Where we work · Timor-Leste
ISO and GRC certification consulting in Timor-Leste
Achieve ISO and GRC certification in Timor-Leste with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Jakarta office team
- Effivity and Academy included
Sectors that ask for certification in Timor-Leste
Clients include
ISO and GRC certification in Timor-Leste at a glance
Suppliers to Timor-Leste's public bodies work under a Public Procurement Code, approved by Decree-Law No. 1/2025 and amended by Decree-Law No. 25/2025, and each tender sets its own evidence of supplier quality. Elsewhere the rules are sector by sector. Law No. 11/2023 sets workplace safety duties, the National Environmental Licensing Authority handles environmental licensing, AIFAESA inspects food and other economic activity, and Banco Central de Timor-Leste supervises banks and the payment system. TIC TIMOR supervises e-commerce and electronic signatures under Decree-Law No. 12/2024, and the Anti-Corruption Commission applies Law No. 7/2020. The Instituto para a Qualidade de Timor-Leste is the national regulator for standardisation and metrology but has no accreditation role in its organic Article, so management system certificates usually rely on accreditation from another economy. Coffee is the main non-oil export, according to a 2024 ILO study. Sterling's Jakarta office serves clients here, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Timor-Leste
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Timor-Leste (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Instituto para a Qualidade de Timor-Leste, I.P. (IQTL) Quality, standardisation and metrology | Article 32 of Decree-Law No. 12/2019 of 14 June on the organic structure of the Ministry of Tourism, Commerce and Industry, as amended and republished by Decree-Law No. 66/2020 of 22 December. It describes IQTL as a public institute with administrative and financial autonomy and as the national regulatory entity for qualification, standardisation and metrology (the Portuguese text says "qualificação, normalização e metrologia"). IQTL implements and manages the national quality system, promotes activities that demonstrate the credibility of economic operators and serves as the national metrology laboratory. Article 2 tasks the ministry with promoting national and international rules on standardisation, metrology and quality control. Article 32 does not mention accreditation, certification or conformity assessment. | |
| Autoridade de Inspeção e Fiscalização da Atividade Económica, Sanitária e Alimentar, I.P. (AIFAESA) Food businesses and other economic activity | Decree-Law No. 26/2016 of 29 June created AIFAESA. A Prime Ministerial dispatch of 20 June 2017 (Despacho No. 079/2017/VI/PM) describes its mission as inspection and oversight of economic activities in the food and non-food sectors, including the sanitation of establishments and public-utility locations. The Government's 2023 decree on the rice price intervention names AIFAESA among the bodies that monitor and enforce it. Neither text names HACCP or ISO 22000, so confirm the rules for your product with the authority. | |
| The inspection body of the government department responsible for labour Employers and workplaces | Law No. 11/2023 of 19 April on safety, health and hygiene at work, published in Série I, No. 15 of the Jornal da República and in force from the day after publication. It applies to all workplaces and to the public, private, cooperative and social sectors. Employers build risk assessment into their activities, set first aid, firefighting and evacuation measures, and notify the inspection body and the safety committee of an accident or occupational disease by the next working day. Safety committees are mandatory in companies with more than 20 workers or with special risks. The Law refers to a national system for preventing occupational risks and does not mention a formal management system standard. | |
| National Environmental Licensing Authority (Autoridade Nacional de Licenciamento Ambiental, I.P.) Operations with environmental impact | Decree-Law No. 5/2011 of 9 February on environmental licensing, amended by Decree-Law No. 39/2022 of 8 June (first amendment). Decree-Law No. 41/2022 of 8 June, published in the same issue of the Jornal da República, creates the National Environmental Licensing Authority and approves its statutes. The issue's table of contents gives the titles; confirm the licensing categories that apply to your activity with the Authority. | |
| Banco Central de Timor-Leste (BCTL) Banks and payment service providers | BCTL's own site describes its functions as maintaining domestic price stability, fostering the liquidity and solvency of a market-based banking system, executing foreign exchange policy and promoting a safe and efficient payment system. Its Board decides on licences, and its site lists real-time transfers (R-TiMOR), a national card and mobile switch, digital wallets, ATM and EFTPOS networks and agent networks among the payment channels. BCTL's pages name no ISO standard or PCI DSS requirement. | |
| Agência de Tecnologias de Informação e Comunicação I.P. (TIC TIMOR) E-commerce and electronic signature providers | Decree-Law No. 12/2024 of 13 February, the General Legal Regime for E-Commerce and Electronic Signatures. Its preamble assigns supervision of e-commerce and electronic signatures, including sanction proceedings, to TIC TIMOR. It defines the certification entities that issue signature certificates and the public authority competent to accredit and supervise them, and Article 5 applies Timorese law to goods or services aimed at the national territory wherever the supplier is based. The provisions covered here name no ISO standard. | |
| Interministerial Commission on Cybersecurity and Digitalisation of State Services (CICDE) Cybersecurity and digitalisation of State services | Prime Ministerial Despacho No. 11/PM/VIII/2026 of 6 August 2026 creates the Commission, replacing an earlier interministerial group. Its scope covers cybersecurity, cyberspace regulation, data protection, cybercrime and the digitalisation of State services. It is a body for coordination, guidance and oversight and carries out no executive functions; ministries and public entities stay responsible for their own projects. Its tasks include common standards for digital systems and due diligence criteria for private suppliers. The Despacho names no ISO standard. | |
| Comissão Anti-Corrupção (CAC) Organisations dealing with public bodies and private-sector integrity | Law No. 7/2020 of 26 August on measures to prevent and combat corruption (Série I, No. 35 of the Jornal da República). Its prevention duties for private entities encourage codes of conduct and corporate governance, beneficial-owner information and a post-employment restriction for former officials, and statutory auditors must report suspected corruption. Law No. 1/2024 of 8 May, the second amendment to Law No. 8/2009 on the Anti-Corruption Commission, changes the Commission's own law. The text uses no term for compliance programmes and names no ISO standard. | |
| Ministry of Health, through its licensing and inspection offices Private health units | Decree-Law No. 23/2020 of 10 June, first amendment to Decree-Law No. 18/2004 of 1 December on private health units. Licence applications list medical materials and equipment, and the Ministry's licensing office keeps a database of private units while its inspection and audit office conducts site visits. The decree names no quality management standard. | |
| TradeInvest Timor-Leste, I.P. Investors, exporters and new businesses | Government Decree No. 2/2018 of 21 February, the Regulation of Procedures for Private Investment, which implements Law No. 15/2017 (the Private Investment Law). It names TradeInvest as the body that promotes, facilitates and monitors private investment, issues declarations of benefits and keeps the registers of investments and special investment agreements, and it provides support with commercial registration, licences, visas and permits. |
Accreditation and recognition
- Instituto para a Qualidade de Timor-Leste, I.P. (IQTL): National regulatory entity for qualification, standardisation and metrology and the national metrology laboratory, under Article 32 of Decree-Law No. 12/2019 as amended and republished by Decree-Law No. 66/2020. The Article mentions no accreditation function.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Code (Código do Aprovisionamento e dos Contratos Públicos) (Government of Timor-Leste): Approved by Decree-Law No. 1/2025 of 8 January. Decree-Law No. 25/2025 of 13 August amends it, sets its entry into force at 1 January 2026, validates acts and contracts made under it from 1 June 2025, and lets procedures opened but not concluded in that interval continue under Decree-Law No. 22/2022 of 11 May. The amending decree-law deals with entry into force and transition, not supplier certification; each tender document sets its own supplier evidence, so check what the bidding document asks for.
Economic zones
- Special Administrative Region of Oe-Cusse Ambeno and Special Zone of Social Market Economy (RAEOA-ZEESM):
- Industrial parks under the legal regime for industrial parks: industrial activity
Sterling in Timor-Leste
Sterling delivers in Timor-Leste from its Jakarta office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Timor-Leste clients ask
Who deals with quality and standards in Timor-Leste?
The Instituto para a Qualidade de Timor-Leste, a public institute. Its organic provisions call it the national regulatory entity for qualification, standardisation and metrology, give it the job of running the national quality system and make it the national metrology laboratory. They mention no accreditation or certification function. Ask the institute, or the certification body you shortlist, how a given certificate will be recognised by your buyers.
Is there a national accreditation body in Timor-Leste?
None is named in the organic law for the quality institute, whose Article describes no accreditation role. JAS-ANZ reports a cooperation agreement with the institute on quality infrastructure and conformity assessment capability. In practice certificates for Timorese organisations usually carry accreditation from another economy, so check the certification body's accreditation scope and whether your buyer accepts it.
Which law sets workplace safety duties in Timor-Leste?
Law No. 11/2023 of 19 April on safety, health and hygiene at work. It covers all workplaces across public, private, cooperative and social sectors. Employers include risk assessment in their activities, plan first aid and evacuation, report accidents by the next working day and, above a size or risk threshold, form a safety committee. It does not require a management system standard, though ISO 45001 can organise the duties.
Which authority inspects food businesses in Timor-Leste?
The Autoridade de Inspeção e Fiscalização da Atividade Económica, Sanitária e Alimentar, known as AIFAESA, created by Decree-Law No. 26/2016. A 2017 Prime Ministerial dispatch gives its mission as inspecting and overseeing economic activities in food and non-food sectors, including sanitation of establishments. The Decree-Law and the dispatch name no HACCP rule, so confirm product-specific requirements with the authority.
Do public tenders in Timor-Leste ask for ISO certificates?
That varies from one tender to the next. Public contracts fall under the Procurement Code that Decree-Law No. 1/2025 approved and Decree-Law No. 25/2025 amended, while the bidding document lists the proof a supplier must supply. A certificate can count in one competition and carry no weight in another, so read the document first.
Are audits in Timor-Leste run in Tetum, Portuguese or English?
Tetum and Portuguese are both official, and the gazette prints laws in Portuguese, so expect documents in either; the decree on private investment procedures is also available in English. Settle the working language, interpreter needs and the language of controlled documents with the certification body when you apply, so that staff on site and auditors understand each other.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Article 32 of Decree-Law No. 12/2019 of 14 June on the organic structure of the Ministry of Tourism, Commerce and Industry, as amended and republished by Decree-Law No. 66/2020 of 22 December. It describes IQTL as a public institute with administrative and financial autonomy and as the national regulatory entity for qualification, standardisation and metrology (the Portuguese text says "qualificação, normalização e metrologia"). IQTL implements and manages the national quality system, promotes activities that demonstrate the credibility of economic operators and serves as the national metrology laboratory. Article 2 tasks the ministry with promoting national and international rules on standardisation, metrology and quality control. Article 32 does not mention accreditation, certification or conformity assessment. — mj.gov.tl (accessed 18 Oct 2026)
- Decree-Law No. 26/2016 of 29 June created AIFAESA. A Prime Ministerial dispatch of 20 June 2017 (Despacho No. 079/2017/VI/PM) describes its mission as inspection and oversight of economic activities in the food and non-food sectors, including the sanitation of establishments and public-utility locations. The Government's 2023 decree on the rice price intervention names AIFAESA among the bodies that monitor and enforce it. Neither text names HACCP or ISO 22000, so confirm the rules for your product with the authority. — mj.gov.tl (accessed 18 Oct 2026)
- Law No. 11/2023 of 19 April on safety, health and hygiene at work, published in Série I, No. 15 of the Jornal da República and in force from the day after publication. It applies to all workplaces and to the public, private, cooperative and social sectors. Employers build risk assessment into their activities, set first aid, firefighting and evacuation measures, and notify the inspection body and the safety committee of an accident or occupational disease by the next working day. Safety committees are mandatory in companies with more than 20 workers or with special risks. The Law refers to a national system for preventing occupational risks and does not mention a formal management system standard. — mj.gov.tl (accessed 18 Oct 2026)
