Where we work · Switzerland
ISO and GRC certification consulting in Switzerland
Achieve ISO and GRC certification in Switzerland with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Switzerland
Clients include
ISO and GRC certification in Switzerland at a glance
Demand for certification in Switzerland rests on a few firm legal duties and an exacting buyer base. The revised Federal Act on Data Protection, in force since 1 September 2023, is supervised by the FDPIC and supported by the Data Protection Ordinance. The Information Security Act has required listed critical-infrastructure organisations to report cyberattacks to the Federal Office for Cybersecurity since 1 April 2025, and banks work to FINMA Circular 2023/1 on operational risks and resilience. Medical device makers answer to Swissmedic under the Medical Devices Ordinance, food businesses to HACCP-based rules in the food legislation, and every tender under the Public Procurement Act sets its own eligibility criteria. Demand is strongest in financial services and insurance, pharma and life sciences, medical technology, the mechanical, electrical and metal industries, ICT and food. Certificates are issued by certification bodies, preferably accredited by the Swiss Accreditation Service, and not by Sterling. Sterling's Frankfurt office serves Swiss organisations on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Switzerland
Each page covers who needs the standard in Switzerland, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Switzerland (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Federal Act on Data Protection (FADP; German DSG, French LPD) and Data Protection Ordinance (DPO) Federal Data Protection and Information Commissioner (FDPIC), who supervises the application of the federal data protection regulations | The FADP applies to the processing of personal data of natural persons by private persons and federal bodies, and to circumstances that have an effect in Switzerland even if they were initiated abroad. Controller and processor must guarantee data security appropriate to the risk through technical and organisational measures, keep a record of processing activities, and carry out a data protection impact assessment where processing is likely to result in a high risk. The controller notifies the FDPIC of a data security breach likely to lead to a high risk, as quickly as possible. A private controller with registered office or domicile abroad appoints a representative in Switzerland where the processing meets the conditions of the Act. Private controllers may appoint a data protection officer. The controller must satisfy itself that a processor can guarantee data security. The DPO sets criteria for assessing the protection need, the risk and the measures. | |
| Ordinance on Data Protection Certification (DPCO) Swiss Accreditation Service (SAS) accredits certification bodies and consults the FDPIC on the accreditation procedure; the FDPIC recognises foreign certification bodies | Controllers, processors and manufacturers of data processing systems may have their systems, products and services evaluated by recognised independent certification bodies; this is optional. Certification bodies must be accredited, with separate accreditation for management systems and for products, services and processes. Management systems, products, services and processes may be certified. | |
| EU General Data Protection Regulation (GDPR) as an international legal basis Supervisory authorities of the EU member states concerned; in Switzerland the FDPIC | The FDPIC lists the GDPR among the international legal bases on its website. Switzerland is not an EU member state, and whether the GDPR also applies to a Swiss organisation depends on that organisation's activities involving people in the EU, which counsel should assess. | |
| Federal Office for Cybersecurity (BACS) Critical-infrastructure organisations: banks, insurers and financial market infrastructures, hospitals on cantonal lists, licensed medical laboratories, medicinal-product manufacturers, energy, rail, civil aviation, drinking water and others | Information Security Act (Bundesgesetz vom 18. Dezember 2020 über die Informationssicherheit, ISG), SR 128 — the duty to report cyberattacks to the BACS, in force since 1 April 2025; the Act lists the authorities and organisations covered and the BACS tells interested organisations whether they are covered. | |
| Swiss Financial Market Supervisory Authority (FINMA) Banks and securities firms | FINMA Circular 2023/1 'Operational risks and resilience – banks' (Rundschreiben 2023/1 'Operationelle Risiken und Resilienz – Banken'), adopted 7 December 2022 and in force from 1 January 2024; it covers ICT risk, cyber risk and business continuity management, and expects cyber risk aspects to be covered according to internationally recognised standards and practices without naming ISO/IEC 27001 or ISO 22301. | |
| Swiss Agency for Therapeutic Products (Swissmedic) Medical device manufacturers, authorised representatives, importers and distributors | Medical Devices Ordinance of 1 July 2020 (MedDO), SR 812.213 — applies requirements of Regulation (EU) 2017/745 by reference, includes quality management system requirements for economic operators, requires a foreign manufacturer to have an authorised representative domiciled in Switzerland, and lets Swissmedic designate conformity assessment bodies. ISO 13485 is not named in the text. | |
| Federal Food Safety and Veterinary Office (FSVO, BLV), which approves industry guidelines under the LGV Food businesses that produce, process or treat food | Food and Utility Articles Ordinance (LGV), SR 817.02 — anyone who produces, processes or treats food applies one or more procedures based on the HACCP system or its principles, in a form adapted to the safety risk and production scale, with exceptions for primary production and small direct sellers of own primary products; the EDI Hygiene Ordinance (HyV), SR 817.024.1, requires staff responsible for HACCP-based procedures to be adequately trained. Industry guidelines approved by the FSVO may be used as an alternative. | HACCP |
| Federal Office of Public Health (FOPH) and certification bodies accredited under the EPDV Communities, primary communities and access portals in the electronic patient record | Ordinance on the Electronic Patient Record (EPDV), SR 816.11, and the FDHA ordinance EPDV-EDI, SR 816.111 — bodies that certify communities, primary communities and access portals must be accredited for the auditing and certification of management systems by the Swiss Accreditation Service, by a foreign accreditation body that is a member of European co-operation for Accreditation, or by a body recognised on the basis of an international agreement. | |
| Federal Council ordinance under the Federal Act on Accident Insurance All employers with employees working in Switzerland | Ordinance on the Prevention of Accidents and Occupational Diseases (VUV), SR 832.30 — the employer must take all protective measures required by the Ordinance and recognised occupational safety and occupational medicine rules, check their effectiveness at suitable intervals, and call in occupational physicians and other occupational safety specialists where necessary. | |
| Confederation and cantons under the Energy Act Large energy consumers and energy-intensive businesses | Energy Act (EnG), SR 730.0 — the grid surcharge is refunded only to end consumers that have committed in a target agreement with the Confederation to increase energy efficiency and report regularly; the cantons issue rules on agreements with large consumers on energy efficiency targets. ISO 50001 is not named in the Act. | |
| Courts and criminal prosecution authorities All undertakings (bribery and corruption risk) | Swiss Criminal Code of 21 December 1937, SR 311.0 — for listed offences including bribery of private-sector employees, an undertaking is penalised irrespective of the liability of any natural person if it failed to take all the reasonable organisational measures required to prevent the offence. | |
| Federal Data Protection and Information Commissioner (FDPIC) Providers, developers and users of AI-supported data processing | The FDPIC states that the Federal Data Protection Act is technology-neutral and directly applicable to AI-supported data processing, and advises manufacturers, providers and users to ensure that affected individuals keep the greatest possible control over their personal data. |
Accreditation and recognition
- Swiss Accreditation Service (SAS, Schweizerische Akkreditierungsstelle), part of the State Secretariat for Economic Affairs (SECO): National accreditation body — assesses and accredits conformity assessment bodies (testing laboratories, inspection bodies and certification bodies) on the basis of the relevant international standards; accreditation is governed by the Accreditation and Designation Ordinance of 17 June 1996 (AccDO), SR 946.512.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Federal Act on Public Procurement (PPA), SR 172.056.1 — eligibility criteria (Swiss Confederation (federal contracting authorities apply it)): The contracting authority sets the tenderer eligibility criteria in full in the invitation to tender or tender documentation. They must be objectively necessary and verifiable for the project, may relate to professional, financial, economic, technical and organisational capacity and experience, and the authority specifies the evidence required. The Act does not itself require an ISO certificate.
- simap.ch (Swiss Confederation, cantons and communes (joint procurement platform)): The procurement platform of the public sector in Switzerland, where tenders of the Confederation, cantons, communes and government-associated organisations are published and where offers can be submitted online; each tender sets its own requirements.
- Federal Act on Public Procurement (PPA) — workplace safety, environmental law and anti-corruption (Swiss Confederation (federal contracting authorities apply it)): For goods, work and services provided in Switzerland the contracting authority awards a contract only to tenderers that comply with workplace health and safety regulations, employment terms, equal pay and environmental law; the authority also takes measures against conflicts of interest, unlawful agreements affecting competition and corruption.
Economic zones
- Mechanical, electrical and metal industries (MEM): machinery, electrical engineering, metal processing
- Medical technology: medical devices, medtech suppliers
- Biotech and pharma: biotechnology, pharmaceuticals, life sciences
- Finance: banking, insurance, financial services
- ICT and digital: information and communication technology, digital services
- Food: food production, food exports
Sterling in Switzerland
Sterling delivers in Switzerland from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Switzerland, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Swiss clients ask
Are certification audits in Switzerland conducted in German, French, Italian or English?
The language is agreed with the certification body. Switzerland has several national languages, and English is common in international groups, banks and technology firms, so tell the certification body at application which language you want for the audit and for controlled documents. Follow any language set in a tender, a regulator's correspondence or a customer contract.
Which accreditation should a certification body hold for Switzerland?
Look for accreditation by the Swiss Accreditation Service (SAS), the national accreditation body inside SECO. SECO describes SAS as a member of European co-operation for Accreditation and lists its scopes under the Global ACI arrangement. Accreditation is scope-specific, so check on the SAS list that the body is accredited for your standard and sector.
Who supervises the revised Federal Act on Data Protection?
The Federal Data Protection and Information Commissioner (FDPIC) supervises the application of the federal data protection regulations. The revised Act has been in force since 1 September 2023 and is supported by the Data Protection Ordinance. Private controllers deal with the FDPIC for breach notifications and oversight, and the Commissioner is the first stop for questions about the Act.
Does Swiss data protection law require a data protection certificate?
No. Certification under the FADP is optional: the Act says controllers, processors and manufacturers may have their systems, products and services evaluated by recognised independent certification bodies. Those bodies must be accredited, and management systems and products need separate accreditation. Whether a certificate suits your situation is a decision for your counsel and customers.
Must Swiss companies report cyberattacks?
Some must. Under the Information Security Act, listed authorities and organisations have to see that cyberattacks on their IT are reported to the Federal Office for Cybersecurity (BACS), and the duty has applied since 1 April 2025. The list covers banks, insurers, hospitals, medicinal-product manufacturers and energy, rail and aviation operators, among others. The BACS can tell you whether you are covered.
Do Swiss public tenders require ISO certificates?
Not as a general rule. Under the Public Procurement Act each contracting authority sets its own eligibility criteria, which must be objectively necessary and verifiable, and it states the evidence it wants. An ISO certificate may be accepted as such evidence where a tender asks for it, so read the tender documents published on simap.ch before deciding.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Federal Act on Data Protection (FADP; German DSG, French LPD) and Data Protection Ordinance (DPO) — fedlex.admin.ch; edoeb.admin.ch (accessed 7 Oct 2026)
- Ordinance on Data Protection Certification (DPCO) — fedlex.admin.ch (accessed 7 Oct 2026)
- EU General Data Protection Regulation (GDPR) as an international legal basis — edoeb.admin.ch (accessed 7 Oct 2026)
- Information Security Act (Bundesgesetz vom 18. Dezember 2020 über die Informationssicherheit, ISG), SR 128 — fedlex.admin.ch (accessed 7 Oct 2026)
- FINMA Circular 2023/1 'Operational risks and resilience – banks' (Rundschreiben 2023/1 'Operationelle Risiken und Resilienz – Banken'), adopted 7 December 2022 and in force from 1 January 2024; it covers ICT risk, cyber risk and business continuity management, and expects cyber risk aspects to be covered according to internationally recognised standards and practices without naming ISO/IEC 27001 or ISO 22301. — finma.ch (accessed 7 Oct 2026)
- Medical Devices Ordinance of 1 July 2020 (MedDO), SR 812.213 — fedlex.admin.ch (accessed 7 Oct 2026)
- Food and Utility Articles Ordinance (LGV), SR 817.02 — fedlex.admin.ch (accessed 7 Oct 2026)
- Ordinance on the Electronic Patient Record (EPDV), SR 816.11, and the FDHA ordinance EPDV-EDI, SR 816.111 — fedlex.admin.ch (accessed 7 Oct 2026)
- Ordinance on the Prevention of Accidents and Occupational Diseases (VUV), SR 832.30 — fedlex.admin.ch (accessed 7 Oct 2026)
- Energy Act (EnG), SR 730.0 — fedlex.admin.ch (accessed 7 Oct 2026)
- Swiss Criminal Code of 21 December 1937, SR 311.0 — fedlex.admin.ch (accessed 7 Oct 2026)
- The FDPIC states that the Federal Data Protection Act is technology-neutral and directly applicable to AI-supported data processing, and advises manufacturers, providers and users to ensure that affected individuals keep the greatest possible control over their personal data. — edoeb.admin.ch (accessed 7 Oct 2026)
- Swiss Accreditation Service (SAS, Schweizerische Akkreditierungsstelle), part of the State Secretariat for Economic Affairs (SECO) — seco.admin.ch; sas.admin.ch (accessed 7 Oct 2026)
- Federal Act on Public Procurement (PPA), SR 172.056.1 — eligibility criteria — fedlex.admin.ch (accessed 7 Oct 2026)
- simap.ch — simap.ch (accessed 7 Oct 2026)
- Federal Act on Public Procurement (PPA) — workplace safety, environmental law and anti-corruption — fedlex.admin.ch (accessed 7 Oct 2026)
- Mechanical, electrical and metal industries (MEM) — s-ge.com (accessed 7 Oct 2026)
- Medical technology — s-ge.com (accessed 7 Oct 2026)
- Biotech and pharma — s-ge.com (accessed 7 Oct 2026)
- Finance — s-ge.com (accessed 7 Oct 2026)
- ICT and digital — s-ge.com (accessed 7 Oct 2026)
- Food — s-ge.com (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice