ISO 37001 anti-bribery management and public procurement in Georgia

Public contracts and donor-funded projects carry the highest bribery risk and the strictest consequences. ISO 37001 gives a supplier a structured way to prevent, detect and respond to bribery, and to show it.

The Georgian procurement framework

Public procurement in Georgia runs through the electronic system operated by the State Procurement Agency. The Law of Georgia on Public Procurement, adopted in February 2023 as part of approximation with EU rules under the Association Agreement, regulates procedures, subcontractors and conflicts of interest. Among the grounds for placing a supplier on the procurement black list are convictions for bribe-giving, commercial bribery, influence peddling and related offences, and bad-faith conduct in procurement. Exclusion from public contracts is a serious commercial risk for any company that relies on them.

The institutional picture has also changed. The Anti-Corruption Bureau, created in 2022, was abolished on 2 March 2026, and its functions, including the asset declaration system, passed to the State Audit Office. Companies should follow guidance from the bodies now responsible rather than older materials.

Donor and IFI-funded projects

Many infrastructure, energy and municipal projects in Georgia are financed by international financial institutions and development partners. These lenders apply their own procurement and anti-corruption rules, including integrity clauses in contracts, audit rights and the possibility of debarment of companies found to have engaged in corrupt or fraudulent practices. Debarment by one lender can affect eligibility with others. Tender documents increasingly ask bidders to describe their compliance programme.

What ISO 37001 requires

ISO 37001:2025 is the current edition of the anti-bribery management system standard. Organisations certified to the 2016 edition must transition by 28 February 2027. The standard requires, among other things:

• an anti-bribery policy approved by top management and communicated to staff and business associates;
• a bribery risk assessment covering the organisation's activities, markets and business associates;
• a compliance function with independence and direct access to the governing body;
• due diligence on higher-risk transactions, projects, staff positions and business associates such as agents, subcontractors and joint venture partners;
• financial and non-financial controls, for example on payments, gifts, hospitality, donations and sponsorships;
• anti-bribery commitments in contracts with business associates;
• a reporting channel that allows concerns to be raised in confidence and without retaliation, and a process for investigation;
• training, monitoring, internal audit and management review.

The 2025 edition puts more weight on managing conflicts of interest, on compliance culture and on showing that controls work in practice rather than only existing on paper.

Where the risks sit for a Georgian contractor

1. Subcontractors and suppliers. The 2023 procurement law brought subcontractors into the regulated picture. Your due diligence and contract clauses should reach them.
2. Agents and intermediaries. Any third party that interacts with officials on your behalf, for permits, customs or tender communication, is high risk.
3. Conflicts of interest. Family or business links between your staff and the contracting authority's officials.
4. Gifts and hospitality. Clear limits, approval and a register.
5. Site-level payments. Cash payments, facilitation payments and informal requests at project sites.

What certification does and does not do

ISO 37001 certification from an accredited certification body shows that a system meeting the standard is in place and is audited every year. It cannot guarantee that bribery will never occur, and it does not replace legal obligations. Its practical value is that it provides documented evidence for tender questionnaires and lender due diligence, and a defensible position if an incident does occur.

Smaller contractors sometimes worry that the standard is designed for large groups. It is not: the requirements are scaled to the organisation's size and bribery risk, and a company of thirty people can run a proportionate system with a part-time compliance function.

Anti-bribery controls fit well with an existing quality system. See ISO 9001 certification steps and our ISO 9001 page.

How BALTUM helps

We run a bribery risk assessment and gap assessment against ISO 37001:2025, help set up the compliance function, due diligence procedures, controls and reporting channel, train management and staff, and carry out the internal audit before certification by an accredited body. For companies holding a 2016 certificate we plan the transition. The plan is set after the first assessment. Details are on our ISO 37001 page.

This article is general information, not legal advice. To discuss your organisation, use the form on this site or write to info@baltum.org.

Frequently asked questions

Is ISO 37001 required to bid in Georgian public procurement?

Not as a general rule. Check each tender's documents. Certification is more often requested by international lenders and private clients, and it supports answers to compliance questions in tenders.

When must ISO 37001:2016 certificates move to the 2025 edition?

Certified organisations must complete the transition to ISO 37001:2025 by 28 February 2027. Plan the transition audit with your certification body well before that date.

More articles from BALTUM Georgia