ISO Certification in France: Accredited Audits for Industry, Food, Health Tech, and Public Bidders
ISO certification in France gives aerospace and automotive suppliers the evidence their prime contractors expect, helps food and wine exporters pass buyer reviews, and supports firms answering public tenders. Accredify Global audits French organizations against ISO 9001, ISO 14001, ISO 45001, ISO 50001, ISO 27001, ISO 37001, and the other standards in our scope.
What ISO Certification in France Proves to Clients and Public Buyers
ISO certification in France means an accredited certification body has checked your management system against an international standard and found it in daily use. Our auditors read your records, talk to staff, and walk through factories, warehouses, kitchens, data rooms, or offices. A system that conforms receives a certificate valid for three years. A surveillance audit each year keeps it in force.
Industrial supply chains create much of the demand. Toulouse and Bordeaux anchor aerospace, while car and parts plants run from the Hauts-de-France to Franche-Comté. Prime contractors push quality requirements down to every tier. Small machining shops and subcontractors often need ISO 9001 before they can even be listed as a supplier.
Food and drink are a second driver. Brittany processes meat, dairy, and seafood, and Champagne, Burgundy, and Bordeaux export wine and spirits worldwide. Retailers and importers in Asia and North America ask for audited food safety. ISO 22000 gives them a recognized framework that sits alongside the retail schemes many buyers already use.
Energy law is now a direct trigger. A law of 30 April 2025 moved France from company size to actual energy use. Groups using at least 23.6 GWh a year must run a certified energy management system by 11 October 2027. That obligation points straight at ISO 50001 for steel, chemical, glass, paper, and food plants.
Digital and health firms complete the picture. Software publishers around Paris-Saclay, Sophia Antipolis, and Lyon face security questionnaires from banks, insurers, and hospitals. ISO 27001 answers most of those questions. Hosting providers that store health data for French clients also need a separate HDS certification, which is built on an ISO 27001 system.
Accredify Global is accredited by UAF, an IAF MLA signatory, and our scope is listed in its directory. Some French buyers and tenders refer to COFRAC, the national accreditation body, or to AFNOR standards. If a clause names a specific body, send us the exact wording before you book and we will confirm whether our certificate fits.
French Rules in 2026 That Drive Certification Requests
Personal data falls under the GDPR and a French law from 1978. France applies the GDPR together with the Loi Informatique et Libertés of 6 January 1978, as amended. The CNIL supervises both. Controllers must notify the CNIL of a qualifying breach within 72 hours. Fines under the GDPR reach €20 million or 4% of worldwide turnover, whichever is higher.
NIS2 is still moving through Parliament. France has not yet finished transposing NIS2. The Senate adopted the resilience bill on 12 March 2025, and a special committee of the National Assembly adopted its version on 10 September 2025. ANSSI, the national cybersecurity agency, has published a working security framework called ReCyF. The bill reflects the directive: an alert within 24 hours, a notification within 72 hours, and a final report within one month.
Energy and anti-corruption duties are already in force. Large energy users face the ISO 50001 deadline of 11 October 2027. Groups using at least 2.75 GWh a year must carry out regular energy audits. The Sapin II law of 9 December 2016 covers firms with at least 500 employees and over €100 million in turnover. They must run an anti-corruption program. The French Anti-Corruption Agency, AFA, checks those programs.
Public buying has new thresholds. The Code de la commande publique governs public contracts. Since 1 April 2026, buyers may award supply and service contracts under €60,000 excluding VAT without a formal tender. Above that level, quality, environmental, and safety evidence is weighed in written bids.
Sources: NIS2 transposition in France (Legiscope) · DDADUE energy audit and ISO 50001 duties (GRDF Cegibat) · HDS health data hosting framework (Agence du numérique en santé) · Public procurement threshold of €60,000 (Landot avocats)
Standards French Clients Request Most
Each prime contractor, retailer, and public buyer words it differently. These are the pairings we see most often.
| Sector | What the buyer worries about | Usual standards |
|---|---|---|
| Aerospace and automotive subcontractors | Process control demanded by prime contractors | ISO 9001 and ISO 14001 |
| Steel, chemical, glass, and paper plants | The 2027 energy management obligation | ISO 50001 and ISO 14001 |
| Meat, dairy, seafood, wine, and spirits producers | Food safety for export buyers | ISO 22000 and HACCP |
| Software publishers and cloud hosts | Client security reviews and HDS groundwork | ISO 27001 and ISO 27701 |
| Large groups under Sapin II | Anti-corruption program discipline | ISO 37001 |
| Builders and public works contractors | Site safety and the risk assessment file | ISO 45001, ISO 9001, and ISO 14001 |
| Medical device manufacturers | Device quality for EU market access | ISO 13485 |
HDS certification and the ANSSI SecNumCloud qualification are separate French schemes. ISO 27001 supports both but replaces neither.
Industrial groups gain most from one integrated system. A typical client might run a plant near Lyon's chemical valley, a warehouse near Le Havre, and a head office in La Défense. One quality, environmental, and energy system can cover all three sites. Audits then sample the sites each year rather than visiting each one separately. The energy data gathered for ISO 50001 also feeds the reporting that large groups already prepare for their sustainability statements.
How ISO Supports French Obligations
A certificate is not a permit, an ANSSI qualification, or a CNIL approval. It is the management system that keeps your controls working between inspections.
| Rule or system | Who it reaches | How ISO supports it |
|---|---|---|
| GDPR and the Loi Informatique et Libertés | Every organization handling personal data | ISO 27701 organizes privacy duties; ISO 27001 protects the data |
| NIS2 resilience bill (pending) | Essential and important entities in 18 sectors | ISO 27001 supports risk management and incident reporting |
| Energy Code audit and management duties | Groups using 2.75 GWh or more each year | ISO 50001 is the named route above 23.6 GWh |
| Sapin II anti-corruption law | Firms with 500+ staff and over €100m turnover | ISO 37001 structures risk mapping, checks, and training |
| ICPE environmental permits | Sites with classified installations | ISO 14001 tracks permit conditions and incidents |
| Document unique of occupational risks | All employers | ISO 45001 keeps the risk assessment current |
Some needs call for testing or a separate scheme. Our VAPT services and cyber security risk assessment report against recognized frameworks. Our NIS2 readiness work tracks the French bill and the ReCyF framework. Our GDPR services and DORA readiness serve banks, insurers, and their ICT suppliers.
Planning a Certification Audit in France
Local details that keep a French audit on track.
Have ready before Stage 1
- Kbis extract and SIREN or SIRET number for each entity
- Every plant, depot, and office in scope
- The prime contractor, tender, or energy law clause
- Your document unique and ICPE permits where relevant
Scheduling notes
- The legal working week is 35 hours
- Many plants slow or close for part of August
- May often holds several public holidays and bridge days
- Alsace and Moselle add Good Friday and 26 December
How ISO Certification in France Works With Us
From first contact to a certificate you can upload to a buyer portal or tender file. Our certification process guide explains every stage.
Is a tender deadline or the 2027 energy date driving your plan? Share it and we will schedule the audit backward from it.
Book a free scoping reviewWhat ISO Certification Costs in France
Fees are built from audit man-days per site and standard. You see them in a written proposal before you commit.
Adds audit days
- Several plants or regions in scope
- Classified installations or heavy processes
- Large workforces across shifts
- Each standard audited on its own
Saves audit days
- Quality, environment, and energy run as one system
- Shared procedures across all sites
- Energy data and records ready before Stage 1
- A full internal audit cycle completed
First Questions From French Organizations
Short answers for quality managers, energy leads, CISOs, and compliance officers.
| Question | Our answer |
|---|---|
| Which body accredits Accredify Global? | UAF, for twelve standards listed in its directory. |
| Does ISO 50001 satisfy the 2027 energy duty? | A certified ISO 50001 system is the route the law names. |
| Where can a buyer verify our certificate? | On our certificate verification page. |
| Do you write the system for us? | No. Consulting would compromise our impartiality. |
| How is the price set? | By audit man-days, shown in a written proposal. |
FAQ: ISO Certification in France
Answers on the 2027 energy duty, NIS2, the CNIL, HDS, Sapin II, cost, and timing.
How do I get ISO certification in France?
Pick the standard your client, tender, or legal duty requires and run it long enough to produce records. Then book Stage 1 and Stage 2 with an accredited body. A three-year certificate follows once you conform.
How long does ISO certification take in France?
A company with a working system often certifies within 6 to 12 weeks of Stage 1. Groups with many sites, or a system built from scratch, need longer. August closures can add a few weeks.
How much does ISO certification cost in France?
There is no fixed price. Each proposal is built from the man-days your scope needs, based on headcount, sites, process risk, and the standards involved.
Is Accredify Global accredited?
Yes. UAF, an IAF MLA signatory, accredits Accredify Global for twelve standards, including ISO 9001, ISO 14001, ISO 50001, ISO 27001, and ISO 37001.
Will a French buyer accept a certificate that is not COFRAC-accredited?
Many accept accredited certificates from bodies in the international arrangement. Some tenders or contracts name COFRAC or a European body. Send us the clause before you book and we will confirm the fit.
Does the 2025 energy law make ISO 50001 mandatory?
For groups using at least 23.6 GWh of energy a year, yes. They must have a certified energy management system by 11 October 2027. Groups above 2.75 GWh face a recurring energy audit instead.
Is energy use counted per site or per company?
The reform counts consumption at company or group level using the SIREN number, not site by site. Check your combined figure before deciding which duty applies.
Has France transposed NIS2 yet?
Not fully. The Senate adopted the resilience bill on 12 March 2025, and a National Assembly committee adopted its text on 10 September 2025. Final adoption and decrees are still pending.
Does ISO 27001 replace HDS certification?
No. Hosts of health data for French clients need HDS certification, a separate scheme. HDS is built on an ISO 27001 system, so the two are often audited together by an HDS-accredited body.
How fast must a breach be reported to the CNIL?
Within 72 hours of becoming aware of a qualifying personal data breach. Processors must alert the controller without undue delay.
Does ISO 37001 satisfy Sapin II?
It does not replace the legal duty. It does cover most of the program the law expects: risk mapping, third-party checks, training, and internal control.
Must our audit documents be in French?
Documents that set obligations for employees in France generally must be in French. Tell us your working languages during scoping and we will confirm the audit language in the proposal.
Can parts of the audit be remote?
Document review and some interviews can be remote where accreditation rules allow. Plants, kitchens, depots, and construction sites are visited in person.
Can one certificate cover France and our other EU sites?
Yes, when every site runs the same management system under one organization. The certificate lists each address, and audits sample the sites each year.
Will Accredify Global help write our procedures?
No. A certification body must stay independent, so we only audit and certify. Your staff or an independent consultant builds the system. Accredify Global is headquartered in Dallas–Fort Worth, Texas, and plans French audits on local time.
Prepare Your French Sites for the Next Audit or Tender
Send us your entities, sites, and the clause behind the request. We will confirm the right ISO certification in France and prepare a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.