- Decree-Law No. 5/2011 of 9 February on environmental licensing, amended by Decree-Law No. 39/2022 of 8 June (first amendment). Decree-Law No. 41/2022 of 8 June, published in the same issue of the Jornal da República, creates the National Environmental Licensing Authority and approves its statutes. The issue's table of contents gives the titles; confirm the licensing categories that apply to your activity with the Authority. — mj.gov.tl (accessed 18 Oct 2026)
- BCTL's own site describes its functions as maintaining domestic price stability, fostering the liquidity and solvency of a market-based banking system, executing foreign exchange policy and promoting a safe and efficient payment system. Its Board decides on licences, and its site lists real-time transfers (R-TiMOR), a national card and mobile switch, digital wallets, ATM and EFTPOS networks and agent networks among the payment channels. BCTL's pages name no ISO standard or PCI DSS requirement. — bancocentral.tl (accessed 18 Oct 2026)
- Decree-Law No. 12/2024 of 13 February, the General Legal Regime for E-Commerce and Electronic Signatures. Its preamble assigns supervision of e-commerce and electronic signatures, including sanction proceedings, to TIC TIMOR. It defines the certification entities that issue signature certificates and the public authority competent to accredit and supervise them, and Article 5 applies Timorese law to goods or services aimed at the national territory wherever the supplier is based. The provisions covered here name no ISO standard. — tic.gov.tl (accessed 18 Oct 2026)
- Prime Ministerial Despacho No. 11/PM/VIII/2026 of 6 August 2026 creates the Commission, replacing an earlier interministerial group. Its scope covers cybersecurity, cyberspace regulation, data protection, cybercrime and the digitalisation of State services. It is a body for coordination, guidance and oversight and carries out no executive functions; ministries and public entities stay responsible for their own projects. Its tasks include common standards for digital systems and due diligence criteria for private suppliers. The Despacho names no ISO standard. — mj.gov.tl (accessed 18 Oct 2026)
- Law No. 7/2020 of 26 August on measures to prevent and combat corruption (Série I, No. 35 of the Jornal da República). Its prevention duties for private entities encourage codes of conduct and corporate governance, beneficial-owner information and a post-employment restriction for former officials, and statutory auditors must report suspected corruption. Law No. 1/2024 of 8 May, the second amendment to Law No. 8/2009 on the Anti-Corruption Commission, changes the Commission's own law. The text uses no term for compliance programmes and names no ISO standard. — mj.gov.tl (accessed 18 Oct 2026)
- Decree-Law No. 23/2020 of 10 June, first amendment to Decree-Law No. 18/2004 of 1 December on private health units. Licence applications list medical materials and equipment, and the Ministry's licensing office keeps a database of private units while its inspection and audit office conducts site visits. The decree names no quality management standard. — mj.gov.tl (accessed 18 Oct 2026)
- Government Decree No. 2/2018 of 21 February, the Regulation of Procedures for Private Investment, which implements Law No. 15/2017 (the Private Investment Law). It names TradeInvest as the body that promotes, facilitates and monitors private investment, issues declarations of benefits and keeps the registers of investments and special investment agreements, and it provides support with commercial registration, licences, visas and permits. — customs.gov.tl (accessed 18 Oct 2026)
- Instituto para a Qualidade de Timor-Leste, I.P. (IQTL) — mj.gov.tl; jasanz.org (accessed 18 Oct 2026)
- Public Procurement Code (Código do Aprovisionamento e dos Contratos Públicos) — mj.gov.tl (accessed 18 Oct 2026)
- Special Administrative Region of Oe-Cusse Ambeno and Special Zone of Social Market Economy (RAEOA-ZEESM) — mj.gov.tl (accessed 18 Oct 2026)
- Industrial parks under the legal regime for industrial parks — mj.gov.tl (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Jakarta team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
indonesia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice