Where we work · Spain
ISO and GRC certification consulting in Spain
Achieve ISO and GRC certification in Spain with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Spain
Clients include
ISO and GRC certification in Spain at a glance
Spanish demand for certification and compliance work comes from procurement, data protection and cyber rules rather than from one national mandate. The Agencia Española de Protección de Datos supervises the GDPR under Ley Orgánica 3/2018, with regional authorities acting inside their own public sectors. Public bodies and their suppliers fall under the Esquema Nacional de Seguridad in Real Decreto 311/2022, while the NIS2 Directive is still moving through national law: the Council of Ministers approved a draft cybersecurity governance law in January 2025, and the European Commission referred Spain to the Court of Justice in July 2026. Financial entities work to DORA, medical device makers answer to the AEMPS and food businesses apply HACCP principles. Tenders under Ley 9/2017 may ask for quality or environmental certificates. Certificates come from certification bodies accredited by ENAC, Spain's national accreditation body, not from Sterling. Sterling's Enschede office serves clients in Spain, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement. Demand is strongest among IT providers, public-sector suppliers, financial services, medical devices, automotive and aerospace makers, and food producers.
ISO and GRC standards Sterling delivers in Spain
Each page covers who needs the standard in Spain, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Spain (16)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR; RGPD in Spanish) and its Spanish organic law Agencia Española de Protección de Datos (AEPD) — the law describes it as an independent administrative authority at State level; regional data protection authorities may exercise the GDPR powers for the public sector of their autonomous community and for processing by those performing public functions of the regional or local administration | The GDPR applies directly. The organic law supplements it for Spain, sets the AEPD's status and recognises regional authorities, which act within the matters the law lists. | |
| Data protection officer rules in the organic law AEPD or, where relevant, the regional data protection authority | Controllers and processors must designate a data protection officer in the cases of Article 37.1 of the GDPR and in every case where they are one of the entities the Spanish law lists: professional associations, schools and universities, electronic communications operators processing at large scale, information society providers profiling users at large scale, credit institutions, insurers, investment firms, electricity and gas distributors and retailers, credit-reference and fraud-prevention file operators, advertising and market-research businesses profiling people, health centres keeping patient records, commercial-report issuers, online gambling operators, private security companies and sports federations processing children's data. Appointments and removals are notified to the AEPD or the regional authority, which keep public lists. | |
| GDPR certification and DPO certification scheme AEPD with ENAC | The published convenio covers ENAC accreditation of bodies that certify under Article 42 of the GDPR. Separately, the AEPD promotes a scheme in which data protection officers are certified by bodies accredited by ENAC; the AEPD states that this certification is not compulsory for acting as a DPO. | |
| Centro Criptológico Nacional (CCN) and the public administrations that apply the scheme Public sector and the private suppliers that serve it | Esquema Nacional de Seguridad (ENS), Real Decreto 311/2022, de 3 de mayo — applies to the whole public sector and, by contract, to private suppliers that provide services or solutions to public entities for their administrative powers; systems of medium or high category need a certification audit of conformity, basic-category systems a self-assessment; tender documents must set the ENS conformity evidence needed. The decree does not name ISO/IEC 27001. | |
| Competent authorities named in the draft Spanish law: the Interior Ministry (cybersecurity coordination office), the Defence Ministry (Centro Criptológico Nacional) and the Digital Transformation ministry's State Secretariat for telecommunications; a National Cybersecurity Centre attached to the Presidency would be the single point of contact Essential and important entities under NIS2 | Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025 as a draft, transposing Directive (EU) 2022/2555. On 8 July 2026 the European Commission decided to refer Spain to the Court of Justice for failing to notify transposing measures; it records that Spain had yet to notify full transposition. Status: transposition pending. | |
| Interior Ministry through the CNPIC for critical operators; the sector authority for other essential-service operators; the State Secretariat for Digitalisation and Artificial Intelligence for digital service providers; the Defence Ministry through the CCN for those within the public-sector law Essential-service operators and digital service providers under the earlier NIS rules | Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información — regulates network and information system security for essential and digital services and sets up incident notification; it remains the national instrument while NIS2 transposition is pending. | |
| Banco de España, CNMV and the Dirección General de Seguros y Fondos de Pensiones, each for the entities it supervises Financial entities and their ICT third-party providers | Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, applicable from 17 January 2025 — ICT risk management, ICT third-party risk, resilience testing and major-incident reporting. The CNMV's DORA FAQ (updated 10 February 2026) states that ISO 27001 certification, or an equivalent, does not guarantee compliance with DORA. | |
| Agencia Española de Medicamentos y Productos Sanitarios (AEMPS) — the competent authority under Article 101 of the MDR Medical device manufacturers, importers and distributors | Real Decreto 192/2023, de 21 de marzo, por el que se regulan los productos sanitarios, alongside Regulation (EU) 2017/745 — covers the operating licences for facilities, notified bodies, placing on the market, clinical investigations, vigilance and market inspection. ISO 13485 is not named in the decree. | |
| Competent food authorities; the Agencia Española de Seguridad Alimentaria y Nutrición (AESAN) publishes hygiene and HACCP implementation guides Food businesses | Regulation (EC) No 852/2004 on the hygiene of foodstuffs — food business operators must put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. | HACCP |
| Inspección de Trabajo y Seguridad Social All employers | Ley 31/1995, de 8 de noviembre, de Prevención de Riesgos Laborales — prevention must be integrated into the company's general management system through a prevention plan, with risk evaluation and planning of preventive activity; the Inspección de Trabajo y Seguridad Social monitors compliance. ISO 45001 is not named. | |
| The State energy authority named in the decree (Dirección General de Política Energética y Minas) Large companies and groups — energy efficiency | Real Decreto 56/2016, de 12 de febrero (energy audits) — large companies and groups must undergo an energy audit, or alternatively apply an energy or environmental management system certified by an independent body to the relevant European or international standards, provided the system includes an energy audit meeting the decree's minimum guidelines. | |
| Agencia Española de Supervisión de Inteligencia Artificial (AESIA), seated in A Coruña Providers and deployers of artificial intelligence | Real Decreto 729/2023 (AESIA statute) and the EU Artificial Intelligence Act, Regulation (EU) 2024/1689 — providers of high-risk AI systems must have a risk management system and a quality management system. ISO/IEC 42001 is not named in either text. | |
| Autoridad Independiente de Protección del Informante (A.A.I.) and regional bodies Organisations with fifty or more workers, public bodies and certain regulated sectors | Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción — private entities with fifty or more workers, all public-sector entities and entities in the listed EU-law areas must have an internal information system with a responsible person. | |
| Criminal courts (Código Penal); UNE publishes the Spanish criminal compliance standard Companies exposed to corporate criminal liability | Ley Orgánica 10/1995, del Código Penal, Article 31 bis — a legal person can be exempt from liability where its governing body adopted and effectively implemented, before the offence, prevention models with suitable supervision and control measures, and the supervision is entrusted to a body with autonomous powers. UNE 19601:2025 is the Spanish standard for criminal compliance management systems; neither text names ISO 37001 or ISO 37301. | |
| Interior Ministry (Secretaría de Estado de Seguridad, CNPIC) Critical infrastructure operators | Ley 8/2011 on critical infrastructure protection, which the earlier NIS decree-law builds on; at its Council of Ministers press conference of 17 March 2026 the government announced that a bill on critical infrastructure protection and resilience was being sent to the Cortes Generales. | |
| Agencia Estatal de Seguridad Aérea (AESA); EASA for approvals within the EU Basic Regulation Aerospace and aircraft production organisations | Production Organisation Approval (POA) as described in Part 21 Subpart G of Annex I to Regulation (EU) 748/2012, applicable to production activities within EASA's scope. AS9100 is not named on the AESA page. |
Accreditation and recognition
- Entidad Nacional de Acreditación (ENAC): National accreditation body — designated by Real Decreto 1715/2010 as Spain's sole national accreditation body under Regulation (EC) No 765/2008; accredits conformity assessment bodies, including certification bodies and laboratories; Spain's member of European co-operation for Accreditation (EA).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Ley 9/2017 de Contratos del Sector Público — quality assurance evidence (Spanish legislature (contracting authorities apply it)): In contracts subject to harmonised regulation, where a contracting authority asks for certificates from independent bodies showing the supplier meets quality assurance standards, it must refer to quality assurance systems based on the relevant series of standards, certified by bodies meeting the European certification standards. It must recognise equivalent certificates from bodies established in any EU member state and accept other evidence of equivalent quality assurance measures.
- Ley 9/2017 de Contratos del Sector Público — environmental management evidence (Spanish legislature (contracting authorities apply it)): Where a harmonised-regulation contract asks for certificates of environmental management as proof of technical or professional solvency, the authority must refer to the EU eco-management and audit scheme (EMAS), to other systems recognised under Regulation (EC) No 1221/2009, or to other environmental management standards based on the relevant European or international standards from accredited bodies, and must accept equivalent certificates and other evidence of equivalent measures.
- ENS conformity evidence in public contracts (Public sector contracting entities within the scope of Real Decreto 311/2022): Tender documents of in-scope public entities must include the requirements needed to ensure ENS conformity of the information systems behind the contractor's services, such as ENS declarations or certifications of conformity; the caution extends to the contractor's supply chain where the risk analysis calls for it.
- Plataforma de Contratación del Sector Público (Spanish State public sector): The State's public procurement platform, with search for tenders and minor contracts, contractor profiles and company services. The platform is where documents are published; certification requirements come from each contracting authority's own tender documents.
Economic zones
- Zona Franca de Vigo (Balaidos industrial estate and Bouzas port area): international trade and logistics, industry, port services
- Zona Franca de Barcelona (industrial hub and Zona Franca Industrial Park): advanced industry, logistics, innovation and start-ups
- Zona Franca de Cádiz: naval industry, blue economy
Sterling in Spain
Sterling delivers in Spain from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Spain, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Spanish clients ask
Are certification audits in Spain conducted in Spanish or English?
Either can work, by agreement. Spanish is the official language of the State and the usual language for tenders, regulators and the AEPD, while English is common in multinational groups and technology firms. Tell the certification body at application which language you want for the audit and for controlled documents, and follow any language clause written into a tender or contract.
Which accreditation body should a certification body hold for Spain?
Look for accreditation from ENAC, the Entidad Nacional de Acreditación, which Real Decreto 1715/2010 designates as Spain's sole national accreditation body. It is Spain's member of European co-operation for Accreditation and describes itself as part of the international mutual recognition arrangements. Accreditation is scope-specific, so check the body's ENAC scope for your standard.
Is the NIS2 Directive law in Spain yet?
Not as a finished national law. A draft cybersecurity governance law cleared the Council of Ministers on 14 January 2025. Then, on 8 July 2026, the European Commission decided to take Spain to the Court of Justice because full transposition had not been notified. Meanwhile Real Decreto-ley 12/2018 stays the national instrument. Ask your counsel for the latest position.
Who supervises data protection in Spain?
The Agencia Española de Protección de Datos (AEPD), an independent administrative authority at State level, supervises the GDPR under Ley Orgánica 3/2018. Regional authorities can also act, but only for the public sector of their autonomous community and for processing carried out in exercising regional or local public functions. Which one applies depends on who is processing.
Does the Esquema Nacional de Seguridad apply to private companies?
Yes, where the company provides services or solutions to public entities for their administrative powers, by virtue of a contract. The decree then applies to the systems involved, including the duty to hold a security policy. Medium and high category systems need a certification audit; basic systems need a self-assessment. Tender documents set the evidence expected.
Do Spanish public tenders require ISO certificates?
Not as a blanket rule. Where an authority asks for quality or environmental certificates in a harmonised contract, the Ley 9/2017 says it must refer to certified systems from conforming bodies and accept equivalents from other EU states. ENS evidence is a separate requirement for in-scope public contracts. Each tender document sets its own criteria, so read it closely.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR; RGPD in Spanish) and its Spanish organic law — boe.es (accessed 7 Oct 2026)
- Data protection officer rules in the organic law — boe.es (accessed 7 Oct 2026)
- GDPR certification and DPO certification scheme — boe.es; aepd.es (accessed 7 Oct 2026)
- Esquema Nacional de Seguridad (ENS), Real Decreto 311/2022, de 3 de mayo — boe.es (accessed 7 Oct 2026)
- Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025 as a draft, transposing Directive (EU) 2022/2555. On 8 July 2026 the European Commission decided to refer Spain to the Court of Justice for failing to notify transposing measures; it records that Spain had yet to notify full transposition. Status: transposition pending — interior.gob.es; lamoncloa.gob.es; digital-strategy.ec.europa.eu (accessed 7 Oct 2026)
- Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información — boe.es (accessed 7 Oct 2026)
- Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, applicable from 17 January 2025 — dgsfp.mineco.gob.es; cnmv.es (accessed 7 Oct 2026)
- Real Decreto 192/2023, de 21 de marzo, por el que se regulan los productos sanitarios, alongside Regulation (EU) 2017/745 — boe.es (accessed 7 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs — eur-lex.europa.eu; aesan.gob.es (accessed 7 Oct 2026)
- Ley 31/1995, de 8 de noviembre, de Prevención de Riesgos Laborales — boe.es (accessed 7 Oct 2026)
- Real Decreto 56/2016, de 12 de febrero (energy audits) — boe.es (accessed 7 Oct 2026)
- Real Decreto 729/2023 (AESIA statute) and the EU Artificial Intelligence Act, Regulation (EU) 2024/1689 — boe.es; eur-lex.europa.eu (accessed 7 Oct 2026)
- Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción — boe.es (accessed 7 Oct 2026)
- Ley Orgánica 10/1995, del Código Penal, Article 31 bis — boe.es; une.org (accessed 7 Oct 2026)
- Ley 8/2011 on critical infrastructure protection, which the earlier NIS decree-law builds on; at its Council of Ministers press conference of 17 March 2026 the government announced that a bill on critical infrastructure protection and resilience was being sent to the Cortes Generales — boe.es; lamoncloa.gob.es (accessed 7 Oct 2026)
- Production Organisation Approval (POA) as described in Part 21 Subpart G of Annex I to Regulation (EU) 748/2012, applicable to production activities within EASA's scope. AS9100 is not named on the AESA page — seguridadaerea.gob.es (accessed 7 Oct 2026)
- Entidad Nacional de Acreditación (ENAC) — boe.es; enac.es (accessed 7 Oct 2026)
- Ley 9/2017 de Contratos del Sector Público — quality assurance evidence — boe.es (accessed 7 Oct 2026)
- Ley 9/2017 de Contratos del Sector Público — environmental management evidence — boe.es (accessed 7 Oct 2026)
- ENS conformity evidence in public contracts — boe.es (accessed 7 Oct 2026)
- Plataforma de Contratación del Sector Público — contrataciondelestado.es (accessed 7 Oct 2026)
- Zona Franca de Vigo (Balaidos industrial estate and Bouzas port area) — zfv.es (accessed 7 Oct 2026)
- Zona Franca de Barcelona (industrial hub and Zona Franca Industrial Park) — zfbarcelona.es (accessed 7 Oct 2026)
- Zona Franca de Cádiz — zonafrancacadiz.com (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice