ISO Certification in China: Accredited Audits for Export Factories, Electronics Makers, and Tech Firms
ISO certification in China gives export factories the evidence overseas buyers request, helps device makers ship to regulated markets, and lets software firms answer security reviews. Accredify Global audits organizations in China against ISO 9001, ISO 14001, ISO 13485, ISO 27001, and the other standards in our scope. Every engagement starts with a free scoping review.
What ISO Certification in China Proves to Overseas Customers
ISO certification in China is an independent check, by an accredited certification body, that your management system meets an international standard and runs on the shop floor as written. Auditors read your records, talk to line leaders and engineers, and walk the production lines, warehouses, and labs. A conforming system earns a three-year certificate, confirmed by a surveillance audit each year.
Most requests start with an export customer. Factories in the Pearl River Delta, around Shenzhen, Dongguan, Guangzhou, and Foshan, ship electronics, appliances, furniture, and toys to buyers in Europe and North America. Those buyers put ISO 9001 on their supplier approval forms and audit against it.
The Yangtze River Delta adds a different mix. Suzhou Industrial Park, Kunshan, Ningbo, and Hangzhou host precision machining, auto parts, chemicals, and solar supply chains. Their customers often add ISO 14001 for environmental control and ISO 50001 where energy cost and carbon questions now appear in supplier reviews.
Inland hubs such as Chengdu, Chongqing, Wuhan, Hefei, and Xi'an have grown fast in electronics assembly, vehicles, batteries, and software. Plants that moved inland from the coast often need their certificates extended to the new sites, and that is a common reason to re-scope.
Certification inside mainland China is regulated. The Certification and Accreditation Administration (CNCA) supervises certification bodies under the Regulations on Certification and Accreditation. Each engagement's eligibility, including where the sites sit and which entity holds the certificate, is confirmed during scoping.
Accredify Global is accredited by UAF, and our scope is listed in its directory. If a buyer, tender, or regulator names CNAS or another specific accreditation body, share the wording before you book and we will confirm the fit.
Chinese Rules in 2026 That Shape Certification Requests
The Cybersecurity Law was amended and penalties rose. The NPC Standing Committee adopted amendments on 28 October 2025, and they took effect on 1 January 2026. Fines for operators now reach RMB 10 million in the most serious cases. Responsible managers can be fined up to RMB 1 million. The amended law also links its personal information duties to the PIPL.
Network data rules apply to everyday data handling. The Network Data Security Management Regulations, State Council Order 790, took effect on 1 January 2025. Processors handling the personal information of more than 10 million people take on extra duties. Overseas processors of data on people in China must name a local representative and file with the city-level cyberspace office.
Data export follows clear volume thresholds. A CAC security assessment is needed once a company sends abroad, since 1 January of the year, the personal information of 1 million or more people or sensitive data of 10,000 or more. Below those levels, a standard contract or personal information export certification may apply. The CAC published updated questions and answers on these rules on 11 September 2026.
Public security inspections widen from October 2026. Ministry of Public Security Order No. 176 takes effect on 1 October 2026. It covers network, data, and information security, and adds algorithm security to the inspection list. Networks graded at Level 3 or above under the Multi-Level Protection Scheme face one on-site inspection a year at most.
Sources: Cybersecurity Law amendments (DLA Piper) · Network Data Security Management Regulations (YL Insight) · CAC data export Q&A, September 2026 (YL Insight) · MPS cyberspace inspection rules (YL Insight)
Standards Chinese Exporters and Buyers Ask For
Customer questionnaires differ, but these pairings come up most often in China.
| Sector | What the buyer worries about | Usual standards |
|---|---|---|
| Electronics and appliance makers in Guangdong | Supplier approval and process control | ISO 9001 and ISO 14001 |
| Auto parts and machinery plants in Jiangsu and Zhejiang | Quality, energy, and worker safety | ISO 9001, ISO 50001, and ISO 45001 |
| Medical device manufacturers | Device quality for export registrations | ISO 13485 |
| Textile, garment, and furniture exporters | Brand audits and environmental checks | ISO 9001 and ISO 14001 |
| Food processors and seafood exporters | Food safety for overseas importers | ISO 22000 and HACCP |
| Software, cloud, and outsourcing firms | Client data and service reliability | ISO 27001 and ISO 20000-1 |
| Foreign-invested enterprises | One group system across Chinese plants | ISO 9001, ISO 14001, and ISO 45001 as an integrated system |
| AI and platform companies | Governance answers for global clients | ISO 42001 |
CCC compulsory product certification, NMPA device registration, and customs food filing are separate legal schemes. An ISO certificate supports them but does not replace any of them.
Contract manufacturers gain most when one system covers what customers actually inspect. A typical Dongguan plant runs SMT lines, injection molding, a warehouse, and a small test lab, often with a sales office in Shenzhen or Hong Kong. One ISO 9001 and ISO 14001 system can cover all of them. Customer auditors then see a single set of records instead of a new folder for every brand. Plants that make devices for export usually keep ISO 13485 separate, because device buyers and notified bodies read that certificate on its own.
How ISO Supports Chinese Requirements
A certificate is not a licence or a regulator's filing. It is the system that keeps controls working between customer audits and official checks.
| Rule or system | Who it reaches | How ISO supports it |
|---|---|---|
| Personal Information Protection Law (PIPL) | Companies processing personal information in China | ISO 27701 runs privacy duties; ISO 27001 secures the data |
| Cybersecurity Law (amended, in force 2026) | Network operators and critical infrastructure operators | ISO 27001 gives the risk process, controls, and incident handling |
| Multi-Level Protection Scheme | Networks graded under the national scheme | ISO 27001 controls support, but do not replace, MLPS assessment |
| Data export rules (CAC) | Firms sending personal data abroad | ISO 27701 records support data mapping and volume tracking |
| Medical device quality rules (NMPA) | Device makers selling in China and abroad | ISO 13485 aligns with the quality system regulators expect |
| Government Procurement Law | Firms bidding through the national procurement network | Certificates support the technical and quality evaluation |
Some needs call for testing rather than certification. Our VAPT services and cyber security risk assessment report against recognized frameworks. Exporters selling into Europe can add CE marking support, and firms handling European customer data can review GDPR duties through our compliance services.
Planning a Certification Audit in China
Local details that keep an audit in China on schedule.
Prepare before Stage 1
- Business license and unified social credit code for each entity
- Plants, warehouses, labs, and offices to include
- The customer, tender, or export requirement
- Chinese and English versions of key procedures
Scheduling notes
- Spring Festival closes many plants for two weeks or more
- National Day Golden Week runs from 1 October
- Make-up working days can fall on weekends
- Typhoon season can disrupt southern coastal travel
How ISO Certification in China Works With Us
Six steps from the first call to a certificate your customers can verify. Our certification process guide explains every stage.
Is a customer audit or supplier approval date fixed? Tell us and we will plan around Spring Festival and Golden Week.
Book a free scoping reviewWhat ISO Certification Costs in China
The fee follows audit man-days, listed per site and standard in your proposal before you sign.
What adds audit days
- Coastal and inland plants in one scope
- Large production workforces on several shifts
- Chemical, battery, or other high-risk processes
- Interpreting time when records are only in Chinese
What saves audit days
- One integrated system across plants
- Bilingual procedures ready before Stage 1
- Records organized by process, not by customer
- Internal audit and management review complete
What Organizations in China Ask Us First
Short answers for quality managers, EHS leads, and IT security teams.
| Question | Our answer |
|---|---|
| Who accredits Accredify Global? | UAF, for twelve standards in its directory. |
| Can one certificate cover several plants? | Yes, as a multi-site certificate. |
| How do customers verify our certificate? | On our verification page. |
| Will you write our procedures? | No. We audit only, so we stay impartial. |
| How is the fee set? | From audit man-days, in writing. |
FAQ: ISO Certification in China
Answers on export buyers, CNCA, the PIPL, data export, cost, and timing.
How do I get ISO certification in China?
Choose the standard your customer or tender names, run the system until it produces records, then book an audit. An accredited body completes Stage 1 and Stage 2 and issues a three-year certificate if you conform.
How long does ISO certification take in China?
With a working system, most organizations certify 6 to 12 weeks after Stage 1. Several plants, several standards, or a Spring Festival shutdown add time.
How much does ISO certification cost in China?
There is no list price. The fee follows the audit man-days your scope needs, driven by headcount, sites, process risk, and standards.
Is Accredify Global accredited?
Yes. UAF accredits Accredify Global for twelve standards, including ISO 9001, ISO 14001, ISO 45001, ISO 13485, and ISO 27001.
Does a certification body need CNCA approval to work in China?
Certification activity in mainland China is supervised by CNCA under the Regulations on Certification and Accreditation. We confirm each engagement's eligibility during scoping, before any audit is booked.
Our customer asks for a CNAS certificate. What should we do?
Send us the exact clause first. Some buyers accept any accredited certificate from the international arrangement, and some name CNAS on purpose. We will tell you honestly which applies.
Is GB/T 19001 the same as ISO 9001?
GB/T 19001 is the Chinese national adoption of ISO 9001. GB/T 24001, GB/T 45001, and GB/T 22080 adopt ISO 14001, ISO 45001, and ISO/IEC 27001 in the same way.
Does ISO certification replace CCC product certification?
No. CCC is compulsory product certification for listed products. ISO 9001 certifies your management system and supports, but never replaces, CCC.
Does ISO 27001 replace an MLPS assessment?
No. The Multi-Level Protection Scheme has its own grading and testing. ISO 27001 controls support that work and help with customer security reviews.
When do we need a CAC security assessment for data export?
Once you send abroad, since 1 January of the year, personal information of 1 million or more people or sensitive data of 10,000 or more. Smaller volumes may use a standard contract or certification.
Can auditors outside China see our records remotely?
Document review can be remote where the rules allow. Records with personal information may count as data export, so we often review those on site.
Can one certificate cover plants in Guangdong and Sichuan?
Yes, if all plants run one management system under the same organization. Each site is listed and sampled over the cycle.
Does ISO 13485 help with NMPA registration?
It supports it. NMPA applies its own device production quality rules, and ISO 13485 aligns closely with them and with export markets.
Will Accredify Global write our documents?
No. A certification body must stay impartial, so we audit and certify only. Your team or an independent consultant builds the system.
When should we avoid scheduling an audit in China?
Avoid the weeks around Spring Festival and the 1 October Golden Week. Many plants also run reduced shifts around the early May holiday.
Show Overseas Buyers an Audited Chinese Plant
Tell us your entities, plants, and the customer or tender requirement. We will confirm the right ISO certification in China and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.