Where we work · United Arab Emirates
ISO and GRC certification consulting in the United Arab Emirates
Achieve ISO and GRC certification in the UAE with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in the UAE
Clients include
ISO and GRC certification in the UAE at a glance
Demand for certification and compliance in the UAE has several sources. The federal Personal Data Protection Law, overseen by the UAE Data Office, sits alongside the DIFC Data Protection Law and the ADGM Data Protection Regulations 2021 in the free zones. Sector rules add pressure: the Dubai Electronic Security Centre for Dubai Government bodies, the Department of Health – Abu Dhabi and its ADHICS Standard for healthcare, TDRA's Information Assurance Regulation for critical entities, and the Central Bank of the UAE for banks, their outsourcing providers and payment services. Dubai Municipality's Food Code expects a HACCP-based food safety programme, and MOHAP asks for ISO 13485 evidence when registering medical device manufacturing sites. In procurement, the Ministry of Industry and Advanced Technology's In-Country Value programme gives extra credit to suppliers holding ISO 14001, 14046 or 50001. Demand is strongest in financial services and fintech, government and semi-government suppliers, healthcare, construction and facilities management, logistics and free-zone trading, IT and managed services, and oil, gas and energy supply. Accredited certification bodies issue certificates; EIAC accredits in Dubai. Sterling's Dubai office brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included. Sterling does not certify.
ISO and GRC standards Sterling delivers in the UAE
Each page covers who needs the standard in the UAE, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in the UAE (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| UAE Personal Data Protection Law (PDPL) UAE Data Office (defined in the law as the body established under Federal Decree by Law No. (44) of 2021) | Federal law. It does not apply to, among others, government data and governmental entities, health and banking/credit data covered by their own legislation, or companies in free zones that have their own personal data protection legislation (such as DIFC and ADGM). Controllers and processors must take appropriate technical and organisational measures to secure personal data. | |
| DIFC Data Protection Law Commissioner of Data Protection (DIFC) | Applies to controllers and processors incorporated in the DIFC, and to processing in the DIFC as part of stable arrangements. | |
| ADGM Data Protection Regulations 2021 ADGM Office of Data Protection | Applies to processing in the context of the activities of an establishment of a controller or processor in ADGM, whether or not the processing takes place in ADGM. | |
| Dubai Electronic Security Centre (DESC) Dubai Government entities, critical non-government entities and the electronic security companies they engage | Law No. (15) of 2024 Concerning the Dubai Electronic Security Centre — DESC develops the Information Security Regulation and oversees compliance; entities may not engage a private electronic security company unless it is certified by DESC. | |
| Department of Health – Abu Dhabi (DoH) Healthcare (Abu Dhabi) — all public and private healthcare facilities and any entity handling health information from the emirate | Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard — mandatory for healthcare facilities; states it is based on international information and cyber security best practice, without naming ISO/IEC 27001. | |
| Telecommunications and Digital Government Regulatory Authority (TDRA) Critical entities under the UAE CIIP Policy | UAE Information Assurance Regulation — management and technical information security controls. | UAE Information Assurance Regulation |
| Central Bank of the UAE (CBUAE) Banks and their outsourcing service providers | Outsourcing Regulation for Banks (Circular No. 14/2021) — banks must ensure outsourcing service providers maintain an appropriate level of information security, risk management and service delivery, and that outsourced critical functions are covered by disaster recovery and business continuity plans. | |
| Central Bank of the UAE (CBUAE) Retail payment service providers and card schemes | Retail Payment Services and Card Schemes Regulation (Circular No. 15/2021) — includes technology risk and information security requirements. | |
| Dubai Municipality (Food Control Department) Food establishments (Dubai) | Food Code — food establishments should implement and maintain a Dubai Municipality approved, documented food safety programme (defined as a food safety management system based on the principles of HACCP), audited by a third-party food safety auditor approved by Dubai Municipality unless waived; at least one certified Person in Charge on site. | HACCP |
| Department of Municipalities and Transport (DMT), as Sector Regulatory Authority Building and construction (Abu Dhabi City) — contractors, consultants and developers | Abu Dhabi Occupational Safety and Health System Framework (OSHAD SF); the page does not cite ISO 45001. | |
| Ministry of Health and Prevention (MOHAP) Medical device manufacturers registering manufacturing sites | Registration of the manufacturing sites of medical products (human) in UAE — required documents include a valid legalised ISO 13485 certificate issued by the competent authority in the country of origin (medical device sites). | ISO 13485 |
| UAE Government Developers and users of artificial intelligence | The UAE Charter for the Development and Use of Artificial Intelligence — priorities include safety, addressing algorithmic bias, data privacy, transparency, human oversight, and governance and accountability. |
Accreditation and recognition
- Emirates International Accreditation Centre (EIAC): Accreditation body (Dubai); accredits management-system certification bodies (ISO/IEC 17021-1), personnel certification bodies, laboratories, inspection bodies and proficiency testing providers; ILAC MRA signatory.
- Emirates National Accreditation System (ENAS): UAE national body for the accreditation of conformity assessment bodies (Ministry of Industry and Advanced Technology): testing and calibration laboratories (ISO/IEC 17025), medical laboratories (ISO 15189), inspection bodies (ISO/IEC 17020), product certification bodies (ISO/IEC 17065) and halal certification bodies (UAE.S 2055-2).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- National In-Country Value (ICV) Program (Ministry of Industry and Advanced Technology (MoIAT)): An ICV certificate stating the supplier's ICV score, issued through the official ICV platform by certifying bodies empanelled by MoIAT, used by government entities and companies that have implemented the programme. The October 2023 supplier certification guidelines state: suppliers holding ISO (14001 or 14046 or 50001) issued by any licensed certifier in UAE are eligible for an additional total ICV of one percent (1%) (goods manufacturers and service providers).
- Federal Supplier Register (Digital Procurement Platform) (Ministry of Finance): Registration is the first step to contracting with federal government entities; it asks for supplier category, trade licence number, tax registration status, banking information and documents. The page does not list ISO certificates; any certificate requirement is set in the individual tender.
Economic zones
- Jebel Ali Free Zone (Jafza): logistics, food and agriculture, petrochemicals, oil and gas, manufacturing, retail and e-commerce
- DMCC (Dubai Multi Commodities Centre): trading, services, industrial
- Dubai International Financial Centre (DIFC): financial services (regulated by the DFSA)
- Abu Dhabi Global Market (ADGM): financial institutions, asset management, fintech, professional services
- Khalifa Economic Zones Abu Dhabi (KEZAD): manufacturing, logistics, food production, automotive, pharmaceuticals, metals
Sterling in the UAE
Sterling delivers in the UAE from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in United Arab Emirates, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions UAE clients ask
Are certification audits in the UAE conducted in English or Arabic?
Either can be used, but English is the usual choice. Arabic is the official language and English is widely used in business, so settle the audit language, and the language of controlled documents, with the certification body at application. Follow any language requirement written into the client's contract or set by its regulator.
Does the UAE PDPL apply to a company in DIFC or ADGM?
Generally not. The federal PDPL excludes companies in free zones that have their own personal data protection legislation. DIFC has the Data Protection Law 2020, with a Commissioner of Data Protection, and ADGM has its 2021 Data Protection Regulations, with an Office of Data Protection. Each applies according to where the entity is established, so confirm which regime governs you with your counsel.
Which accreditation should the certification body hold for the UAE?
Look for a certification body accredited to ISO/IEC 17021-1 for management systems. EIAC in Dubai accredits such bodies and is an ILAC MRA signatory. ENAS, under the Ministry of Industry and Advanced Technology, covers laboratories, inspection, product and halal bodies instead. IAF ceased operations on 1 January 2026, so check the current recognition scope of any body before quoting it.
Do UAE government tenders require ISO certificates?
Not as a general rule. The Ministry of Finance's Federal Supplier Register does not list ISO certificates, and any certificate requirement is set in the individual tender. Separately, the ICV programme from MoIAT offers an additional one percent of total ICV to suppliers holding ISO 14001, 14046 or 50001 from a licensed UAE certifier. Read each tender's own criteria.
Can the audit be scheduled during Ramadan?
Yes, with planning. Ramadan working hours and the Eid holidays affect audit scheduling, and their dates move each year, so never rely on fixed dates. Raise your preferred audit window with the certification body early and ask it to confirm availability against the current year's calendar before you commit your team.
Cities Sterling covers in the UAE
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- UAE Personal Data Protection Law (PDPL) — uaelegislation.gov.ae (accessed 5 Oct 2026)
- DIFC Data Protection Law — government.ae (accessed 5 Oct 2026)
- ADGM Data Protection Regulations 2021 — assets.adgm.com (accessed 5 Oct 2026)
- Law No. (15) of 2024 Concerning the Dubai Electronic Security Centre — dlp.dubai.gov.ae (accessed 5 Oct 2026)
- Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard — doh.gov.ae (accessed 5 Oct 2026)
- UAE Information Assurance Regulation — u.ae (accessed 5 Oct 2026)
- Outsourcing Regulation for Banks (Circular No. 14/2021) — centralbank.ae (accessed 5 Oct 2026)
- Retail Payment Services and Card Schemes Regulation (Circular No. 15/2021) — rulebook.centralbank.ae (accessed 5 Oct 2026)
- Food Code — dmpmedia.dm.gov.ae (accessed 5 Oct 2026)
- Abu Dhabi Occupational Safety and Health System Framework (OSHAD SF); the page does not cite ISO 45001 — dmt.gov.ae (accessed 5 Oct 2026)
- Registration of the manufacturing sites of medical products (human) in UAE — mohap.gov.ae (accessed 5 Oct 2026)
- The UAE Charter for the Development and Use of Artificial Intelligence — u.ae (accessed 5 Oct 2026)
- Emirates International Accreditation Centre (EIAC) — dm.gov.ae; ilac.org (accessed 5 Oct 2026)
- Emirates National Accreditation System (ENAS) — moiat.gov.ae (accessed 5 Oct 2026)
- National In-Country Value (ICV) Program — qc.moiat.gov.ae (accessed 5 Oct 2026)
- Federal Supplier Register (Digital Procurement Platform) — mof.gov.ae (accessed 5 Oct 2026)
- Jebel Ali Free Zone (Jafza) — jafza.ae (accessed 5 Oct 2026)
- DMCC (Dubai Multi Commodities Centre) — landing.dmcc.ae (accessed 5 Oct 2026)
- Dubai International Financial Centre (DIFC) — dfsa.ae (accessed 5 Oct 2026)
- Abu Dhabi Global Market (ADGM) — adgm.com (accessed 5 Oct 2026)
- Khalifa Economic Zones Abu Dhabi (KEZAD) — investinabudhabi.ae (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice