ISO 37301 Certification in Portugal
Last reviewed: November 2026
ISO 37301 certification in Portugal gives organisations a structured, auditable compliance management system at a time when Portuguese law has made compliance programmes a legal expectation. The General Regime for the Prevention of Corruption (RGPC) requires many companies to adopt a compliance programme, and the national anti-corruption mechanism, MENAC, supervises implementation.
Nathan ISO Consulting implements ISO 37301:2021 compliance management systems for Portuguese companies, building on risk assessment, code of conduct, whistleblowing channel, training and monitoring. We work remotely and on site across Lisbon, Porto, Braga, Aveiro, Setúbal and Sines.
Quick answer: ISO 37301 is the international standard for compliance management systems. In Portugal, a company can usually be certified in four to eight months, with certification body fees of roughly €3,500 to €9,000 over three years for a small organisation, before consulting.
Looking for ISO 37301 Certification in Portugal?
ISO 37301 at a Glance for Portuguese Businesses
| Item | Typical position in Portugal |
|---|---|
| Current edition | ISO 37301:2021, which replaced ISO 19600 |
| Certificate validity | Three years, with annual surveillance audits |
| Typical timeline | 4 to 8 months |
| Indicative certification body fees | €3,500 to €9,000 (small), €9,000 to €22,000 (medium) |
| Legal requirement | Voluntary; supports RGPC programme duties, but does not prove legal compliance |
| Best fit | Companies with 50+ employees, regulated sectors, public contractors, exporters |
What Is ISO 37301?
ISO 37301:2021 specifies requirements and gives guidance for establishing, developing, implementing, evaluating, maintaining and improving a compliance management system. It is certifiable, unlike its predecessor ISO 19600, and follows the Annex SL structure.
It helps organisations identify compliance obligations, assess compliance risks, assign responsibilities, train people, investigate concerns and demonstrate a culture of integrity.
Why ISO 37301 Certification in Portugal Matters
Decree-Law 109-E/2021 created the General Regime for the Prevention of Corruption (RGPC). It requires entities with 50 or more employees to adopt a compliance programme that includes a prevention plan for corruption risks, a code of conduct, a training programme and a whistleblowing channel, plus a compliance officer. Breaches can lead to administrative fines, up to €44,891.81 for legal persons in some cases, with the higher figure of up to €250,000 for certain whistleblowing offences. ISO 37301 does not guarantee compliance with the RGPC, but its structure of obligations, risk assessment, training and monitoring covers much of the same ground. Confirm requirements with your legal advisers.
The National Anti-Corruption Mechanism, MENAC, promotes and supervises implementation of the regime and expects entities to document their programmes. A certified system provides a clear audit trail of controls and monitoring.
Portuguese law protecting whistleblowers requires reporting channels, confidentiality, acknowledgement and follow-up timelines. ISO 37301 expects concern reporting and non-retaliation processes that align with these expectations.
Banks, multinational customers and public buyers perform integrity due diligence on suppliers. A certified compliance system shortens questionnaires and supports tenders, especially in infrastructure, energy, health and defence-related supply chains.
Financial services, energy, health, construction, transport and data-intensive sectors face overlapping obligations on anti-money laundering, data protection, sanctions, competition and consumer protection. A single compliance management system avoids duplicated registers and training.
IPAC is Portugal's national accreditation body, and buyers expect certificates from certification bodies accredited for ISO 37301 under recognised arrangements. Because the standard is relatively new, confirm that your chosen body holds accreditation for it.
Which Portuguese Organisations Need ISO 37301
The Business Benefits
How to Get ISO 37301 Certified in Portugal: Step by Step
| Step | What Happens |
|---|---|
| Step 1: Gap Analysis | We assess your current compliance arrangements against ISO 37301 and RGPC programme elements. |
| Step 2: Scope and Governance | We define scope, compliance function, reporting lines and board oversight. |
| Step 3: Obligations Register | We compile legal, contractual and voluntary obligations, assign owners and set review routines. |
| Step 4: Compliance Risk Assessment | We assess risks such as bribery, conflicts of interest, sanctions, competition, data protection and procurement irregularities. |
| Step 5: Policy, Code of Conduct and Controls | We draft or refine the compliance policy and code of conduct, and design controls for gifts, hospitality, intermediaries and donations. |
| Step 6: Whistleblowing and Investigation | We design reporting channels, triage, confidentiality and investigation procedures, including non-retaliation and record keeping. |
| Step 7: Third-Party Due Diligence | We set risk-based due diligence for suppliers, agents and partners. |
| Step 8: Training and Communication | We deliver role-based training and measure understanding. |
| Step 9: Internal Audit and Management Review | We train internal auditors, run a complete audit cycle and facilitate a management review with compliance metrics. |
| Step 10: Certification Audit Support and Surveillance | We help select an IPAC-accredited certification body, attend Stage 1 and Stage 2, close findings and support surveillance audits. |
ISO 37301 Certification Cost in Portugal
The bands below are indicative certification body fees for ISO 37301 certification in Portugal across the three-year cycle, in euros, excluding consulting and VAT.
Audit time reflects headcount, sites, regulated activities and complexity.
How Long Does ISO 37301 Certification Take?
Typically four to six months for a smaller organisation with some existing policies, and six to ten months for larger or more regulated ones. A risk assessment, training records, a tested reporting channel, an internal audit and a management review must exist before the certification audit.
Common Implementation Challenges in Portugal
Why Choose Nathan ISO Consulting
We build compliance systems that reflect your actual risks and that managers and staff can use. Registers are practical, controls proportionate, and investigations credible. ISO 37301 certification in Portugal should reduce exposure and support tenders and customer due diligence. Fixed scope and fee, full audit attendance and continuing support. Nathan ISO Consulting is a consultancy, not a certification body, and does not provide legal advice, including on RGPC or whistleblowing law.
Where We Deliver ISO 37301 in Portugal
Related Services
See also: ISO 27001 information security certification Portugal, ISO 27701 privacy information management Portugal, ISO 9001 quality management Portugal, ISO 45001 occupational health and safety Portugal and ISO 42001 AI management Portugal.
Request a Free ISO 37301 Scoping Call
For ISO 37301 certification in Portugal, tell us your size, sector and current compliance programme, and we will confirm the likely scope, timeline and certification body options within one working day.
Ready to start your ISO 37301 certification journey?
Sources and References
Frequently Asked Questions
No. ISO 37301 is voluntary. The RGPC imposes legal programme duties on many entities regardless, and ISO 37301 certification does not prove compliance, but it provides a recognised, auditable structure that supports those duties. Check your customer contracts first.
Certification body fees typically fall around €3,500 to €9,000 over three years for small organisations and €9,000 to €22,000 for medium ones, before consulting and VAT. Headcount, sites and regulated activities determine audit time. Quotes are fixed after scoping.
Typically four to six months for a smaller organisation with existing policies and six to ten months for larger or more regulated ones. Risk assessment, training, a tested reporting channel, internal audit and management review are needed first.
The General Regime for the Prevention of Corruption, created by Decree-Law 109-E/2021. It requires entities with 50 or more employees to adopt a compliance programme with a prevention plan, code of conduct, training and a whistleblowing channel.
Not automatically. The RGPC sets specific legal elements and deadlines, while ISO 37301 is a voluntary management system. They overlap substantially, so one programme can serve both, but legal advisers should confirm that mandatory elements are met.
The National Anti-Corruption Mechanism, which promotes and supervises implementation of the regime for preventing corruption. Entities are expected to document their compliance programmes and be able to show evidence of prevention, training and monitoring. Check its current guidance regularly.
ISO 37001 focuses on anti-bribery management. ISO 37301 covers a wider compliance system across all obligations, including law, contracts and voluntary commitments. Some organisations certify to both, and the structures integrate well. Choose based on customer demands and risk profile.
The RGPC requires one for entities within its scope, and ISO 37301 expects a compliance function with authority, independence and resources. The role should not conflict with operational duties, and auditors check reporting lines to top management.
Secure and confidential reporting options, acknowledgement and follow-up timelines, impartial investigation, protection from retaliation and record keeping. Staff must know the channel exists and trust it, so communication and testing are essential. Review the design with your legal adviser.
Yes. Even below the RGPC size threshold, a company can implement a proportionate system. Certification helps with banks, public tenders and multinational customers, and a focused obligations register keeps the work manageable. Auditors expect proportionate evidence, not volume.
Evidence that obligations are known, risks assessed, controls operating and concerns handled. Auditors review registers, training, investigations, due diligence files and management reports, and interview leaders and staff about real situations. Sampling is based on risk.
Certificates last three years, with annual surveillance audits and a recertification audit at the end of the cycle. Risk reviews, training, monitoring and management reviews must continue throughout the cycle to keep the system credible.
Yes. The standards share the Annex SL structure, so one document control system, audit programme and management review can serve several certificates. Integration reduces duplication and is common in regulated companies. Auditors can plan one visit.
Yes. Policies, codes of conduct, training and reporting channel materials can be prepared in Portuguese, English or both. Staff communication works best in Portuguese, and group or customer documents often need English. Bilingual sets are common.
Largely yes. Registers, risk assessments, policies, training and reviews run well online. Interviews, channel testing and certification audits benefit from physical presence, which we arrange at your Portuguese sites when required. Hybrid delivery is typical.
Nathan ISO Consulting is headquartered in Dubai and does not maintain a Portuguese office. We deliver through remote engagement and scheduled on-site visits. Workshops and documentation run online, while verification and audits are attended in person.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving