Certifications · Overview

Certifications
EU customers ask for

Hardly any certification is required by law in the EU. Even so, it often decides whether you make it onto the supplier list.

Required by lawonly HACCP for food

Requested throughcontracts, tenders, questionnaires

Recognized ifthe certification body is accredited

Certification · Information security

ISO/IEC 27001

Why EU customers ask for ISO/IEC 27001, who needs it, how certification works, and which accreditation counts in your country.

Certification · Quality management

ISO 9001

ISO 9001:2026 is out. What EU customers expect from your quality management, how certification works, and which accreditation counts.

Certification · Environmental management

ISO 14001

ISO 14001:2026 is out. Why EU customers ask about environmental management under CSRD and CSDDD, and how to get an accredited certificate.

Certification · Food

Food safety

Which food standards EU retailers and manufacturers require, what HACCP under Reg. 852/2004 means, and why ISO 22000 alone often falls short.

Assessment · Automotive

TISAX

What TISAX is, which labels and assessment levels German carmakers ask for, and how suppliers in Brazil and Argentina get their label.

Certificate · Artificial intelligence

ISO/IEC 42001

What ISO/IEC 42001 covers, why EU customers ask AI suppliers for it, how it relates to the AI Act and what the path to certification looks like.

Comparison · Information security

SOC 2 or ISO 27001

SOC 2 and ISO/IEC 27001 compared: what each one is, why EU customers usually expect ISO/IEC 27001 and when it pays to have both.

Why EU customers ask for certifications

Many EU rules oblige your customer to check its supply chain: NIS2 for cybersecurity, DORA for IT providers to banks, the GDPR for personal data, CSRD and CSDDD for the environment and human rights. For a purchasing department, a certificate from an independent body is the easiest evidence there is. It will not replace every questionnaire, but it shortens it considerably and often saves you a separate supplier audit.

Which certification for which industry

Industry	Typical proof
Software, IT services, BPO, data centers	ISO/IEC 27001, plus SOC 2 for US customers
Manufacturing, components, packaging	ISO 9001
Mining, chemicals, agro-processing, logistics	ISO 14001
Food and beverages	HACCP, plus IFS Food, BRCGS or FSSC 22000
Automotive suppliers	TISAX
Providers of AI systems	ISO/IEC 42001

A software company in Montevideo working for an insurer in Madrid will usually get further with ISO/IEC 27001 than with any other proof. A meat exporter from Paysandú, on the other hand, needs HACCP and, as a rule, one of the GFSI-recognized food safety standards.

Accreditation: the only thing that makes the paper count

EU buyers recognize a certificate when the certification body is accredited by an accreditation body that has signed the international recognition arrangement. Until the end of 2025 that was the IAF MLA. Since January 1, 2026, the Global Accreditation Cooperation Incorporated (Global ACI) has carried on the IAF and ILAC arrangements, and existing accreditations remain recognized. All nine countries on MercoEU have an accreditation body listed there as a signatory: Cgcre at INMETRO in Brazil, OAA in Argentina, INN in Chile, ONAC in Colombia, INACAL in Peru, SAE in Ecuador, OUA in Uruguay, ONA in Paraguay and DTA-IBMETRO in Bolivia. Whether a body is recognized for the specific standard is stated in the scope of its accreditation.

Where to start

Start by asking your most important EU customers which proof they expect. If the contract does not say, the EU Readiness Check can help: it shows, by industry and country, which certifications will do the most for you.

Once the decision is made, preparation is mostly organized work: policies, risks, tasks and evidence for each requirement. For ISO/IEC 27001, ISO 9001, ISO/IEC 42001, SOC 2 or HACCP, a GRC platform such as Sightadel sets up the requirements of the standard and shows what is still open. The certificate itself is issued by an accredited certification body after the audit.

FAQ

Is an ISO certification mandatory in the EU?

As a rule, no. For food, a HACCP-based self-monitoring system under Regulation (EC) No 852/2004 is mandatory. Every other proof is something your customers require through contracts and tenders.

Do EU customers recognize certificates from South America?

Yes, if the certification body is accredited by an accreditation body that has signed the Global ACI recognition arrangement (formerly the IAF MLA). That can be the body in your own country or one from another signatory country.

Which certification pays off the most?

That depends on your industry and your customer. For IT and software it is almost always ISO/IEC 27001, for food IFS Food, BRCGS or FSSC 22000, for automotive suppliers TISAX.

Which tool helps with preparing for certification?

Sightadel is a GRC platform developed and hosted in Germany. It supports ISO/IEC 27001, ISO 9001, ISO/IEC 42001, SOC 2 and HACCP as frameworks, with templates, tasks and evidence. For TISAX or ISO 14001 it can be used as a general tool for tasks, evidence and document control. Sightadel does not certify; certificates are issued by accredited certification bodies.

Sources · Last updated: October 11, 2026

General information, not legal advice. The official texts are authoritative.

Certification · Information security