A missing certificate is not a permanent state.
When the selection-criteria check says “not met”, that is not a rejection — it is an investment decision with a known lead time. This page explains what each certificate means, how many open procedures require it right now, and what obtaining it typically costs and takes.
ISO 9001 — Quality management
Currently required or explicitly named in 1,377 open procedures, of which 392 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
Proof that your company works to documented, repeatable processes — from bid to acceptance. By far the most frequently required certificate in public procurement.
Who it is for: Practically every sector. Anyone who bids regularly will sooner or later run into this requirement.
- Stocktake: which processes already exist, what is missing?
- Document processes and responsibilities (the former “quality manual”)
- Internal audit as a dry run
- Stage 1 and stage 2 audit by an accredited body
The certification body must be accredited (in Germany: DAkkS-listed) — otherwise buyers will not recognise the certificate.
ISO 14001 — Environmental management
Currently required or explicitly named in 636 open procedures, of which 111 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
Proof of a systematic handling of environmental impacts: waste, energy, emissions, legal obligations.
Who it is for: Construction, waste management, facility management, transport — wherever public buyers write environmental criteria into the selection stage. Demand grows with every procurement-law reform.
- Environmental review: what impact does the company actually have?
- Build a register of legal requirements (which environmental obligations apply to you)
- Set objectives and measures, document the processes
- Audit by an accredited body
EMAS — the EU eco-management scheme
Currently required or explicitly named in 567 open procedures, of which 68 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
The environmental management system of the EU regulation — ISO 14001 plus a verified environmental statement and public registration. Wherever ISO 14001 is required, EMAS is recognised as equivalent or higher.
Who it is for: Companies heading for ISO 14001 anyway that want the extra step for public visibility — or whose buyers name EMAS explicitly.
- Build environmental management along ISO 14001 lines
- Draw up the environmental statement
- Validation by a licensed environmental verifier
- Entry in the EMAS register
ISO 27001 — Information security
Currently required or explicitly named in 59 open procedures, of which 41 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
Proof of an information security management system: access control, data handling, contingency plans, suppliers.
Who it is for: IT service providers, software companies, data centres, operators of sensitive infrastructure. Increasingly mandatory in German public-sector IT procedures — our measurement shows most procedures requiring it are German.
- Define the scope: which systems and sites belong to it?
- Risk analysis and control catalogue (Statement of Applicability)
- Implement the controls and run them verifiably
- Stage 1 and stage 2 audit by an accredited body
For public-sector IT, look at BSI IT-Grundschutz (the German federal baseline) — some buyers accept or require it instead of or alongside ISO 27001.
ISO 45001 — Occupational health and safety
Currently required or explicitly named in 18 open procedures, of which 6 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
Proof of a management system for safety and health at work.
Who it is for: Construction and assembly companies, maintenance — anywhere with physical work. Rarely required explicitly in selection criteria so far — more of a plus at the award stage.
- Consolidate risk assessments
- Document processes and responsibilities
- Internal audit
- Certification audit
SCC — Safety Certificate for Contractors
Currently required or explicitly named in 1 open procedures, of which 1 in Germany. And because 54–62% of procurement repeats every year, this demand is not a snapshot — it is a steady state.
The safety certificate for work on third-party industrial sites (chemicals, energy, refineries). Personal certificates for employees plus a company certificate.
Who it is for: Companies working on industrial premises — there it is usually the plant operator who requires it, not the public buyer. It hardly ever appears in public selection criteria; our measurement barely finds it.
- Clarify whether a personal or a company certificate is required
- Training and examination of the employees
- For the company certificate: a documented HSE system plus an audit
DEMAND · measured nightly on the selection criteria of open procedures (structured code + explicit naming) · DURATION/COST · practitioner experience, not a measurement · methodology: friedrich-clement.com/methodology