Where we work · Taiwan
ISO and GRC certification consulting in Taiwan
Achieve ISO and GRC certification in Taiwan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Tokyo office team
- Effivity and Academy included
Sectors that ask for certification in Taiwan
Clients include
ISO and GRC certification in Taiwan at a glance
Demand for certification and compliance work in Taiwan runs through a handful of public bodies and through supply-chain customers. The Ministry of Digital Affairs administers the Cyber Security Management Act, under which contractors serving government agencies and designated non-government agencies must manage cyber security or obtain impartial third-party certification. The Personal Data Protection Act names the Personal Data Protection Commission as its competent authority, and the commission's Preparatory Office publishes the draft rules that follow. Food businesses answer to the Ministry of Health and Welfare, medical device makers to the Taiwan Food and Drug Administration, whose quality management regulations are prescribed with reference to ISO 13485, and employers to the Ministry of Labor, which runs its own TOSHMS scheme beside ISO 45001. Management system certificates come from certification bodies accredited by the Taiwan Accreditation Foundation or by an accreditation body within the international mutual recognition arrangements, never from Sterling. Electronics and semiconductor suppliers, ICT providers, automotive and machinery makers and listed companies are the usual buyers. Sterling serves Taiwan from its Tokyo office, drawing on 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Taiwan
Each page covers who needs the standard in Taiwan, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Taiwan (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act (PDPA) Personal Data Protection Commission (named as the competent authority in Article 1-1); its Preparatory Office (個人資料保護委員會籌備處) publishes announcements and draft regulations | The Act regulates the collection, processing and use of personal data. Data subjects hold rights to inquire, obtain a copy, correct, stop use and erase (Article 3). Data about medical records, healthcare, genetics, sex life, physical examination and criminal records is restricted to listed bases (Article 6). Agencies must tell data subjects what is collected and why (Articles 8 and 9). A non-government agency that learns personal data has been stolen, altered, damaged, lost or leaked must notify the data subject and, within a specified scope, report to the competent authority (Article 12). Non-government agencies possessing personal data files must implement security and maintenance measures (Article 20-1). The competent authority may restrict cross-border transfers in four listed circumstances (Article 21) and may inspect non-government agencies (Article 22). The database states that the Chinese version prevails over the English version. | |
| Ministry of Digital Affairs (competent authority); Administration for Cyber Security Government agencies and specific non-government agencies (critical infrastructure providers, government-owned enterprises, designated foundations) and their outsourcing contractors | Cyber Security Management Act (amended 2025-09-24 in the law database) — agencies report cyber security responsibility levels and implement protection measures; where they outsource information and communication systems or services, the contractor's procedures and environments must incorporate comprehensive cyber security management measures or obtain impartial third-party certification (Article 10). TAF lists an ISO/IEC 27001 (CNS 27001) Cyber Security Management Act certification scheme and names the Administration for Cyber Security among the authorities that use its accreditation results. | ISO/IEC 27001 |
| Ministry of Health and Welfare Food businesses | Act Governing Food Safety and Sanitation, Article 8 — designated food businesses must comply with the food safety control system and obtain certification of their sanitation and safety management systems from institutions accredited by the central competent authority. Regulations on Food Safety Control System define the system by Hazard Analysis Critical Control Point principles. The certification regulations require a food safety management system certification body to hold accreditation under ISO/TS 22003 from a member of the international accreditation arrangements. | HACCP, ISO 22000 |
| Ministry of Labor (Occupational Safety and Health Administration) Employers and workplaces | Occupational Safety and Health Act, Article 23 — employers whose business reaches a scale set by the central competent authority, or that have workplaces of the kind in Article 15, must establish an occupational safety and health management system. The Ministry runs the voluntary Taiwan Occupational Safety and Health Management System (TOSHMS), for which TAF accredits certification bodies alongside ISO 45001. | ISO 45001 |
| Ministry of Health and Welfare; Taiwan Food and Drug Administration (TFDA) Medical device manufacturers | Medical Devices Act, Article 22 — manufacturers establish a quality management system and may begin manufacture only after a compliance inspection by the central competent authority and a manufacturing licence, unless the item is exempt. The Medical Device Quality Management System Regulations prescribe their standards with reference to ISO 13485. TFDA runs quality management system conformity assessment for domestic manufacturers and QSD conformity assessment for foreign manufacturers of imported devices. | ISO 13485 |
| Ministry of Environment Entities with designated emission sources | Climate Change Response Act — entities designated by the central competent authority conduct emission inventories and submit them to the registry, and for designated entities the inventory data is verified by a verification body, which must hold accreditation from the authority or its appointed accreditation body. The Act does not name ISO 14001. | |
| Financial Supervisory Commission (FSC); Taiwan Stock Exchange and Taipei Exchange Listed companies | FSC sustainability-disclosure roadmap aligning listed companies with IFRS Sustainability Disclosure Standards in phases from financial year 2026, and the FSC's March 2026 statement that, as of the end of 2025, the mandated listed companies had completed greenhouse gas inventory and assurance filings. ISO 14001 is not named. | |
| Ministry of Digital Affairs; National Science and Technology Council Developers and users of artificial intelligence | Artificial Intelligence Basic Act — passed by the Legislative Yuan on 23 December 2025; sets seven principles for government promotion of AI (including privacy protection and data governance, cybersecurity and safety, transparency and explainability, accountability). ISO/IEC 42001 is not named in the Ministry's release. | |
| Ministry of Justice Public servants and those who deal with them | Anti-Corruption Act, Article 11 — tendering a bribe or other unjust valuables to a person subject to the Act in return for acting or omitting to act against official duties is punishable. ISO 37001 is not named. | |
| Ministry of Economic Affairs (Energy Administration) Energy users meeting the level set by the competent authority | Energy Administration Act, Article 9 — an energy user whose consumption meets the level stipulated by the central competent authority must establish its own energy audit system and set energy conservation objectives, carried out upon approval by the authority. ISO 50001 is not named. |
Accreditation and recognition
- Taiwan Accreditation Foundation (TAF): National accreditation body, founded on 17 September 2003 by the Ministry of Economic Affairs; accredits management system certification bodies (ISO/IEC 17021-1), testing and calibration laboratories (ISO/IEC 17025), medical laboratories, inspection bodies, proficiency testing providers, reference material producers, product and personnel certification bodies, validation and verification bodies and biobanks.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Government Procurement Act — tenderer qualifications (Public Construction Commission, Executive Yuan): A procuring entity may prescribe basic qualifications for tenderers according to actual need, and specific qualifications for special or large procurements; it may prescribe only the qualifications essential to contract performance (Articles 36 and 37). The Act does not name ISO certificates; any certificate requirement is set in the individual tender documentation.
- Outsourcing to government agencies and specific non-government agencies under the Cyber Security Management Act (Ministry of Digital Affairs): Contractors that run or maintain systems or provide services for those agencies must have effective cyber security management mechanisms, and their procedures and environments must incorporate comprehensive cyber security management measures or obtain impartial third-party certification (Article 10). A written agreement sets rights, obligations and liability.
Economic zones
- Free trade zones: trade, logistics
- Science parks: high technology
Sterling in Taiwan
Sterling delivers in Taiwan from its Tokyo office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Taiwan, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Taiwanese clients ask
Are certification audits in Taiwan conducted in English or Chinese?
Either can be used, but Mandarin Chinese is the working language of most organisations, and the Ministry of Justice's law database states that the Chinese version of a statute prevails over its English version. Agree the audit language and the language of controlled documents with the certification body when you apply, and follow any language set by a tender or customer contract.
Which accreditation body covers certification bodies in Taiwan?
The Taiwan Accreditation Foundation (TAF) accredits management system certification bodies, and it says its recognition under the international arrangements remains valid. TAF accredits; it does not certify. A body accredited by another accreditation body within the international mutual recognition arrangements is a further option, so ask any body for its accreditation scope before you apply.
Does the Personal Data Protection Act require ISO 27001 or ISO 27701?
No certificate is named. As printed in the Ministry of Justice database, the Act requires non-government agencies that possess personal data files to implement security and maintenance measures, and it leaves the detail to the competent authority. TAF lists a CNS 27701 scheme, so ISO/IEC 27701 is a voluntary benchmark. Confirm the detail with your counsel or the competent authority.
Does the Cyber Security Management Act reach private companies?
Yes, in two ways. It applies directly to specific non-government agencies, a term that covers critical infrastructure providers, government-owned enterprises and designated foundations. Those agencies, like government bodies, must see that outsourcing contractors manage cyber security effectively or obtain impartial third-party certification. The Ministry of Digital Affairs and your sector authority decide which category your business falls in.
Do Taiwanese public tenders require ISO certificates?
Not as a general rule. The Government Procurement Act lets a procuring entity set basic or specific qualifications for tenderers, limited to those essential to contract performance, and it does not name ISO certificates itself. Each tender document states what it asks for, so read its qualification clause before assuming a certificate is needed or will be accepted.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act (PDPA) — law.moj.gov.tw; pdpc.gov.tw (accessed 8 Oct 2026)
- Cyber Security Management Act (amended 2025-09-24 in the law database) — law.moj.gov.tw; taftw.org.tw (accessed 8 Oct 2026)
- Act Governing Food Safety and Sanitation, Article 8 — law.moj.gov.tw (accessed 8 Oct 2026)
- Occupational Safety and Health Act, Article 23 — law.moj.gov.tw; taftw.org.tw (accessed 8 Oct 2026)
- Medical Devices Act, Article 22 — law.moj.gov.tw; fda.gov.tw (accessed 8 Oct 2026)
- Climate Change Response Act — law.moj.gov.tw (accessed 8 Oct 2026)
- FSC sustainability-disclosure roadmap aligning listed companies with IFRS Sustainability Disclosure Standards in phases from financial year 2026, and the FSC's March 2026 statement that, as of the end of 2025, the mandated listed companies had completed greenhouse gas inventory and assurance filings. ISO 14001 is not named. — fsc.gov.tw (accessed 8 Oct 2026)
- Artificial Intelligence Basic Act — moda.gov.tw (accessed 8 Oct 2026)
- Anti-Corruption Act, Article 11 — law.moj.gov.tw (accessed 8 Oct 2026)
- Energy Administration Act, Article 9 — law.moj.gov.tw (accessed 8 Oct 2026)
- Taiwan Accreditation Foundation (TAF) — taftw.org.tw (accessed 8 Oct 2026)
- Government Procurement Act — tenderer qualifications — law.moj.gov.tw (accessed 8 Oct 2026)
- Outsourcing to government agencies and specific non-government agencies under the Cyber Security Management Act — law.moj.gov.tw (accessed 8 Oct 2026)
- Free trade zones — law.moj.gov.tw (accessed 8 Oct 2026)
- Science parks — law.moj.gov.tw (accessed 8 Oct 2026)
Talk to a consultant
Plan your certification with the Tokyo team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
japan@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice