DSTU EN ISO 9001:2018 and DSTU ISO 9001:2015 in Ukraine: Engineering and Legal Guide, NAAU Accreditation, Prozorro Tenders, and Technical Regulations

When a Ukrainian manufacturer, construction general contractor, engineering bureau, or distributor opens a public procurement tender package or a supply contract with a European buyer, they almost always run into a requirement for a certified Quality Management System (QMS). Yet across tender specifications and regulatory rules, you'll see three different designations: the international standard ISO 9001 (ISO 9001:2015), the Ukrainian national standard DSTU ISO 9001:2015 (ДСТУ ISO 9001:2015), and the European-harmonized national standard DSTU EN ISO 9001:2018 (ДСТУ EN ISO 9001:2018). Confusing these three indices costs companies real money. Businesses either request the wrong certificate format or buy a dubious piece of paper from an unaccredited broker in 24 hours, only to get disqualified from a multi-million-hryvnia tender before the Antimonopoly Committee of Ukraine (AMKU).

Here's the direct engineering and legal answer: both DSTU ISO 9001:2015 and DSTU EN ISO 9001:2018 are official, currently valid national standards of Ukraine that adopt the international ISO 9001:2015 standard with an IDT (identical) degree of correspondence. All three documents share the exact same 10-clause Annex SL (Harmonized Structure) architecture, the same sub-clause numbering from 4.1 to 10.3, the same risk-based thinking rules, the same process approach, and the same Deming PDCA (Plan-Do-Check-Act) loop. There's zero technical divergence between them when it comes to shop-floor process control, metrological traceability, or documented information.

So why do two national editions remain in force simultaneously in Ukrainian law, and why does your engineering and legal team need to know how they differ? It comes down to how each index links to Ukrainian statutory law, European Union technical regulation directives, and public procurement rules:

• DSTU ISO 9001:2015 was adopted in Ukraine as the baseline identical translation of the Geneva ISO 9001:2015 standard and is widely cited in domestic corporate bylaws, sector licensing conditions, and standard public tenders for services and construction works;
• DSTU EN ISO 9001:2018 was adopted as an identical implementation of the European standard EN ISO 9001:2015 (issued by the European Committee for Standardization, CEN) and sits on the official lists of national standards whose voluntary application confers a presumption of conformity with Ukrainian Technical Regulations under Modules D, E, and H;
• International ISO 9001:2015 without the DSTU prefix is used in foreign trade contracts, second-party supplier audits by multinational corporations, and industrial exports to the European Union, the United Kingdom, North America, and the Middle East.

In this engineering and legal guide, the Ekontrol (Еконтроль) team breaks down Ukraine's standardization and conformity assessment statutes, how SE "UkrNDNTs" adopts standards via the IDT method, the commercial chasm between certification accredited by the National Accreditation Agency of Ukraine (NAAU) and unaccredited 24-hour "grey" certificates, bid qualification and bid protest rules in Prozorro, and how the standard operates inside Technical Regulations and defense procurement. If you're looking for a clause-by-clause operational walkthrough of building a QMS from the ground up, check out our complete ISO 9001 guide and our practical breakdown of QMS certification requirements.

To defend your company's qualification before a procuring entity's tender officer, a designated conformity assessment body auditor, or a state market surveillance inspector, your executive and quality teams need to rely on two foundational Ukrainian statutes that dismantled the post-Soviet mandatory GOST regime and established a European quality infrastructure.

Law of Ukraine "On Standardization" No. 1315-VII and the Role of SE "UkrNDNTs"

The legal and organizational rules governing national standardization are established by the Law of Ukraine "On Standardization" No. 1315-VII. Under Articles 4 and 23 of Law No. 1315-VII, Ukrainian state policy prioritizes adopting international and European standards as national standards and establishes a core European rule: national standards are applied on a voluntary basis, except where mandatory compliance is explicitly established by statutory legislation or Technical Regulations. In commercial practice, a DSTU standard becomes binding on a company in three scenarios: when a Technical Regulation or statute mandates it; when a public tender or customer contract requires a valid certificate; or when a manufacturer voluntarily declares conformity with the standard on its product labeling or corporate documents.

Pursuant to Article 11 of Law No. 1315-VII, the functions of Ukraine's sole National Standardization Body (NSB) are performed by the State Enterprise "Ukrainian Research and Training Center for Standardization, Certification and Quality" (SE "UkrNDNTs", or ДП «УкрНДНЦ»). SE "UkrNDNTs" represents Ukraine in the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and acts as an affiliate partner to the European standardization bodies CEN and CENELEC. Technical translation, drafting, and peer review of quality management standards are carried out by the specialized national Technical Committee TC 189 "Quality Management Systems" (formerly TC 93).

How the National Standardization Body Adopts Standards: Translation Method and Confirmation Method (IDT)

Under the national harmonization standard DSTU 1.7:2015 (National Standardization. Rules and Methods for Adopting International and Regional Normative Documents), SE "UkrNDNTs" adopts the ISO 9001 family into Ukrainian law strictly with an IDT (Identical) degree of correspondence. The IDT designation legally guarantees that the national standard is 100% identical to the international source in technical content, clause structure, and normative requirements, without national deviations, additions, or exemptions. Depending on the stage of harmonization, SE "UkrNDNTs" uses two formal adoption mechanisms:

1. Translation method (Метод перекладу): the complete text of the international or European standard is officially translated into Ukrainian, undergoes technical editing and public inquiry by TC 189, and is enacted by an order of SE "UkrNDNTs" as an official Ukrainian-language publication bearing a DSTU cover page. That's how SE "UkrNDNTs" Order No. 221 of December 31, 2015 enacted DSTU ISO 9001:2015 (Quality management systems - Requirements, ISO 9001:2015, IDT), which entered into force on July 1, 2016 to replace the retired DSTU ISO 9001:2009. Subsequently, an official Ukrainian translation was also released for the European-harmonized edition DSTU EN ISO 9001:2018.
2. Confirmation / Cover method (Метод підтвердження): used to rapidly integrate European EN standards into Ukraine's national catalog under the EU-Ukraine Association Agreement. SE "UkrNDNTs" issues an executive order and publishes an official national confirmation notice (cover sheet) granting the European standard the legal status of a Ukrainian national standard while the Ukrainian translation is prepared. By SE "UkrNDNTs" Order No. 454 of November 30, 2018, effective December 5, 2018, Ukraine enacted DSTU EN ISO 9001:2018 (EN ISO 9001:2015, IDT; ISO 9001:2015, IDT).

Where to Buy the Official Text Legally and Why "Free PDFs" Trigger Audit Nonconformities

Under Article 26 of the Law of Ukraine "On Standardization" No. 1315-VII, copyright to official national standard texts belongs to the state through the National Standardization Body (SE "UkrNDNTs"). Official licensed copies are distributed for a modest fee (typically UAH 500 to 900) through the SE "UkrNDNTs" catalog or authorized regulatory databases such as "Budstandart" and "Leonorm." When an engineering team downloads a "free PDF" from a university .edu.ua server or a Telegram channel, two practical problems show up right away:

• four times out of five, the file circulating online is either a scanned copy of the obsolete DSTU ISO 9001:2009 with a fake 2015 cover (still referencing a mandatory Quality Manual, a Management Representative, and 8 principles instead of 7) or an amateur machine translation of the Russian GOST R ISO 9001 filled with terminology errors;
• during a Stage 1 or Stage 2 certification audit under Clause 7.5.3 (Control of documented information of external origin), the lead auditor checks whether your company holds an official licensed copy of the standard you're certifying against.

Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII

The second statutory pillar is the Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII. It draws a clear legal boundary between two conformity assessment regimes in Ukraine:

• Voluntary conformity assessment (Chapter V, Article 24 of Law No. 124-VIII): performed via third-party QMS audits and certification to DSTU ISO 9001:2015 or DSTU EN ISO 9001:2018 on a contractual basis between your enterprise and an accredited certification body;
• Legally regulated conformity assessment (Chapter VI of Law No. 124-VIII): mandatory assessment for industrial products governed by Ukrainian Technical Regulations (harmonized with EU Directives and Regulations), where approval of the manufacturer's quality management system under Modules D, E, or H must be conducted by a Conformity Assessment Body officially designated by the Ministry of Economy and accredited by NAAU.

Plant directors, tender managers, and corporate counsel frequently ask us during kickoff consultations: "If our certificate says DSTU ISO 9001:2015, and a customer's tender specifies DSTU EN ISO 9001:2018, did the quality management requirements change in 2018?" No QMS requirements changed in 2018. The international baseline standard ISO 9001:2015, drafted by ISO Technical Committee TC 176 (Subcommittee SC 2), has remained unchanged since September 2015 (aside from the brief ISO 9001:2015/Amd 1:2024 climate action amendment adding two notes to Clauses 4.1 and 4.2). The year 2018 in DSTU EN ISO 9001:2018 simply records the year SE "UkrNDNTs" registered the European CEN edition in Ukraine's national catalog.

What the European "EN" Prefix and CEN Annex ZA Add

When the European Committee for Standardization (CEN) in Brussels adopts ISO 9001:2015 as the European standard EN ISO 9001:2015, it keeps 100% of Clauses 1 through 10 verbatim, while adding three European regulatory elements:

1. European Foreword: obliges the national standardization bodies of all CEN member countries (the 27 EU member states, EFTA countries, the UK, and candidate countries) to adopt the text unchanged as a national standard (such as DIN EN ISO 9001 in Germany, PN-EN ISO 9001 in Poland, or BS EN ISO 9001 in the UK) and withdraw any conflicting national standards.
2. UkrNDNTs National Introductory Note: maps normative references (specifically the vocabulary standard ISO 9000:2015) to their Ukrainian national equivalents (DSTU ISO 9000:2015 / DSTU EN ISO 9000:2018).
3. Annex ZA (Relationship with EU Harmonization Legislation): links the quality management system clauses to the conformity assessment modules of the European Union's New Legislative Framework and supports Ukraine's preparation for the ACAA Agreement ("industrial visa-free regime" with the EU).

Ukrainian Terminology Nuance: "СУЯ" vs "СМЯ"

When reading Ukrainian tender documents or quality procedures, you'll encounter two Ukrainian abbreviations for a QMS: СУЯ (система управління якістю) and СМЯ (система менеджменту якості). In the official Ukrainian translations published by SE "UkrNDNTs", the statutory title of both DSTU ISO 9001:2015 and DSTU EN ISO 9001:2018 is «Системи управління якістю. Вимоги» (СУЯ). The phrase "система менеджменту якості (СМЯ)" entered business usage as a direct loan translation of the English word management. Legally and technically, СУЯ, СМЯ, and QMS mean the exact same thing.

Which Standard Designation Should Appear on Your Certificate?

Both DSTU ISO 9001:2015 and DSTU EN ISO 9001:2018 are simultaneously in force across Ukraine. To eliminate formal objections from both Ukrainian state tender committees and European buyers, Ekontrol engineers advise clients to request a certificate displaying the full identity chain: DSTU EN ISO 9001:2018 (EN ISO 9001:2015, IDT; ISO 9001:2015, IDT) and DSTU ISO 9001:2015 (ISO 9001:2015, IDT), issued in both Ukrainian and English.

To pass a two-stage certification audit with an accredited body without getting hit by Major Nonconformities, your engineering team needs to know what objective evidence an auditor looks for under every clause of DSTU EN ISO 9001:2018 (DSTU ISO 9001:2015). Clauses 1 through 3 cover scope, normative references, and definitions (per DSTU ISO 9000:2015), while all auditable requirements sit in Clauses 4 through 10.

Clause 4. Context of the Organization and Process Architecture (Clauses 4.1-4.4)

The audit starts by evaluating how your business maps its operational environment:

• Understanding the organization and its context (4.1) and needs of interested parties (4.2): your team maintains a live register of external factors (statutory changes, power grid disruptions, supply chain bottlenecks, and climate considerations under the 2024 amendment) and internal factors (equipment wear, skilled labor turnover), paired with the requirements of customers, market surveillance authorities, suppliers, and staff.
• Determining the scope of the QMS (4.3): a clear statement of the products and services covered (aligned with Ukrainian NACE/KVED codes DK 009:2010 and IAF sector codes) and the physical addresses of all production shops, warehouses, and branches. If your plant manufactures parts strictly to customer drawings without designing products itself, Clause 4.3 documents the justified non-applicability of Clause 8.3 (Design and development).
• QMS and its processes (4.4): instead of isolated departmental silos, your company defines interacting processes with documented inputs, outputs, resources, process owners, and measurable Key Performance Indicators (KPIs).

Clause 5. Leadership, Quality Policy, and Organizational Roles (Clauses 5.1-5.3)

The current edition of DSTU EN ISO 9001:2018 eliminated the old clause for a single "Management Representative" who used to carry the entire burden of the audit alone. Clause 5.1 requires demonstrable commitment from top management (the CEO, Plant Director, or COO): integrating QMS targets into business strategy, funding metrology and training, and enforcing customer focus (5.1.2). Top management signs the Quality Policy (5.2) and assigns clear responsibilities and authorities (5.3) across shop-floor supervisors, technologists, procurement leads, and quality control (QC) inspectors.

Clause 6. Planning: Risk-Based Thinking and Measurable Quality Objectives (Clauses 6.1-6.3)

Clause 6.1 embeds risk-based thinking across every operational workflow. In practice, engineers build a Risk and Opportunity Register (typically scored on a $1 \times 5$ Likelihood × Severity matrix), defining preventive controls for realistic operational failures (such as off-spec raw steel deliveries, curing oven temperature drift, loss of a lead CNC programmer, or ERP server downtime). Under Clause 6.2, departments set Quality Objectives for the year: specific numeric targets (for instance, keeping On-Time In-Full delivery at $\ge 98.5%$ or cutting internal scrap from $2.4%$ to $1.1%$ by Q4) backed by budgets, deadlines, and owners. Clause 6.3 governs planned changes to the QMS when launching new workshops or restructuring teams.

Clause 7. Support: Infrastructure, Metrology, Competence, and Document Control (Clauses 7.1-7.5)

During Stage 2, the auditor verifies Clause 7 directly on the shop floor, in the maintenance department, in the testing lab, and with HR:

• Infrastructure and environment for the operation of processes (7.1.3, 7.1.4): preventive maintenance (PM) schedules and repair logs for CNC machines, presses, ventilation, and IT servers; monitoring of temperature, humidity, lighting, cleanroom particulates, or electrostatic discharge (ESD) protection.
• Monitoring and measuring resources (7.1.5): one of the most heavily scrutinized clauses in manufacturing. Every measuring instrument and test rig used to release product (scales, micrometers, bore gauges, pressure gauges, pyrometers, hardness testers, torque wrenches) must carry a unique ID tag, appear on the calibration schedule, and hold a valid verification (повірка) or calibration (калібрування) certificate traceable to national or international standards under the Law of Ukraine "On Metrology and Metrological Activity." If an instrument is found out of calibration, Clause 7.1.5.2 requires you to assess the validity of previous measurements and quarantine potentially affected batches.
• Organizational knowledge, competence, and awareness (7.1.6, 7.2, 7.3): job competence matrices, qualification certificates for welders or NDT technicians, and records evaluating whether training actually improved operator performance.
• Documented information (7.5): the standard separates documents you must maintain (policies, procedures, SOPs, process maps) from records you must retain as objective evidence of execution (inspection logs, batch passports, nonconformity reports, audit minutes).

Clause 8. Operation: End-to-End Traceability From Contract Review to Product Release (Clauses 8.1-8.7)

During the on-site Stage 2 audit, the auditor picks 3 to 5 completed customer orders and traces them backward from final shipping documents to raw material intake:

• Review of requirements for products and services (8.2.3): documented proof that engineering, production, and sales reviewed customer drawings, tolerances, delivery schedules, and statutory regulations before signing the contract or launching a work order.
• Design and development (8.3): for companies engineering their own products, software, or construction projects, the auditor checks design inputs, stage-gate Design Reviews, design Verification (did we calculate the blueprint correctly against the spec?), design Validation (does the physical prototype perform safely under real operating conditions?), and engineering change orders (8.3.6).
• Control of externally provided processes, products, and services (8.4): an approved vendor list (AVL) for raw materials, components, and outsourced processes (heat treatment, galvanizing, transport, calibration), annual supplier performance scoring, and incoming inspection logs paired with mill test certificates.
• Production and service provision (8.5): travelers and technological cards at workstations (8.5.1), end-to-end batch identification and inspection status traceability (8.5.2: "Passed", "Awaiting QC", "Quarantined"), protection of customer property such as tooling or drawings (8.5.3), preservation during storage and shipping (8.5.4), and post-delivery warranty service (8.5.5). In particular, Clause 8.5.1 f) requires validation of special processes (welding, soldering, heat treatment, casting, concrete pouring, sterilization) where output quality cannot be verified by subsequent non-destructive inspection alone. Here the auditor checks qualified welding procedures (WPQR/WPS per DSTU EN ISO 3834), certified operators, and continuous parameter logging.
• Release of products (8.6) and control of nonconforming outputs (8.7): signed release sign-offs by authorized QC inspectors, a physically segregated red-tagged Quarantine Area for defective parts, and formal disposition records (rework, scrap, or customer concession).

Clauses 9 and 10. Performance Evaluation, Internal Audit, and CAPA

Clauses 9 and 10 close the PDCA loop:

• Monitoring, measurement, analysis, and evaluation (9.1): tracking customer satisfaction and complaints (9.1.2, CSI/NPS trends), process KPI achievement, risk mitigation effectiveness, and supplier quality.
• Internal audit (9.2): scheduled audits covering all QMS clauses conducted by trained internal auditors per DSTU ISO 19011:2019, strictly enforcing auditor impartiality (auditors cannot audit their own department or work).
• Management review (9.3): formal executive review minutes covering all mandatory inputs (9.3.2) and documented resource and improvement decisions (9.3.3).
• Nonconformity and corrective action (10.2): distinguishing between immediate correction (fixing or replacing the defective item) and corrective action (CAPA) aimed at eliminating the root cause (via 5 Whys or Ishikawa fishbone analysis) so the defect cannot recur.

Two completely opposite worlds operate side by side in Ukraine's certification market: the legitimate international accreditation infrastructure and a shadow market of brokers selling decorative certificates in 24 hours. Knowing how to tell them apart determines whether your bid survives qualification in Prozorro and whether a European buyer accepts your company as an approved supplier.

1. How Legitimate Accredited Certification Works (NAAU + EA MLA + IAF MLA)

In the statutory conformity assessment system, certification bodies operate under strict multi-tier oversight:

• A management system Certification Body (CB) undergoes state accreditation by Ukraine's sole national accreditation authority, the National Accreditation Agency of Ukraine (NAAU), against DSTU EN ISO/IEC 17021-1:2017 (Conformity assessment - Requirements for bodies providing audit and certification of management systems) and DSTU EN ISO/IEC 17021-3:2018 (competence requirements for QMS auditors).
• NAAU issues the accredited CB an Accreditation Certificate (with a registration code starting with 8О...) and an official Scope of Accreditation, specifying which of the 39 international IAF/EA technical sector codes (such as Code 17 Basic metals and fabricated metal products, Code 28 Construction, or Code 33 Information technology) the body is authorized to audit and certify.
• NAAU itself passes rigorous international peer evaluations and is a full signatory to the Multilateral Agreement of the European co-operation for Accreditation (EA MLA) and the global Multilateral Recognition Arrangement of the International Accreditation Forum, tracked in the worldwide IAF CertSearch database.

Because NAAU is an active signatory to both EA MLA and IAF MLA, a DSTU EN ISO 9001:2018 / ISO 9001:2015 certificate issued within scope by a NAAU-accredited CB (or by a foreign CB accredited by DAkkS, UKAS, PCA, CAI, or ANAB) carries full international equivalence across Ukraine, the European Union, the UK, the US, Canada, and Japan under the principle "Accredited once, accepted everywhere."

2. The Anatomy of Unaccredited 24-Hour "Grey" Certificates

Search ads in Ukraine are full of brokers promising to "issue a DSTU ISO 9001 certificate in 24 hours for UAH 8,000-15,000 without an on-site visit or paperwork hassle." How does that scheme work?

1. A broker registers a private LLC with words like "International Certification Center," "UkrStandard," or "EuroCert" in its company name.
2. That entity does not hold a NAAU accreditation certificate under DSTU EN ISO/IEC 17021-1 (or it invents its own "voluntary certification system" registered as a private trademark, completely unconnected to NAAU, EA, or IAF). Another variation involves using the logo of an accredited body whose accreditation has been suspended, or whose NAAU scope only covers wholesale trade (IAF Code 29) while illegally issuing certificates for construction or manufacturing.
3. No Stage 1 documentation review and no Stage 2 on-site audit under IAF MD 5 ever take place. Within a day of receiving payment and a company registration extract, the broker prints a holographic paper certificate in direct breach of the Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII.

Using a 24-hour "grey" certificate triggers immediate commercial consequences:

• Disqualification in Prozorro public tenders: a competitor's legal team or the procuring entity's tender officer checks the CB's certificate number in the official NAAU Register at naau.org.ua in under two minutes. Once they see that the issuing company isn't accredited under DSTU EN ISO/IEC 17021-1 or lacks the required IAF sector code in its scope, the bid is rejected, and the AMKU Permanent Administrative Board upholds the disqualification.
• Rejection by European buyers, banks, and IFIs (EBRD, World Bank): when a foreign compliance officer checks IAF CertSearch or the national registers of EA MLA signatories, an unaccredited certificate flags immediately as invalid, halting export onboarding and damaging your company's reputation.

In Ukraine's electronic public procurement system Prozorro, a DSTU ISO 9001:2015 or DSTU EN ISO 9001:2018 certificate serves as one of the primary qualification and technical filters for state and municipal contracts. Procuring entities routinely require it in tenders for construction and capital repair works, energy grid and critical infrastructure reconstruction, medical equipment and pharmaceutical supply, public school and hospital catering, government IT systems, and defense logistics.

Article 16 vs Article 23 of the Law of Ukraine "On Public Procurement" No. 922-VIII

To prepare a bulletproof tender bid or challenge a competitor's defective certificate before the Antimonopoly Committee of Ukraine (AMKU), your legal and engineering teams need to distinguish between two statutory provisions of the Law of Ukraine "On Public Procurement" No. 922-VIII (operating alongside Cabinet of Ministers Resolution No. 1178 on martial-law procurement rules):

1. Article 16 "Qualification Criteria of the Procurement Procedure": sets out four exhaustive qualification criteria (availability of equipment, material and technical base, and technologies; availability of qualified staff; documented experience of performing analogous contracts; and financial capacity). State buyers frequently embed the requirement for a valid DSTU ISO 9001 certificate inside Article 16 qualification criteria (as proof of established quality management technologies) or in general qualification annexes. If a bidder submits an unaccredited certificate, a certificate missing its annual surveillance confirmation, or a certificate covering an unrelated business activity, the procuring entity disqualifies the bid for failing to meet tender requirements.
2. Article 23 "Technical Specifications, Marking, Certificates, Test Reports, and Other Means of Confirming Conformity": Part 5 of Article 23 explicitly authorizes the procuring entity to require a certificate or report issued by a conformity assessment body accredited by NAAU or a recognized international accreditation body as proof that the offered goods, works, or services conform to technical specifications. At the same time, Parts 4 and 6 of Article 23 of Law No. 922-VIII mandate the principle of equivalence (the "or equivalent" rule): if tender documentation asks for DSTU ISO 9001:2015, the buyer is legally required to accept a valid accredited DSTU EN ISO 9001:2018 or international ISO 9001:2015 certificate.

How the "24-Hour Discrepancy Correction Window" Works and Four Grounds for Disqualification

Does Prozorro's "24 hours to correct discrepancies" rule save a bidder who made a mistake with their ISO 9001 certificate? It depends on where the requirement sits in the tender dossier and when the certificate was actually issued:

• if the ISO 9001 requirement is placed under Article 16 qualification criteria and the bidder accidentally forgot to upload their valid certificate or annual surveillance letter that already existed prior to the bid submission deadline, the bidder can upload the missing file within the 24-hour correction window;
• if the DSTU EN ISO 9001:2018 certificate requirement is embedded strictly inside the technical specification of the procurement subject (Article 23), the 24-hour correction mechanism does not apply to technical specifications, resulting in immediate bid rejection;
• also note that if a bidder uses the 24-hour window to upload a newly purchased certificate whose issue date falls after the tender submission deadline, both the procuring entity and the AMKU treat that as lacking qualification at the time of bidding.

Across hundreds of tender reviews handled by Ekontrol, 90% of ISO 9001 disqualifications in Prozorro come down to four specific pitfalls:

1. Mismatch between the certificate's scope and the tender's CPV code (DK 021:2015): for example, a contractor bids on a bridge reconstruction or shelter construction tender (CPV 45200000), but uploads a DSTU ISO 9001 certificate scoped only for "wholesale trade in building materials" or "architectural consulting." The AMKU Administrative Board consistently upholds disqualification in such cases.
2. Missing annual surveillance audit confirmation letter or report: an ISO 9001 certificate carries a 3-year validity period, but 9 out of 10 major tender dossiers explicitly require the bidder to submit both the certificate and the certification body's decision or report confirming successful completion of the latest annual surveillance audit.
3. Suspended or out-of-scope NAAU accreditation of the issuing CB: the certification body holds a NAAU certificate, but its official Scope of Accreditation annex doesn't include the IAF sector code matching the bidder's industry.
4. Omitted production facilities or branch locations: the tender requires a QMS covering the manufacturing plant where the goods are produced, whereas the certificate lists only the company's legal office address in another city.

5-Minute Step-by-Step Protocol to Verify Any NAAU Certificate (Yours or a Competitor's)

Before submitting your bid or when auditing a rival bidder's proposal in Prozorro, run this four-step check:

1. Step 1. Inspect the credentials printed on the certificate: locate the exact legal name of the issuing certification body, its NAAU accreditation number (formatted as 8О..., where 8 designates management system certification bodies), the exact wording of the certified scope, the covered site addresses, and the issue and expiry dates.
2. Step 2. Look up the certification body in the official NAAU Register: go to naau.org.ua, open the "Register of Accredited CABs," and search by the 8О... number or body name. Confirm that its accreditation status is "Active" (not suspended or withdrawn) and download its PDF "Scope of Accreditation" annex to verify that it is accredited for DSTU EN ISO 9001:2018 / DSTU ISO 9001:2015 in the exact IAF sector code printed on the certificate.
3. Step 3. Check international certificates in IAF CertSearch and EA MLA: if a competitor submitted a foreign-issued certificate, verify the company's certificate in IAF CertSearch and confirm that the foreign accreditation body is an active signatory in the European co-operation for Accreditation directory.
4. Step 4. Verify the certificate's active status with the issuing CB: under Clause 8.1.2 of DSTU EN ISO/IEC 17021-1:2017, every accredited certification body must maintain a public directory or respond to official verification inquiries confirming whether a specific certificate is active, suspended for missed surveillance, or withdrawn.

For Ukrainian machinery, medical device, pressure equipment, cable, and construction material manufacturers, DSTU EN ISO 9001:2018 performs another vital engineering role: it serves as the mandatory quality system backbone for statutory product conformity assessment under Ukraine's Technical Regulations and for affixing the national Technical Regulation conformity mark (the Ukrainian trefoil mark harmonized with the European CE mark).

How Conformity Assessment Modules D, E, and H Operate Under Law No. 124-VIII and CMU Resolution No. 95

Pursuant to Article 14 of the Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII and Cabinet of Ministers of Ukraine Resolution No. 95 "On Approval of Conformity Assessment Modules" (which transposes EU Decision No. 768/2008/EC into Ukrainian law), medium- and high-risk industrial products cannot be placed on the market solely on the basis of a one-off laboratory prototype test (Module B Type Examination). A Designated Conformity Assessment Body (призначений ООВ) must audit and approve the manufacturer's quality management system to guarantee that every serial unit leaving the assembly line matches the approved type. That's where three QMS-based conformity assessment modules built on DSTU EN ISO 9001:2018 come into play:

• Module D (Conformity to type based on quality assurance of the production process) and Module D1: applied at the serial manufacturing stage (typically paired with a Module B type-examination certificate). The manufacturer must operate an approved quality management system covering production, final product inspection, and testing. Holding an implemented and certified QMS under DSTU EN ISO 9001:2018 (with rigorous focus on Clause 7.1.5 Metrological traceability, Clause 8.4 Incoming material control, Clause 8.5 Production control and special process validation, Clause 8.6 Release, and Clause 8.7 Nonconforming outputs) provides the structural foundation required by the Designated Body.
• Module E (Conformity to type based on product quality assurance) and Module E1: covers the final inspection and testing phase. Within a DSTU EN ISO 9001:2018 framework, every manufactured unit (or statistically sampled batch) undergoes final acceptance testing against harmonized standards before the manufacturer issues the Declaration of Conformity and affixes the conformity mark.
• Module H (Conformity based on full quality assurance) and Module H1 (Full quality assurance plus design examination): the most comprehensive engineering module, covering both product design and serial manufacturing without a separate Module B certificate (or adding a dedicated design examination certificate under Module H1). To pass Module H or H1, the manufacturer must operate a full DSTU EN ISO 9001:2018 system covering all Clauses 4 through 10 with zero exclusion of Clause 8.3 (Design and development). Auditors from the Designated Body inspect both the R&D engineering department (design calculations, product risk analysis, technical file) and the production workshops.

Five Regulated Sectors Where DSTU EN ISO 9001:2018 Enables Market Access

The Ekontrol engineering team regularly builds and aligns quality management systems for Modules D, E, and H across five regulated industrial sectors:

1. Medical devices, in vitro diagnostics, and active implantable devices (CMU Resolutions No. 753, No. 754, and No. 755): placing Class IIa, IIb, and III medical devices on the Ukrainian market requires QMS approval under quality assurance modules alongside the sector-specific DSTU EN ISO 13485:2018 standard.
2. Pressure equipment and simple pressure vessels (CMU Resolutions No. 27 and No. 1025, harmonized with EU Directive 2014/68/EU PED): steam boilers, heat exchangers, industrial piping, autoclaves, and pressure vessels in Categories II, III, and IV require an approved QMS under Modules D, D1, E, E1, H, or H1, integrated with welding quality requirements (DSTU EN ISO 3834) and certified NDT personnel.
3. Construction products and structural components (Law of Ukraine No. 850-IX implementing EU Regulation No. 305/2011 CPR): mandatory Factory Production Control (FPC) under AVCP Systems 1+, 1, and 2+ is built directly on the operational controls of Clauses 7 and 8 of DSTU EN ISO 9001:2018.
4. Machinery safety, elevators, personal protective equipment (PPE), measuring instruments, and ATEX equipment (CMU Resolutions No. 62, No. 438, No. 761, No. 94, and No. 1055): a certified DSTU EN ISO 9001:2018 system accelerates quality system approval by Designated Conformity Assessment Bodies.

As Ukraine's defense industrial base scales rapidly and integrates into European and NATO supply chains, DSTU EN ISO 9001:2018 functions as the foundational operating system onto which defense, aerospace, environmental, occupational safety, and laboratory accreditation standards lock in.

Defense Procurement and MilTech: Pairing DSTU EN ISO 9001:2018 with AQAP 2110 and AS 9100

For Ukrainian developers and manufacturers of unmanned aerial vehicles (UAVs/FPV drones), ground robotic platforms, electronic warfare (EW) systems, secure communications, thermal optics, armor, and military logistics supplies, holding an accredited ISO 9001 (DSTU EN ISO 9001:2018) certificate is the first prerequisite for long-term state contracts with the Defense Procurement Agency (AOZ), the State Rear Operator (DOT), and joint ventures with Western defense primes:

• AQAP 2110 (NATO Quality Assurance Requirements for Design, Development and Production, adopted into Ukraine's State Quality Assurance framework under CMU Resolution No. 452): you cannot implement AQAP 2110 without a functioning DSTU EN ISO 9001:2018 system. Clause 4.1 of AQAP 2110 explicitly requires the supplier to establish and maintain a QMS conforming to ISO 9001:2015. On top of that ISO 9001 core, AQAP 2110 adds a mandatory contract-specific Quality Plan (per ISO 10005), rigorous Configuration Management (per ISO 10007 to track every hardware, PCB, and firmware revision), counterfeit electronic part prevention controls, and unobstructed facility access for the Government Quality Assurance Representative (GQAR).
• AS 9100 (EN 9100:2018, Quality Management Systems - Requirements for Aviation, Space and Defense Organizations): incorporates 100% of the ISO 9001:2015 text and layers on aviation-critical controls: Product Safety management, Foreign Object Debris / Damage (FOD) prevention programs, Key Characteristics tracking, and mandatory First Article Inspection (FAI per AS 9102).

Building an Integrated Management System (IMS / QHSE) with ISO 14001 and ISO 45001

Because DSTU EN ISO 9001:2018 is written on the Annex SL Harmonized Structure, 70% to 75% of its management clauses align directly with the environmental management standard ISO 14001 (DSTU ISO 14001:2015) and the occupational health and safety standard ISO 45001 (DSTU ISO 45001:2019).

For manufacturing plants, construction general contractors, agricultural processors, and energy companies, combining all three standards into a single Integrated Management System (IMS / QHSE) delivers two major operational benefits:

• instead of maintaining three parallel sets of binders, your team runs one document control procedure (Clause 7.5), one internal audit schedule per ISO 19011 (Clause 9.2), one executive Management Review (Clause 9.3), and one unified CAPA tracker (Clause 10.2);
• during third-party certification, a combined multi-standard audit calculated under IAF MD 11 cuts total auditor man-days and certification fees by up to 20% compared to three separate audits. See our full engineering matrix in the guide to combining ISO 9001, ISO 14001, and ISO 45001 into an Integrated Management System.

Integrating In-House Testing and Calibration Laboratories Under ISO/IEC 17025 (Option B)

A certified DSTU EN ISO 9001:2018 system also gives a major head start to industrial enterprises that operate in-house testing, chemical, metallographic, electrical, or calibration laboratories preparing for NAAU accreditation under ISO/IEC 17025 (DSTU EN ISO/IEC 17025:2019).

Clause 8 of DSTU EN ISO/IEC 17025:2019 (Management system requirements) gives laboratories two implementation pathways: Option A (building a standalone laboratory management system) or Option B (operating within an existing ISO 9001 quality management system). Under Clause 8.1.3 of DSTU EN ISO/IEC 17025:2019, if your factory laboratory is covered within the scope of your enterprise's certified DSTU EN ISO 9001:2018 system and fulfills the technical competence requirements of Clauses 4 through 7 (impartiality, confidentiality, metrological traceability, method validation, measurement uncertainty estimation, and proficiency testing), it automatically satisfies the management system requirements of Clauses 8.2 through 8.9 without duplicating document control, internal audit, or management review procedures.

Once your quality management system is operating across your workshops and verified by an internal audit, your next decision is selecting an independent Certification Body (CB). That choice determines both your 3-year audit budget and whether your target customers accept the certificate.

Criterion 1. National NAAU Accreditation vs Direct Foreign Accreditation (DAkkS, UKAS, ANAB)

Choosing between a Ukrainian NAAU-accredited body and the local branch of an international registrar depends on where your revenue comes from over the 3-year certification cycle:

• Ukrainian domestic market, Prozorro public tenders, state contracts, and Technical Regulations: your primary choice is a Ukrainian certification body holding an active NAAU accreditation certificate under DSTU EN ISO/IEC 17021-1. State procurement officers verify certificates directly in the Ukrainian NAAU Register and look for the national DSTU ISO 9001:2015 or DSTU EN ISO 9001:2018 designation.
• Direct industrial exports to the EU, UK, and US or onboarding with multinational corporations: although NAAU accreditation is internationally recognized under the EA MLA and IAF MLA agreements, conservative corporate procurement teams in Western Europe and North America (especially in automotive, machinery, pharma, and chemicals) frequently ask in their vendor questionnaires for a certificate carrying DAkkS (Germany), UKAS (UK), COFRAC (France), or ANAB (US) accreditation.
• Combined Dual Certification in a single audit: the most cost-effective route for Ukrainian manufacturers that bid in Prozorro while also exporting to the EU. An accredited CB conducts one synchronized audit and issues two certificates: a Ukrainian DSTU EN ISO 9001:2018 certificate under NAAU accreditation and an international ISO 9001:2015 certificate registered in IAF CertSearch. Dual certification typically adds 30% to 40% to a domestic-only audit fee, but costs half as much as hiring two separate certification bodies. For a full financial breakdown, see our guide on ISO 9001 certification cost factors.

Criterion 2. Engineering Calculation of Audit Duration in Man-Days Under IAF MD 5

No legitimate accredited certification body quotes audit duration by guesswork. Under Clause 9.1.4 of DSTU EN ISO/IEC 17021-1, the CB is legally required to calculate initial audit time (Stage 1 + Stage 2) from the mandatory tables of IAF Mandatory Document MD 5 (Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems).

The baseline IAF MD 5 table (Table QMS 1) starts from the Effective Number of Personnel working within the scope of your QMS:

• for a company of 1 to 5 staff, baseline initial audit duration (Stage 1 + Stage 2) is 1.5 auditor man-days;
• for 11 to 15 staff, baseline duration is 2.5 auditor man-days;
• for 26 to 45 staff, baseline duration is 3.0 auditor man-days;
• for 46 to 65 staff, baseline duration is 4.0 auditor man-days;
• for 66 to 85 staff, baseline duration is 5.0 auditor man-days;
• for a plant of 126 to 175 staff, baseline duration reaches 6.0 auditor man-days;
• for an industrial enterprise of 276 to 425 staff, baseline duration is 8.0 auditor man-days.

At the same time, Sections 3 and 7 of IAF MD 5 allow an accredited CB to reduce baseline audit man-days by up to 30% when objective complexity-reduction factors apply:

1. No design and development in scope (Clause 8.3 exclusion): if your plant manufactures strictly to customer blueprints or standard specifications without in-house R&D, audit duration drops by 10% to 15%.
2. High proportion of staff performing simple, repetitive tasks: if out of 120 employees, 70 are packers, warehouse handlers, drivers, or operators running identical assembly tasks under a single work instruction, IAF MD 5 permits adjusting the effective headcount downward.
3. Low process complexity and compact single-site layout: automated processes operating under one roof.

How is that audit time distributed across the 3-year certification lifecycle?

• Stage 1 (Documentation and readiness review): takes roughly 20% to 30% of the initial audit time (typically 0.5 to 1.0 man-day). The auditor checks your QMS procedures, scope, completed internal audit records (Clause 9.2), and Management Review minutes (Clause 9.3).
• Stage 2 (On-site operational certification audit): takes 70% to 80% of the initial audit time, inspecting workshops, warehouses, labs, and engineering teams in action. If your company operates multiple branches or construction sites running identical processes, site sampling follows the square-root formula ($y = \sqrt{x}$) under IAF MD 1.
• Surveillance Audits (Surveillance 1 at Month 12 and Surveillance 2 at Month 24): each annual surveillance audit takes one-third ($1/3$) of the initial certification audit time, rounded up to the nearest half-day.
• Recertification Audit (at Month 36): takes two-thirds ($2/3$) of the initial certification audit time to renew the certificate for the next 3-year cycle.

Trying to implement DSTU EN ISO 9001:2018 by handing downloaded 2012 template folders to an already overloaded Chief Engineer usually ends the same way: the team spends six months generating dead paperwork, and during Stage 2 the external auditor discovers that actual shop-floor and warehouse operations don't match the written procedures.

The Ekontrol (Еконтроль) engineering team builds practical quality management systems that fit your real production workflows, protect your bids in Prozorro, and pass accredited Stage 1 and Stage 2 audits on the first attempt.

5-Stage Architecture of a Turnkey DSTU ISO 9001 Preparation Project

Depending on your current process maturity and tender deadlines, we step in at a specific stage or deliver the entire project turnkey:

1. Stage 1. QMS Diagnostic Audit (Gap Analysis): an Ekontrol lead auditor inspects your production shops, warehouses, procurement department, R&D bureau, and QC service. We benchmark your existing SOPs, technological cards, inspection logs, and metrology records against every requirement of Clauses 4 through 10 of DSTU EN ISO 9001:2018. You receive a detailed Gap Report, an exact IAF MD 5 man-day calculation, and a week-by-week project schedule.
2. Stage 2. Engineering and Quality Management System Implementation: instead of 500 pages of bureaucratic filler, we engineer lean, shop-floor-ready documentation tailored to your actual operations. We build your process interaction map, context and stakeholder register, live risk matrices, supplier evaluation and incoming inspection procedures (8.4), production Control Plans (8.5), quarantine and nonconformity rules (8.7), and CAPA workflows (10.2).
3. Stage 3. Staff Training, ISO 19011 Internal Audit, and Management Review: we train your process owners and internal audit team, conduct a full pre-certification internal audit across all clauses (9.2), help close every identified gap, and prepare the executive Management Review minutes (9.3).
4. Stage 4. Hands-On Certification Audit Support (Stage 1 + Stage 2): we help you select a recognized NAAU or international certification body without hidden markups, prepare the application, coach department heads and line operators for auditor interviews, and support your team through Stage 1 and Stage 2 until your certificate is issued and published in the official registry.
5. Stage 5. Ongoing Annual Management System Support: we handle scheduled internal audits, risk register updates, and preparation for your Year 1 and Year 2 surveillance audits so your certificate never faces suspension.

To discuss your facility's processes with a lead auditor, verify a customer's tender requirement, or get a transparent cost and timeline calculation for your company, reach out via the Ekontrol contact page.