Where we work · Serbia
ISO and GRC certification consulting in Serbia
Achieve ISO and GRC certification in Serbia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Serbia
Clients include
ISO and GRC certification in Serbia at a glance
Serbia's Law on Personal Data Protection, published in the Official Gazette of the Republic of Serbia No. 87/2018, is supervised by the Commissioner for Information of Public Importance and Personal Data Protection, who inspects controllers and keeps a register of data protection officers. A newer Law on Information Security, published in Official Gazette No. 91 of 23 October 2025, sorts operators of ICT systems into priority and important groups, with the National Bank of Serbia supervising banks and financial markets. Food exporters hear from the Development Agency of Serbia that HACCP certification is a precondition for export, medical device makers register with the Medicines and Medical Devices Agency (ALIMS), and certificates come from certification bodies accredited by the Accreditation Body of Serbia (ATS) or an equivalent body abroad. Demand runs through automotive suppliers, agri-food processors, ICT exporters, metals and electronics makers and banks. Sterling serves clients across Serbia from its Frankfurt office, on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Serbia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Serbia (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti — Закон о заштити података о личности) Commissioner for Information of Public Importance and Personal Data Protection (Повереник за информације од јавног значаја и заштиту података о личности; the Commissioner) — an independent and autonomous public body established under the Law, with offices in Belgrade, Novi Sad, Niš and Kragujevac; Article 77 and the following articles set its powers and Article 79 its inspection powers | Applies to processing done wholly or partly by automated means and to personal data in, or meant for, a filing system, with an exception for a person's purely personal or household use. It applies to controllers and processors established in Serbia and also to controllers and processors outside Serbia whose processing relates to offering goods or services to people in Serbia or monitoring their behaviour there. Processing is lawful only on one of six bases listed in Article 12: consent, a contract or pre-contract steps, a legal duty, vital interests, a public-interest task or statutory power, or the controller's or a third party's legitimate interests unless overridden by the person's rights (the last basis is not open to public authorities acting within their competence). The Commissioner's guidance sets out general duties: processing principles, notice and rights handling, a processor contract (Article 45), records of processing (Article 47), notification of a breach to the Commissioner without undue delay where it may create a risk (Article 52) and to the person where the risk is high (Article 53), an impact assessment for high-risk processing (Articles 54-55), and a data protection officer (Articles 56-58), who is mandatory for public authorities, for core activities of regular and systematic monitoring of many people and for large-scale special-category data, with contact details published and sent to the Commissioner. Transfers abroad rely on an adequate level of protection (deemed to exist in states party to Convention 108 and where the EU has found it) or on safeguards such as standard contractual clauses by the Commissioner, binding corporate rules, an approved code or a certificate (Articles 64-65). Certification under Article 61 is voluntary and does not change legal duties. | |
| Commissioner's registers, forms and inspection tools under the Law Commissioner for Information of Public Importance and Personal Data Protection | The Commissioner states that anyone who designates a data protection officer, including where the Law does not require one, must publish the officer's contact details and send them to the Commissioner in the form the Rulebook sets, and that the Commissioner keeps a register of such officers. Its site also carries an inspection checklist for controllers and a list of foreign companies with a designated representative under the Law. | |
| Ministry responsible for information security (the Ministry of Information and Telecommunications, as the National CERT's site names the competent authority) with the Office for Information Security; the National Bank of Serbia and the Securities Commission supervise their regulated sectors; the National CERT is run by the Regulatory Authority for Electronic Communications and Postal Services (RATEL) Operators of ICT systems of special importance (priority and important systems), including banking and financial markets | Law on Information Security (Zakon o informacionoj bezbednosti), Official Gazette of the Republic of Serbia No. 91 of 23 October 2025, as published on the Official Gazette's pages and on RATEL's site. It sorts operators into priority ICT systems (energy and mining, transport, banking and financial markets, health, drinking water, waste water, digital infrastructure such as cloud and data-centre services, management of ICT services, and others) and important ICT systems (including postal services, waste, chemicals, food production, electronics, machinery, motor vehicles, medical devices and e-commerce information services). Operators must register, apply technical, operational, organisational and physical protection measures, assess risk, adopt an act on the security of the ICT system and check conformity of the measures at least once a year, control third-party access, and notify incidents without delay. The list of measures covers organisational structure and responsibilities, training, asset identification and classification, access control, cryptography, physical protection, supplier agreements, incident handling and business continuity. A government bylaw is to set the measures further, taking national and international standards into account. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, SOC 2 |
| National Bank of Serbia (and the Securities Commission for capital-market firms) — the Law on Information Security names the National Bank as the supervisory authority for priority operators in banking and financial markets, and it receives their incident notices Banks and financial institutions | The same Law on Information Security: the National Bank issues the sector rules on information security, risk assessment, incident classification and notification, and supervises compliance for the operators it oversees. | ISO/IEC 27001, ISO 22301, PCI DSS |
| Medicines and Medical Devices Agency of Serbia (ALIMS) Medical devices | Law on Medical Devices, adopted in 2017 with full application from the end of 2018, according to ALIMS. A manufacturer or its authorised representative applies for registration; ALIMS keeps the Register of Medical Devices and the Register of Manufacturers (domestic makers and foreign makers whose devices are registered), issues the registration decision, approves clinical investigations and runs vigilance and market surveillance. The application relies on certificates of conformity, and ALIMS's page does not name ISO 13485. | ISO 13485 |
| Development Agency of Serbia (RAS), the government agency for investment and export promotion, states the export requirement; the competent veterinary and food-safety authorities decide the legal detail Food processing and export | RAS's agri-food sector page states that HACCP certification is a mandatory precondition for export-oriented food processing companies and that the Government provides grants to help companies acquire the necessary standards. | HACCP, ISO 22000, FSSC 22000 |
| Labour inspection, as the Government's portal describes it Employers (occupational health and safety) | Labour Law and other laws regulating employment, as the Government's portal summarises them: employers must inform employees about working conditions, organisation and their duties in occupational health and safety, and employees can report violations to the labour inspection or the courts. | ISO 45001 |
| Government of the Republic of Serbia (as the Government's portal presents the strategy) Artificial intelligence developers and users | Strategy for the Development of Artificial Intelligence in the Republic of Serbia for the period 2025-2030, listed on the Government's portal; it is a policy document and the portal's page does not set certification duties. | ISO/IEC 42001 |
| Institute for Standardization of Serbia (ISS), the national standardization body founded by the Government Standards (Serbian national standards) | Under the Law on Standardization, ISS adopts, develops, reviews, amends and withdraws Serbian standards, keeps the register of Serbian standards, keeps them in line with European and international standards, takes part in European and international standardization and sells standards. | ISO 9001, ISO 14001, ISO/IEC 27001 |
Accreditation and recognition
- Accreditation Body of Serbia (ATS; Акредитационо тело Србије): National accreditation body — under the Law on Accreditation it assesses the competence of conformity assessment bodies for testing, calibration, inspection and certification of products, management systems and persons.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Free zones and licensed industrial zones: manufacturing for export, automotive components, logistics
Sterling in Serbia
Sterling delivers in Serbia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Serbia clients ask
Is there a personal data protection law in Serbia and who supervises it?
Yes. The Law on Personal Data Protection was published in the Official Gazette of the Republic of Serbia No. 87/2018, and the Commissioner for Information of Public Importance and Personal Data Protection supervises it, with inspection powers under Article 79. The Commissioner's pages explain duties for controllers and processors. Confirm how it applies to your processing with your counsel or the Commissioner.
What does Serbia's Law on Information Security of 2025 ask of companies?
It applies to operators of ICT systems of special importance, sorted into priority and important operators across sectors such as energy, transport, banking, health, digital infrastructure and manufacturing. Operators must register, assess risk, apply protection measures, adopt an act on security, check conformity at least yearly and notify incidents without delay. Read the Law with counsel to see whether you are in scope.
Who accredits certification bodies in Serbia?
The Accreditation Body of Serbia (ATS) is the national accreditation body. EA's directory lists it as an EA MLA signatory with management system certification among its scopes, and ATS states it signed the ILAC MRA for calibration, testing and inspection. Ask any certification body for its accreditation certificate and check that the scope covers your standard and sector.
Do Serbian food exporters need HACCP certification?
The Development Agency of Serbia states that HACCP certification is a mandatory precondition for export-oriented food processing companies, and that the Government offers grants to help firms reach the standards. The agency is not the food safety regulator, so confirm the legal detail for your products with the competent veterinary or food authority, and the certificate your buyer wants.
Do medical devices have to be registered in Serbia?
Yes. Under the Law on Medical Devices, a manufacturer or its authorised representative applies to the Medicines and Medical Devices Agency (ALIMS), which keeps the Register of Medical Devices and issues the registration decision. The application relies on certificates of conformity. ALIMS's page does not name ISO 13485, so ask the Agency what evidence it expects.
In which language will an ISO audit be run in Serbia?
Serbian is the working language of the regulators, and it is written in Cyrillic and Latin script, while English is common in export and technology businesses. The language of the audit, any interpreter and the script of your controlled documents are agreed with the certification body at application, and a regulator, buyer or contract may impose its own language rule.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti — Закон о заштити података о личности) — vrh.sud.rs; poverenik.rs (accessed 18 Oct 2026)
- Commissioner's registers, forms and inspection tools under the Law — poverenik.rs (accessed 18 Oct 2026)
- Law on Information Security (Zakon o informacionoj bezbednosti), Official Gazette of the Republic of Serbia No. 91 of 23 October 2025, as published on the Official Gazette's pages and on RATEL's site. It sorts operators into priority ICT systems (energy and mining, transport, banking and financial markets, health, drinking water, waste water, digital infrastructure such as cloud and data-centre services, management of ICT services, and others) and important ICT systems (including postal services, waste, chemicals, food production, electronics, machinery, motor vehicles, medical devices and e-commerce information services). Operators must register, apply technical, operational, organisational and physical protection measures, assess risk, adopt an act on the security of the ICT system and check conformity of the measures at least once a year, control third-party access, and notify incidents without delay. The list of measures covers organisational structure and responsibilities, training, asset identification and classification, access control, cryptography, physical protection, supplier agreements, incident handling and business continuity. A government bylaw is to set the measures further, taking national and international standards into account — ratel.rs; cert.rs (accessed 18 Oct 2026)
- The same Law on Information Security: the National Bank issues the sector rules on information security, risk assessment, incident classification and notification, and supervises compliance for the operators it oversees — ratel.rs (accessed 18 Oct 2026)
- Law on Medical Devices, adopted in 2017 with full application from the end of 2018, according to ALIMS. A manufacturer or its authorised representative applies for registration; ALIMS keeps the Register of Medical Devices and the Register of Manufacturers (domestic makers and foreign makers whose devices are registered), issues the registration decision, approves clinical investigations and runs vigilance and market surveillance. The application relies on certificates of conformity, and ALIMS's page does not name ISO 13485 — alims.gov.rs (accessed 18 Oct 2026)
- RAS's agri-food sector page states that HACCP certification is a mandatory precondition for export-oriented food processing companies and that the Government provides grants to help companies acquire the necessary standards — ras.gov.rs (accessed 18 Oct 2026)
- Labour Law and other laws regulating employment, as the Government's portal summarises them: employers must inform employees about working conditions, organisation and their duties in occupational health and safety, and employees can report violations to the labour inspection or the courts — srbija.gov.rs (accessed 18 Oct 2026)
- Strategy for the Development of Artificial Intelligence in the Republic of Serbia for the period 2025-2030, listed on the Government's portal; it is a policy document and the portal's page does not set certification duties — srbija.gov.rs (accessed 18 Oct 2026)
- Under the Law on Standardization, ISS adopts, develops, reviews, amends and withdraws Serbian standards, keeps the register of Serbian standards, keeps them in line with European and international standards, takes part in European and international standardization and sells standards — iss.rs (accessed 18 Oct 2026)
- Accreditation Body of Serbia (ATS; Акредитационо тело Србије) — ats.rs; european-accreditation.org (accessed 18 Oct 2026)
- Free zones and licensed industrial zones — ras.gov.rs; carina.rs
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice