ISO standards and certification
ISO standards: which one you need and what comes next
Most companies arrive at ISO for one of three reasons — a requirement in a public tender, a condition from a large customer, or the need to put processes in order. In all three the first question is the same: which standard exactly. This page answers that, and what follows.
8standards in our practice
3–6 mo.typical implementation
3 yearscertificate validity
up to 30%saved on a combined audit
In short
What ISO standards are
Short answer
ISO management system standards set requirements for how an organisation manages a particular area — quality, environment, safety, information. They prescribe neither technology nor organisational structure, but an outcome: defined processes, measurable objectives, control, and evidence that the system works.
Modern management system standards share a common ten-clause structure. That is why several standards can be maintained together without duplicating work — context, leadership, competence, internal audit and management review are done once for all of them.
Certification is not accreditation. The certificate is issued to your organisation by a certification body. Accreditation confirms that the body itself is competent to issue it. A certificate from a non-accredited provider is usually not accepted in public procurement or by serious customers — the difference is explained in accreditation versus certification.
Catalogue
The standards we work with
Each page sets out the requirements, the process, the timelines and answers to the most common questions.
ISO 9001 — Quality
The base quality management standard. Most frequently required in public tenders and by corporate customers. The new version was published in September 2026.
ISO 14001 — Environment
Management of environmental aspects and legal requirements. The foundation for ESG reporting and the new EU regulations.
ISO 45001 — Occupational safety
Builds a management layer on safety law with genuine worker participation. Frequently required in construction and industry.
ISO 27001 — Information security
93 controls in four themes. The shortest route to demonstrability for clients, under NIS2 and under GDPR.
ISO 22000 — Food safety
HACCP inside a working system with prerequisite programmes. A step towards FSSC 22000 for international chains.
ISO 13485 — Medical devices
The system a notified body assesses for CE marking under Regulation (EU) 2017/745.
ISO 39001 — Road traffic safety
For any organisation with a fleet or employees who drive for work. Measured in reduced damage.
AQAP 2110 — Defence industry
NATO requirements on top of ISO 9001 — quality plan, configuration and government quality assurance.
Conflict minerals
Due diligence under Regulation (EU) 2017/821 for importers of tin, tantalum, tungsten and gold.
Choosing
How to choose the right standard
In practice the decision comes down to a few questions. Here is the shortest route to an answer.
| If you… | You most likely need |
|---|---|
| Are bidding in a public tender | ISO 9001, often with ISO 14001 and ISO 45001 — see tender requirements |
| Are audited as a supplier by a large customer | ISO 9001; for food — ISO 22000 or FSSC 22000 |
| Handle personal or client data | ISO 27001, with ISO 27701 where needed |
| Manufacture medical devices | ISO 13485 plus MDR compliance |
| Run a fleet and have damage costs | ISO 39001, usually with ISO 45001 |
| Supply the defence sector | AQAP 2110 on an ISO 9001 base |
| Are applying for European funding | Depends on the call — see the funding checklist |
When several are needed: build them as one integrated system rather than three separate ones. The common clauses are done once and a combined audit is shorter and cheaper than three apart. What that looks like in practice is in integrated management system.
Process
How certification runs
The route is the same for nearly every standard. The differences are in the content of step two and in the duration.
- 1
Gap analysis
We compare how you work today with the chosen standard and you receive a concrete list of gaps and a plan.
2–5 working days - 2
Building the system
Processes, objectives, documents and records — only what will be used. The content depends on the standard.
4–10 weeks - 3
Implementation and training
We train the team and the internal auditors. From here the system starts producing the records for the audit.
2–4 weeks - 4
Internal audit and management review
Both are mandatory before the external audit and are the first things checked.
1–2 weeks - 5
Certification audit
Selection of an accredited body and a two-stage audit — documentation review and an on-site check.
4–8 weeks to certificate - 6
Maintaining the certificate
Surveillance audits in years one and two, recertification at the end of year three.
annually
Further reading
More on the topic
ProcessHow to get an ISO certificate: a complete guide
Choosing a bodyAccreditation versus certification
TendersWhich certificates are mandatory to win
IntegrationIntegrated management system
FundingWhich ISO standards European funding expects
PreparationPreparing for the certification audit
DigitalisationWhy paper ISO systems lose you money
TrainingInternal auditor training to ISO 19011:2026
RiskRisk management to ISO 31000
Questions and answers
Frequently asked questions
Which ISO standard do we need?
It depends on the reason. Public tenders most often require ISO 9001, frequently together with ISO 14001 and ISO 45001. For data handling — ISO 27001. For food — ISO 22000. For medical devices — ISO 13485. The fastest way to decide is to look at the specific requirement in the tender documentation or the customer contract.
How much does ISO certification cost?
The cost has two independent parts: the consultancy work to build the system and the fee of the accredited certification body. The fee depends on the mandatory number of audit days set against headcount and scope. With several standards a combined audit is considerably cheaper than separate ones.
How long does certification take?
For an organisation with one site and up to 50 employees the typical timeline is three to six months for most standards. ISO 13485 and ISO 27001 usually take longer because of design documentation and control implementation respectively. The longest part is always implementation, not writing documents.
What is the difference between certification and accreditation?
A certificate is issued to your organisation by a certification body after an audit. Accreditation is confirmation by a national accreditation body that the certification body itself is competent. A certificate from a non-accredited provider is usually not accepted in public procurement or by corporate customers.
Can several standards be implemented together?
Yes, and it is usually more economical. Modern standards share a common ten-clause structure, so context, leadership, competence, documented information, internal audit and management review are built once. A combined certification audit is shorter than several separate ones.
Are ISO standards mandatory by law?
No. ISO standards are voluntary. What is mandatory are statutory requirements — on occupational safety, the environment, food. Certification becomes effectively mandatory commercially: through selection criteria in public tenders and through customer requirements on suppliers.
How long is the certificate valid?
Three years. In years one and two the certification body conducts a surveillance audit with a smaller scope, and at the end of year three a recertification audit of the whole system. Internal audits, management reviews and records must be maintained throughout, or the certificate can be suspended.
Do we need to hire a consultant?
Not necessarily. An organisation with an experienced quality specialist can build the system itself. A consultant makes sense when the deadline is tight, when there is no in-house experience with the standard, or when a previous attempt produced heavy documentation nobody uses. What matters is that the result keeps working after the project ends.
Not sure where to begin?
Tell us what is being asked of you — a tender, a customer or a regulator — and we will tell you which standard answers it, how long it will take and in what order to proceed.