A few years ago the order was clear: first a company grows, then at some point certification follows. It was regarded as a sign of maturity, as something you allow yourself once time and budget permit. That order has been reversed.
Today a certificate increasingly decides whether a company even makes the shortlist. Not because standards have become more important, but because the environment has changed: procurement departments ask for evidence in a structured way, insurers require demonstrable organisation, investors examine governance, and EU regulation passes obligations down the supply chain.
Five forces are at work at the same time. None of them is new. What is new is that they make themselves felt in the same months at the same companies.
“Our customers rarely certify out of enthusiasm for standards. They certify because someone demands evidence – and because they need that evidence now, not in six months.” – Raquel Jurado Castellón, Sales Partner Germany
Tenders: the evidence belongs in the procedure, not in the conversation
Anyone working on public contracts knows the suitability assessment. Contracting authorities are expressly permitted to require evidence of quality management: § 49 of the Vergabeverordnung stipulates that public contracting authorities refer to quality assurance systems which comply with the relevant European standards and recognise corresponding certificates.
For bidders this means two things. First: the evidence is requested within the procedure, not negotiated in a sales conversation. Second: the provision also requires equivalent evidence to be recognised if a bidder is unable to provide a certificate for reasons not attributable to them. However, anyone relying on this equivalence has to substantiate it – and does so in the middle of an ongoing procedure under time pressure.
Important for a realistic assessment: public procurement law refers to accredited bodies. Eucerta is an independent, non-accredited certification body. What this means and where it becomes difficult is set out in full on our page Independently certified – including the note that we tell you in advance if a certificate from us is not sufficient for your specific client. For private clients, enterprise procurement and security questionnaires, it is usually exactly the evidence that is being asked for.
Customer audits: large customers pass on their obligations
The second force is the strongest, because it reaches mid-sized companies regardless of sector and size. Regulated companies have to assess the security of their suppliers. The NIS2 Directive puts this clearly: affected entities should assess and take into account the quality and resilience of the products and services used as well as the cybersecurity practices of their suppliers and service providers – and include corresponding measures in the contractual relationships with their direct suppliers.
The result lands with companies that are not regulated themselves at all: as a security questionnaire, as a new contract clause, as an obligation to provide evidence before the contract is renewed. A certificate to ISO 27001 answers these questions in one document instead of twenty e-mails. That is exactly the point of our page for startups: the question “ISO 27001 in place?” is answered in a few seconds with a link to the public register.
Cyber insurers: organisation becomes a condition
The third force comes from the insurance side. Anyone renewing cyber cover today no longer fills in a short questionnaire, but sets out technical and organisational measures. The scale of the risk behind this can be documented: the IBM Cost of a Data Breach Report 2026 puts the average cost of a data breach worldwide at USD 4.99 million – an increase of twelve per cent on the previous year and an all-time high.
For small companies these average figures cannot be transferred directly, but the direction is the same. And the attackers’ choice of targets is unambiguous: according to the BSI report on the state of IT security in Germany 2025, around 80 per cent of the reported attacks in the reporting period from 1 July 2024 to 30 June 2025, for instance involving ransomware, were directed against small and medium-sized enterprises – which often lack the means and the knowledge to protect themselves on their own. How deep ISO 27001 goes here is shown on our page on ISO 27001: what is examined is not the technology alone, but whether you know your risks and make well-founded decisions.
Investors: governance is asked about in due diligence
In financing rounds and company sales, management system questions have become part of the standard repertoire: how do you manage quality? Who is responsible for information security? How do you handle AI in the product? A certified system does not replace due diligence, but it shortens it – because the answers are documented rather than having to be reconstructed in interviews.
`[CHECK: If there is solid feedback from customer projects on shortened due diligence processes, add a concrete, approved example here. Otherwise the section stays qualitative – as it stands now.]`
EU regulation: the requirements arrive via customers, not via authorities
The fifth force is regulation itself, although usually indirectly. The EU AI Act has been in force since 1 August 2024, the obligations for general-purpose AI models have applied since 2 August 2025, and further stages follow in 2026 and 2027. Anyone using AI in their product gets the questions about it from customers, often before an authority asks them. We provide an overview of the stages and what follows from them for small companies on our page on the EU AI Act.
The situation has also changed in sustainability reporting, and in favour of small companies. But even where obligations have been relaxed, large customers’ need for data remains.
What this means in practice
Five forces do not call for panic, but for a sober planning exercise. Three points help here:
- Clarify who is demanding the evidence. An enterprise procurement department, a public contracting authority and an insurer want to see different things. The answer determines the standard and the timeline.
- Start with what already exists. Policies, emergency contacts, onboarding checklists: in most organisations there is more substance in place than they themselves assume. What is missing is the order, not the content.
- Work with fixed figures. At Eucerta the first standard costs 179 euros per month, each additional one 149 euros, with a 36-month term and as a fixed price for companies with up to 30 employees. You can check the figures in the cost calculator, without a preliminary conversation.
Certificates from Eucerta are valid for three years from the audit date; between audits the system stays up to date in the platform instead of going stale in a folder. For companies that first want to know which standard fits their business, the page for small and medium-sized enterprises is the right starting point.
Conclusion
Certification is no longer optional, because it is no longer requested voluntarily. Tenders require evidence, large customers pass on their obligations, insurers examine organisation, investors ask about governance, and regulation generates questions that travel on down the supply chain.
The good news in this: the evidence that answers all these questions is the same. Anyone who sets up their management system properly once serves five expectations with one investment. The wrong moment is the one when the question is already on the table.
Your next step: Use the cost calculator to work out what your evidence costs – and check with express certification whether things can move quickly at your company.
Further reading:
