ISO 37001:2025 — new version and transition by 28 February 2027

What has changed with ISO 37001:2025?

In February 2025, the International Organization for Standardization (ISO) published ISO 37001:2025 “Anti-bribery management systems — Requirements with guidance for use”, which replaces the 2016 version.

The standard continues to set out the requirements for a system with which an organization prevents, detects and responds to bribery. However, the new version introduces changes to the requirements, so organizations that have already implemented ISO 37001:2016 need to familiarize themselves with the text of the 2025 version and initiate the transition process.

For an overview of the standard as a whole — what counts as bribery under it and what measures it requires — see the article ISO 37001 — the anti-bribery standard.

What is the transition period?

The transition period is 24 months from the date of publication of the new version, i.e. until 28 February 2027. This is set out in the mandatory document of the International Accreditation Forum (IAF) — IAF MD 30:2025, Issue 1 “Transition requirements for ISO 37001:2025”.

1. 02.2025

   ISO publishes ISO 37001:2025. The transition period begins.

2. until 28.02.2027

   Certified organizations update their documentation and undergo an audit against ISO 37001:2025.

3. after 28.02.2027

   Certificates issued to ISO 37001:2016 become invalid.

After 28 February 2027, an ISO 37001:2016 certificate will not be valid. If the audit against the new version has not been carried out in time, the organization is left without a valid certificate.

Do not leave the transition until the last few months. Updating the documentation, the internal audit and the management review all take time, and the audit against the new version must be planned and carried out before the deadline expires. If your certificate is required by clients, partners or in public procurement, being without it even for a short time can cause you difficulties.

What do certified organizations need to do?

Organizations certified to ISO 37001:2016 must update their documentation and undergo an audit against ISO 37001:2025 by 28 February 2027.

1. 1Familiarize yourself with the new version

   Read ISO 37001:2025 and identify which requirements differ from the previous ones.

2. 2Carry out a gap analysis

   Compare your current system with the new requirements and determine what needs to change.

3. 3Update the documentation

   Reflect the changes in the policy, procedures, risk assessment and records.

4. 4Check the system internally

   Carry out an internal audit and a management review against the new version.

5. 5Plan the audit in good time

   Agree with the certification body when the ISO 37001:2025 audit will take place, so that it is completed before 28 February 2027.

The certification body does not provide consultancy — this guarantees its impartiality under ISO/IEC 17021-1. If you need help with the gap analysis or with updating your documents, consultancy is a separate service provided by an independent consultant.

Which version should new organizations be certified to?

Organizations that intend to get certified in the near future are advised to go straight to ISO 37001:2025.

Certification to the 2016 version would make sense only for a short time — after 28 February 2027 such a certificate will not be valid and the organization would have to go through a transition. It is therefore more sensible to build the system to the new version from the outset.

In both cases, the certificate is issued by CERTIND S.A., which is accredited by RENAR (certificate SM 041) with ISO 37001 included in its scope. RENAR is a signatory of the EA MLA and a member of IAF. The certificate is valid for 3 years, with surveillance audits in the second and third years.

How do you start the transition or certification?

Start with an enquiry describing your activity, the number of employees and whether you already hold an ISO 37001:2016 certificate. Euro Standard Certification will send you a tailored quote within two hours during business hours, and audits are conducted in Bulgarian.