartimento Sviluppo Economico All businesses needing an economic-activity licence, authorisation or entry in the company registers | Under Delegated Decree 3 July 2023 n.103 the Office keeps the Registro Unico delle Attività Economiche, handles licences, authorisations and attestations needed to carry on an economic activity, and issues certificates such as the certificate of authorisation to operate. Licensing is framed by Law 40 of 31 March 2014 (English title: regulations governing licences to perform industrial, service, handicraft and commercial activities). |
Accreditation and recognition
- San Marino Accreditation Service (SMAS): National accreditation body of San Marino, a division of the Economic Development Agency – Chamber of Commerce S.p.A., appointed by the San Marino Government under Regulation (EC) 765/2008; its own page describes the role as attesting the competence and impartiality of certification bodies, and EA's news item says it carries out the accreditation function exclusively for certification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Registro Unico dei Fornitori for public contracts (Delegated Decree 87 of 26 May 2023 and Regulation 6 of 6 July 2023), under Law 96/1999, Law 49/2002 and Delegated Decree 26/2015 (Contracting entities of the public administration and the wider public sector; the register is kept by the Economic Development Agency – Chamber of Commerce (ASE-CC), which handles registration, suspension and removal): San Marino and foreign companies that want to take part in public tenders for supplies, services and public works must register in the Registro Unico dei Fornitori. Delegated Decree 77 of 3 May 2023, ratified by Decree 87 of 26 May 2023, sets up the register, partially revises the 2000 rules on works contracts and specifies criteria for the most economically advantageous offer in supply contracts. The Government also publishes general specifications (capitolato generale) and guidance documents for public contracts. The decree text sets no general management-system certificate requirement, so read the qualification clause of each notice.
Sterling in San Marino
Sterling delivers in San Marino from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions San Marino clients ask
Which law protects personal data in San Marino, and who supervises it?
Law 171 of 21 December 2018 protects personal data, and the Autorità Garante per la Protezione dei Dati Personali supervises it as an independent authority. It reaches organisations outside San Marino that offer goods or services to people there or monitor their behaviour, requires breach notification to the Authority, and regulates transfers abroad. Check how it applies to you with counsel or the Authority.
Who accredits certification bodies in San Marino?
San Marino Accreditation Service, known as SMAS, is the national accreditation body, appointed by the Government under Regulation (EC) 765/2008, and it joined European co-operation for Accreditation in 2023. EA's directory shows no MLA signatory entry for San Marino, so ask SMAS or EA which recognition covers your scope, and ask any certification body for its accreditation certificate.
Who inspects food businesses in San Marino and approves HACCP manuals?
The Social Security Institute's Prevention Department, through its veterinary health and food hygiene unit, inspects food businesses, authorises food activities, approves SSOP-HACCP self-control manuals and checks how they are applied. The same unit issues health certificates for products going to export markets. Ask the unit what it expects for your premises before you commission documentation.
Who is the competent authority for medical devices in San Marino?
The Authority Sanitaria is the competent authority. It supervises the manufacture and sale of medical devices, collects incident reports, and issues free-sale certificates to San Marino manufacturers operating in compliance with Regulation (EU) 2017/745. Its device-vigilance circular, presented on 12 March 2025, follows the European MDR and IVDR framework, so manufacturers should confirm current requirements with the Authority.
Must a supplier register to bid for San Marino public contracts?
Yes. San Marino and foreign companies that want to take part in public tenders for supplies, services or works must be entered in the Registro Unico dei Fornitori, which the Economic Development Agency – Chamber of Commerce keeps under Delegated Decree 87/2023. The decree text sets no general ISO certificate requirement, so read the qualification clause of each notice.
Are certification audits in San Marino conducted in English?
They can be, but laws and official notices are in Italian and the English translations on the Council's site are not authentic. Many records, supplier files and interviews may use either language. Agree the audit language and any interpreter with the certification body when you apply, since the body decides which auditors it can assign.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Legge 21 dicembre 2018 n.171 — Protezione delle persone fisiche con riguardo al trattamento dei dati personali (Law No. 171 of 21 December 2018 on the protection of natural persons with regard to the processing of personal data) — garanteprivacy.sm; consigliograndeegenerale.sm (accessed 18 Oct 2026)
- Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data and its amending Protocol (CETS 223) — garanteprivacy.sm (accessed 18 Oct 2026)
- The unit's hygiene pages list hygiene and health control across the food chain, inspection of the public slaughterhouse, authorisations for food activities and for vehicles carrying foods of animal origin, approval of SSOP-HACCP self-control manuals with checks on their application, health certificates for products intended for export, vigilance over establishments with European Union and United States recognition and an official list of establishments approved under Regulation (EC) 853/2004. Food supplements are governed by Delegated Decree of 21 April 2008 on their production and marketing, amended by Delegated Decree 43 of 1 March 2024, and a cooperation protocol with Italy on supplements is published. The pages do not name ISO 22000 or FSSC 22000. — iss.sm (accessed 18 Oct 2026)
- The Authority supervises the manufacture and sale of medical devices, issues free-sale certificates to San Marino manufacturers operating in compliance with Regulation (EU) 2017/745, and collects incident reports. Because of gaps in the national rules it issued a device-vigilance circular, presented on 12 March 2025, that follows the European MDR and IVDR framework. For medicines it authorises imports and exports on a documentary basis, gives the authorising opinion for wholesalers and inspects their premises. The pages name no ISO standard. — gov.sm (accessed 18 Oct 2026)
- Law 69/2004 and Law 165/2004 reorganised the health system and set up the Authority in 2004. It carries out authorisation and accreditation of health, social-health and socio-educational facilities and clinical-risk vigilance, and publishes the documents and procedures that govern its technical evaluation. This is a national institutional accreditation of facilities and is separate from an ISO 9001 certificate. — gov.sm (accessed 18 Oct 2026)
- The unit supervises workplace safety in companies and building sites under the laws of 2 July 1969 n.40 and n.41, Decree of 17 October 1991 n.124, Law 18 February 1998 n.31 and their implementing decrees, can issue immediately enforceable requirements up to suspension of work, investigates accidents with the judicial authority, and gives opinions on safety for preliminary authorisations such as the start of production activity. Its information and guidance work is addressed to companies, clients, works managers and safety coordinators, the last under Article 25 of Law 31/1998. The pages do not cite ISO 45001. — iss.sm (accessed 18 Oct 2026)
- UPAV controls discharges to water, air, soil and subsoil and noise and electromagnetic emissions, issues opinions and authorisations on discharges and on new productive settlements, can impose prescriptions and orders, and keeps the waste observatory. Its environmental management unit handles prior authorisations for cross-border waste exports under Regulation (EC) 1013/2006, keeps the waste register under Article 27 of Delegated Decree 44/2012 and the list of firms qualified for asbestos remediation under Article 45(2). Its energy desk manages incentives for renewable plants and sets by parameters when an energy audit is mandatory. None of these pages cites ISO 14001 or ISO 50001. — gov.sm (accessed 18 Oct 2026)
- Regulation 2020-04 on payment services and electronic money (consolidated text of 29 January 2026, Update VIII) requires institutions to manage operational and security risk with a contingency and business-continuity plan that is tested periodically, incident-handling procedures, restricted access to sensitive payment data, an annual security-policy document to the BCSM with a risk assessment, prompt reporting of serious incidents, and prior communication of outsourcing of strategic operational functions. Regulation 2024-03 on crypto-assets covers information-security risk, disaster recovery and business continuity. Neither regulation cites ISO/IEC 27001, ISO 22301 or PCI DSS. — bcsm.sm (accessed 18 Oct 2026)
- Legge 23 agosto 2016 n.114 — consigliograndeegenerale.sm (accessed 18 Oct 2026)
- Decree-Law 90 of 16 June 2014 — consigliograndeegenerale.sm (accessed 18 Oct 2026)
- UGRAA's stated mission is to support the agricultural, livestock, agri-food and agritourism businesses on the territory, to check their activities and produce under the rules in force and to promote organic production and marketing. Its committees include a wine protection commission under Law 127/1986 and a tasting commission for virgin olive oils under Delegated Decree 114 of 6 August 2009. — gov.sm (accessed 18 Oct 2026)
- Law 22 of 27 January 2006, the framework law on tourism, is implemented for accommodation companies by Regulation 3 of 8 June 2010, amended by Regulation 12 of 2 December 2010 and Regulation 6 of 19 August 2020 (English titles on the Council's site), and rural tourism has its own Law 23 of 27 January 2006. These texts set the rules for accommodation companies; they are not recorded as citing ISO 9001 or ISO 22000. — consigliograndeegenerale.sm (accessed 18 Oct 2026)
- Under Delegated Decree 3 July 2023 n.103 the Office keeps the Registro Unico delle Attività Economiche, handles licences, authorisations and attestations needed to carry on an economic activity, and issues certificates such as the certificate of authorisation to operate. Licensing is framed by Law 40 of 31 March 2014 (English title: regulations governing licences to perform industrial, service, handicraft and commercial activities). — gov.sm; consigliograndeegenerale.sm (accessed 18 Oct 2026)
- San Marino Accreditation Service (SMAS) — camcom.sm; european-accreditation.org (accessed 18 Oct 2026)
- Registro Unico dei Fornitori for public contracts (Delegated Decree 87 of 26 May 2023 and Regulation 6 of 6 July 2023), under Law 96/1999, Law 49/2002 and Delegated Decree 26/2015 — camcom.sm; gov.sm; consigliograndeegenerale.sm (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice