Is ISO 37001 mandatory? Law and buyer conditions

Decision and conditional example

A buyer may require an ISO 37001 certificate without creating the same certification duty for every organisation. Verify the applicable bribery and related law separately through official sources. For a tender or contract, clarify entity, activity, edition and accepted issuer. Do not declare an excluded subsidiary conforming merely because another entity holds a certificate. Controls and legal duties continue after certification. A preparation contract should not promise approval or legal immunity; define consultancy and independent assessment separately. The decision to seek certification should follow the written requirement and actual scope.

Evidence linked to this purpose

• Official legal duties
• Tender or contract scope
• Entity, edition and acceptance conditions

Standard and authority boundaries

ISO 37001:2025 addresses a management system for preventing, detecting and responding to bribery. Certification does not guarantee that bribery never occurs, remove legal responsibility or certify every fraud and ethics matter. Applicable law, investigations and the duties of competent authorities remain separate.

Kayra’s role and the independent decision

The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. ISO publishes standards and does not certify organisations. Verify the chosen body’s current standard edition, activity coverage and any claimed accreditation. Preparation does not guarantee approval, legal compliance or authority to certify a newly published edition. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Official sources

Checked: 3 October 2026. Examples are hypothetical explanations, not claims about completed client work, local offices or approval.

• ISO 37001:2025
• ISO – Certification
• ISO/IEC 17021-1
• GSO ISO/IEC 17021-1