Where we work · Sweden
ISO and GRC certification consulting in Sweden
Achieve ISO and GRC certification in Sweden with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Sweden
Clients include
ISO and GRC certification in Sweden at a glance
Swedish organisations meet certification questions from three directions: regulators, public buyers and customers. The Integritetsskyddsmyndigheten (IMY) supervises the GDPR, which Lag (2018:218) supplements. The Cybersäkerhetslag (2025:1506), Sweden's NIS2 law, took effect on 15 januari 2026, with sector supervisors named in the Cybersäkerhetsförordning. State authorities follow MSBFS 2020:6, which supports their information security work with ISO/IEC 27001 and 27002 or equivalent, and contracting authorities under the Lag (2016:1145) om offentlig upphandling must accept certificates from accredited bodies. Finansinspektionen supervises DORA, while Livsmedelsverket, Arbetsmiljöverket and Läkemedelsverket shape food, work environment and medical device work. Demand is strongest in IT, SaaS and digital infrastructure, the public sector, financial services, healthcare and life science, manufacturing supply chains, food and drinking water, and energy and transport. Certificates come from certification bodies accredited by Swedac, the national accreditation body, never from Sterling. Sterling's Enschede office serves Swedish clients on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Sweden
Each page covers who needs the standard in Sweden, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Sweden (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and its Swedish supplementing act Integritetsskyddsmyndigheten (IMY) — Förordning (2018:219) 3 § states that IMY is the supervisory authority under the GDPR and Lag (2018:218) | Lag (2018:218) supplements the GDPR. It applies to processing in the activities of controllers' and processors' establishments in Sweden, and to controllers or processors established only in third countries where the processing concerns data subjects in Sweden and relates to offering goods or services to them. It also contains national rules such as the professional secrecy of data protection officers (1 kap. 8 §). IMY describes itself as Sweden's data protection authority and the supervisory authority under the GDPR, the Criminal Data Act, the Camera Surveillance Act and the Credit Information Act. | |
| Accreditation of GDPR certification bodies Styrelsen för ackreditering och teknisk kontroll (Swedac) | Förordning (2018:219) 4 § states that Swedac accredits certification bodies under Article 43 of the GDPR. This is the accreditation framework for GDPR certification bodies; it does not make the GDPR itself a certifiable standard. | |
| Myndigheten för civilt försvar (MCF), publisher of MSBFS 2020:6, in force from 2020-10-01 State authorities — information security | MSBFS 2020:6 föreskrifter om informationssäkerhet för statliga myndigheter — 4 § requires a systematic, risk-based information security effort supported by the standards SS-EN ISO/IEC 27001:2017 and SS-EN ISO/IEC 27002:2017 or equivalent. | ISO/IEC 27001 |
| Sector supervisors named in Cybersäkerhetsförordning (2025:1507) 7–15 §§: Statens energimyndighet, Transportstyrelsen, Finansinspektionen, Inspektionen för vård och omsorg, Läkemedelsverket, Livsmedelsverket, Post- och telestyrelsen and the county administrative boards of Norrbotten, Skåne, Stockholm, Västra Götaland, Örebro and Östergötland. Försvarets radioanstalt is the single point of contact (23 §) and the CSIRT (31 §). Essential and important entities under Sweden's NIS2 transposition (energy, transport, banking and financial market infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration, manufacturing and others) | Cybersäkerhetslag (2025:1506) and Cybersäkerhetsförordning (2025:1507) — issued 2025-12-11; the law states that it partly implements Directive (EU) 2022/2555 (NIS2) and takes effect on 15 januari 2026. | |
| Finansinspektionen (FI) Financial entities — ICT risk and operational resilience | Regulation (EU) 2022/2554 (DORA) — FI states that DORA began to apply in January 2025 and sets higher requirements for managing ICT risk, reporting ICT incidents, testing digital operational resilience and managing ICT third-party risk for most firms under FI's supervision. | |
| Inspektionen för vård och omsorg (IVO) for healthcare providers and Läkemedelsverket for the health sector other than providers and for manufacture of medical devices, as allocated for cybersecurity supervision by Cybersäkerhetsförordning (2025:1507) 7 §; Läkemedelsverket also describes the authorities' role as oversight, supervision and market surveillance of medical devices Healthcare providers and medical device manufacturers | Regulation (EU) 2017/745 (Medical Device Regulation) and Cybersäkerhetslag (2025:1506); Läkemedelsverket states that the manufacturer carries the main responsibility for ensuring that devices are safe. | |
| Livsmedelsverket Food businesses | Own-check for food safety — Livsmedelsverket states that every food business must have a system for food safety made up of procedures, own checks and follow-up, including prerequisite programmes and HACCP-based procedures (primary producers are not required to apply HACCP-based procedures) and traceability. | HACCP |
| Arbetsmiljöverket Employers — work environment management | AFS 2023:1 systematiskt arbetsmiljöarbete — grundläggande skyldigheter för dig med arbetsgivaransvar; decided 2023-09-15 and in force from 2025-01-01. | |
| Naturvårdsverket may issue rules under the ordinance; supervision follows the Environmental Code Operators of permit or notification-liable environmental activities | Förordning (1998:901) om verksamhetsutövares egenkontroll — requires an established and documented allocation of organisational responsibility for the activity's environmental duties. | ISO 14001 |
| Statens energimyndighet publishes guidance; the law leaves supervision to the authority the government decides Large companies — energy audits | Lag (2014:266) om energikartläggning i stora företag — 4 § relieves a large company from the energy audit duty where its environmental or energy management system is certified under the regulations issued with the law and requires an equivalent audit. | ISO 50001, ISO 14001 |
| CSEC — Sveriges Certifieringsorgan för IT-säkerhet, an independent unit within FMV (Swedish Defence Materiel Administration) IT security products and systems | Evaluation and certification of IT security products and systems under Common Criteria (ISO/IEC 15408), with internationally recognised certificates. |
Accreditation and recognition
- Styrelsen för ackreditering och teknisk kontroll (Swedac): National accreditation body — a government authority; states that it is a member of EA and of Global Accreditation Cooperation Incorporated, a signatory to the EA MLA for certification of management systems (ISO/IEC 17021-1), products (ISO/IEC 17065) and persons (ISO/IEC 17024), testing and calibration (ISO/IEC 17025), inspection (ISO/IEC 17020) and other areas, and a signatory to the multilateral arrangements for management-system certification with listed sub-areas for ISO 9001, ISO 14001, ISO 45001, ISO 22000, FSSC 22000 part 2, ISO 27001, ISO 13485 and ISO 50001.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Lag (2016:1145) om offentlig upphandling — quality assurance and environmental management standards (15 kap. 14 and 15 §§) (Swedish legislature (contracting authorities apply it)): Where a contracting authority requires a certificate from an independent body that a supplier follows quality assurance standards, it must refer to quality assurance systems based on relevant European standard series and certified by bodies accredited for the task, and accept equivalent certificates from bodies established in the EEA. For environmental management it must refer to EMAS, to other systems recognised under the EMAS Regulation, or to systems based on environmental management standards grounded in relevant European or international standards and certified by accredited bodies.
- Certification as a qualification requirement in public procurement (Swedac (describing how procuring entities may use accreditation)): Swedac states that a procuring entity or authority can require that the supplier, product or process be certified according to a standard, which then becomes a qualification requirement that must be met when the bid is submitted, and that accreditation can also be used in follow-up. Each tender sets its own requirements.
Economic zones
- Port of Gothenburg (port and logistics hub): port logistics, container, ro-ro, bulk and forestry cargo, industry supply chains
- Kista Science City (Stockholm): transformative technology, ICT and research commercialisation
- Medicon Village: life science
Sterling in Sweden
Sterling delivers in Sweden from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Sweden, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Swedish clients ask
Are certification audits in Sweden conducted in Swedish or English?
Either, by agreement. Swedish is the official language, and English is widely used in business, so tell the certification body at application which one you want for the audit and for controlled documents. Swedish-language records are normal in public-sector and healthcare work, and a language clause in a tender or contract overrides personal preference.
Which accreditation should a certification body hold for Sweden?
Look for accreditation from Swedac, the national accreditation body, or from another accreditation body within the international mutual recognition arrangements. Swedac names listed sub-areas for ISO 9001, 14001, 45001, 22000, 27001, 13485 and 50001, but not every standard, so ask the certification body for its accreditation scope covering your standard.
Do Swedish public tenders require ISO certificates?
Not by default. When a contracting authority asks for an independent certificate on quality assurance or environmental management, the procurement act directs it to systems certified by accredited bodies and obliges it to accept equivalent EEA certificates. Whether a certificate is a qualification requirement is for each tender document to say, so read the notice itself.
Is Sweden's NIS2 law in force?
Yes. The Cybersäkerhetslag (2025:1506), issued on 11 december 2025, took effect on 15 januari 2026, together with the Cybersäkerhetsförordning (2025:1507). The law itself says it partly implements the NIS2 Directive. Whether your organisation is covered depends on its sector and size, so confirm that with your counsel or the relevant supervisory authority.
Who supervises the GDPR in Sweden?
Integritetsskyddsmyndigheten (IMY). Förordning (2018:219) names IMY as the supervisory authority under the GDPR and under the supplementing Lag (2018:218), and IMY describes itself as Sweden's data protection authority. Complaints, breach questions and guidance on personal data processing in Sweden all lead there.
Which authorities supervise cybersecurity duties under the Swedish NIS2 law?
It depends on your sector. The Cybersäkerhetsförordning names Energimyndigheten for energy, Transportstyrelsen for transport, Finansinspektionen for banking, the Post- och telestyrelsen for digital infrastructure and others, with county administrative boards covering public administration and several manufacturing sectors. Försvarets radioanstalt is the single point of contact and the CSIRT.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and its Swedish supplementing act — riksdagen.se; imy.se (accessed 7 Oct 2026)
- Accreditation of GDPR certification bodies — riksdagen.se (accessed 7 Oct 2026)
- MSBFS 2020:6 föreskrifter om informationssäkerhet för statliga myndigheter — mcf.se (accessed 7 Oct 2026)
- Cybersäkerhetslag (2025:1506) and Cybersäkerhetsförordning (2025:1507) — riksdagen.se (accessed 7 Oct 2026)
- Regulation (EU) 2022/2554 (DORA) — fi.se (accessed 7 Oct 2026)
- Regulation (EU) 2017/745 (Medical Device Regulation) and Cybersäkerhetslag (2025:1506); Läkemedelsverket states that the manufacturer carries the main responsibility for ensuring that devices are safe — riksdagen.se; lakemedelsverket.se (accessed 7 Oct 2026)
- Own-check for food safety — livsmedelsverket.se (accessed 7 Oct 2026)
- AFS 2023:1 systematiskt arbetsmiljöarbete — av.se (accessed 7 Oct 2026)
- Förordning (1998:901) om verksamhetsutövares egenkontroll — riksdagen.se (accessed 7 Oct 2026)
- Lag (2014:266) om energikartläggning i stora företag — riksdagen.se (accessed 7 Oct 2026)
- Evaluation and certification of IT security products and systems under Common Criteria (ISO/IEC 15408), with internationally recognised certificates — fmv.se (accessed 7 Oct 2026)
- Styrelsen för ackreditering och teknisk kontroll (Swedac) — swedac.se (accessed 7 Oct 2026)
- Lag (2016:1145) om offentlig upphandling — quality assurance and environmental management standards (15 kap. 14 and 15 §§) — riksdagen.se (accessed 7 Oct 2026)
- Certification as a qualification requirement in public procurement — swedac.se (accessed 7 Oct 2026)
- Port of Gothenburg (port and logistics hub) — portofgothenburg.com (accessed 7 Oct 2026)
- Kista Science City (Stockholm) — kistasciencecity.com (accessed 7 Oct 2026)
- Medicon Village — mediconvillage.se (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice