Where we work · Thailand
ISO and GRC certification consulting in Thailand
Achieve ISO and GRC certification in Thailand with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Manila office team
- Effivity and Academy included
Sectors that ask for certification in Thailand
Clients include
ISO and GRC certification in Thailand at a glance
Thai demand for management system certification and compliance work comes from three directions at once: export customers, investment promotion and a regulator-driven financial sector. The Board of Investment's Investment Promotion Guide 2025 ties tax incentives for certain food, medical device, pharmaceutical and environmental activities to certification such as ISO 22000, HACCP and GMP, ISO 13485 and an international environmental standard. The Bank of Thailand sets IT risk and payment-system security rules for banks and payment providers, and the Personal Data Protection Act, B.E. 2562 (2019), is overseen by the Personal Data Protection Committee. The Eastern Economic Corridor targets automotive, digital, medical, food and aviation clusters, which pull in manufacturers and suppliers. Certificates come from accredited certification bodies; the National Standardization Council and the food standards bureau ACFS are the accreditation bodies recorded for management systems, and the Bureau of Laboratory Accreditation covers testing laboratories. Sterling, with 20+ years of experience and 8,100+ client engagements in 60+ countries, serves Thai clients from its Manila office, on site where the work needs it, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Thailand
Each page covers who needs the standard in Thailand, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Thailand (6)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act, B.E. 2562 (2019) (PDPA) Personal Data Protection Committee and its Office (PDPC) | Thailand's general personal data protection law. The PDPC site publishes the Act in English together with its subordinate legislation and notifications; the instrument name is as the PDPC prints it. | |
| PDPC notification on criteria for the protection of personal data sent or transferred to a foreign country Personal Data Protection Committee | Subordinate legislation under the PDPA dealing with transfers of personal data to other countries; the title is as printed on the PDPC site. The criteria themselves were not read in full. | |
| Bank of Thailand Banks and other financial institutions under the Financial Institution Business Act | Notification of the Bank of Thailand No. FPG. 19/2560, Regulations on Information Technology Risk of Financial Institutions — covers IT governance, security controls, risk management, compliance and audit; policies must be in line with international standards or generally accepted frameworks, and service providers are expected to hold certification according to international standards or generally accepted IT standards. It does not name ISO/IEC 27001 or any ISO standard number. | |
| Bank of Thailand Providers of highly important payment systems, designated payment systems and designated payment services | Notification of the Bank of Thailand No. SorNorChor. 11/2561 on the security of information technology systems — four areas: access control and authentication, information confidentiality and system integrity, service availability, and security audit of IT systems; written board-approved security policies and regular security audit with results submitted to the Bank of Thailand. It refers to international standard guidelines in general terms and does not name ISO/IEC 27001, ISO 22301 or PCI DSS. | |
| Food and Drug Administration (Thai FDA), Ministry of Public Health Manufacturers and importers of medical devices | Medical Devices Act, B.E. 2551 (2008) and Medical Devices Act (No. 2), B.E. 2562 (2019) — manufacture and import need an establishment licence and a product licence; certain products need a selling licence. The Thai FDA FAQ page read does not state ISO 13485 or a quality system certificate as a licensing prerequisite. | |
| Office of the National Anti-Corruption Commission (NACC) Businesses that could be liable for bribing public officials | NACC guidance on corporate liability: an entity that has appropriate internal control measures to prevent bribery is not held liable under the provision described; the NACC page lists eight measures — leadership commitment, risk assessment, controls over high-risk areas such as gifts, entertainment and donations, third-party management, accounting systems, alignment of HR practice, reporting channels and regular review. The page does not name ISO 37001. |
Accreditation and recognition
- National Standardization Council of Thailand (NSC), whose office sits within the Thai Industrial Standards Institute (TISI), Ministry of Industry: National accreditation body for certification bodies, inspection bodies and laboratories (its impartiality policy cites the National Standardization Act, B.E. 2551 (2008) and ISO/IEC 17011); ILAC describes NSC-TISI as a full member signatory to the ILAC MRA and to the international mutual recognition arrangement for management systems certification.
- National Bureau of Agricultural Commodity and Food Standards (ACFS), Ministry of Agriculture and Cooperatives — Office of Standard Accreditation: Accreditation body for food-sector certification; recorded on the management systems certification arrangement's member list with ISO/IEC 17021-1, ISO 22003-1 and ISO 22000 (FSMS), and product certification under ISO/IEC 17065.
- Bureau of Laboratory Accreditation, Department of Science Service (BLA-DSS): Laboratory accreditation to ISO/IEC 17025, with proficiency testing providers (ISO/IEC 17043) and reference material producers (ISO 17034); signatory to the APLAC MRA and ILAC MRA since 2006 and a signatory of the Global ACI mutual recognition arrangement annex for those three scopes.
- Bureau of Laboratory Quality Standards, Department of Medical Sciences (BLQS-DMSc), Ministry of Public Health: Accreditation of medical laboratories; ILAC describes it as holding ILAC MRA signatory status only, with a single-platform accreditation arrangement agreed with the other Thai accreditation bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Board of Investment (BOI) investment promotion — Investment Promotion Guide 2025 (Board of Investment of Thailand (One Start One Stop Investment Center, OSOS)): For several promoted activities the guide makes a certification a condition before the corporate income tax exemption can be used: food safety management system standard such as ISO 22000 or other standards accepted by the Global Food Safety Initiative (food activities), HACCP and GMP (food activities), a medical device international standard such as ISO 13485 or equivalent (medical devices), GMP in line with PIC/S (pharmaceutical manufacture) and an international environmental standard such as ISO 14000 or equivalent.
Economic zones
- Eastern Economic Corridor (EEC) and its Special Economic Promotion Zones: medical and comprehensive healthcare, digital, including intelligent electronics, automation and robotics, and defence, next-generation automotive, BCG economy, including green economy, biofuel and biochemical, advanced agriculture and biotechnology, and food for the future, services, including high-value and medical tourism, aviation and logistics, and education
- Industrial estates of the Industrial Estate Authority of Thailand (IEAT): manufacturing, industrial services
Sterling in Thailand
Sterling delivers in Thailand from its Manila office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Thailand, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Thai clients ask
Are certification audits in Thailand conducted in Thai or English?
Either can work. Thai is the official language, and English is common in multinationals, exporters and technology firms, so the audit language and the language of controlled documents are agreed with the certification body when you apply. Front-line instructions, such as safety or food-handling procedures, are normally also needed in Thai, and a regulator or customer may set its own rule.
Which Thai bodies accredit certification bodies?
Two are recorded. The National Standardization Council (NSC), whose office sits in TISI, has recorded scopes for ISO 9001, ISO 14001 and ISO 50001. ACFS, the agricultural commodity and food standards bureau, has ISO 22000 food safety scopes. For ISO/IEC 27001 and other standards, read the certification body's own accreditation certificate rather than assuming coverage.
Which body accredits laboratories in Thailand?
The Bureau of Laboratory Accreditation at the Department of Science Service (BLA-DSS) accredits testing and calibration laboratories to ISO/IEC 17025. The Bureau of Laboratory Quality Standards (BLQS-DMSc) handles medical laboratories, and NSC-TISI accredits laboratories as well. Which one suits you depends on your scope and your customers' acceptance.
Does Thai investment promotion require ISO certification?
For some activities, yes. The BOI's Investment Promotion Guide 2025 makes certification a condition for food activities (ISO 22000 or a GFSI-accepted standard, HACCP and GMP), medical devices (ISO 13485), pharmaceutical manufacture (GMP in line with PIC/S) and an international environmental standard. The guide names no such condition for ISO 9001 or ISO/IEC 27001. Check the activity you plan with the BOI.
How does Sterling serve clients in Thailand?
From Sterling's Manila office, which covers Thai engagements. Work is on site where it needs it, for example for a plant or warehouse walk-through, and remote otherwise. Effivity and Sterling Academy are included with the engagement, and the certificate or report still comes from the independent body concerned.
Cities Sterling covers in Thailand
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, B.E. 2562 (2019) (PDPA) — pdpc.or.th; ratchakitcha.soc.go.th (accessed 7 Oct 2026)
- PDPC notification on criteria for the protection of personal data sent or transferred to a foreign country — pdpc.or.th (accessed 7 Oct 2026)
- Notification of the Bank of Thailand No. FPG. 19/2560, Regulations on Information Technology Risk of Financial Institutions — bot.or.th (accessed 7 Oct 2026)
- Notification of the Bank of Thailand No. SorNorChor. 11/2561 on the security of information technology systems — bot.or.th (accessed 7 Oct 2026)
- Medical Devices Act, B.E. 2551 (2008) and Medical Devices Act (No. 2), B.E. 2562 (2019) — en.fda.moph.go.th (accessed 7 Oct 2026)
- NACC guidance on corporate liability: an entity that has appropriate internal control measures to prevent bribery is not held liable under the provision described; the NACC page lists eight measures — nacc.go.th (accessed 7 Oct 2026)
- National Standardization Council of Thailand (NSC), whose office sits within the Thai Industrial Standards Institute (TISI), Ministry of Industry — iaf.nu; ilac.org; tisi.go.th (accessed 7 Oct 2026)
- National Bureau of Agricultural Commodity and Food Standards (ACFS), Ministry of Agriculture and Cooperatives — Office of Standard Accreditation — iaf.nu; ilac.org (accessed 7 Oct 2026)
- Bureau of Laboratory Accreditation, Department of Science Service (BLA-DSS) — dss.go.th; bla.dss.go.th (accessed 7 Oct 2026)
- Bureau of Laboratory Quality Standards, Department of Medical Sciences (BLQS-DMSc), Ministry of Public Health — ilac.org (accessed 7 Oct 2026)
- Board of Investment (BOI) investment promotion — Investment Promotion Guide 2025 — osos.boi.go.th (accessed 7 Oct 2026)
- Eastern Economic Corridor (EEC) and its Special Economic Promotion Zones — eeco.or.th (accessed 7 Oct 2026)
- Industrial estates of the Industrial Estate Authority of Thailand (IEAT) — ieat.go.th (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Manila team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
philippines@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice