National foreword

This British Standard is the UK implementation of EN ISO 37001:2026. It is identical to ISO 37001:2025. It supersedes BS ISO 37001:2025, which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee G/1, Governance.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 March 2025.

This European Standard was approved by CEN on 4 October 2026.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

European foreword

The text of ISO 37001:2025 has been prepared by Technical Committee ISO/TC 309 "Governance of organizations” of the International Organization for Standardization (ISO) and has been taken over as EN ISO 37001:2026.

This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by April 2027, and conflicting national standards shall be withdrawn at the latest by April 2027.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN shall not be held responsible for identifying any or all such patent rights.

Any feedback and questions on this document should be directed to the users’ national standards body. A complete listing of these bodies can be found on the CEN website.

According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the United Kingdom.

Endorsement notice

The text of ISO 37001:2025 has been approved by CEN as EN ISO 37001:2026 without any modification.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 309, Governance of organizations.

This second edition cancels and replaces the first edition (ISO 37001:2016), which has been technically revised. It also incorporates the Amendment ISO 37001:2016/Amd 1:2024.

The main changes are as follows:

subclauses were added on climate change and stressing the importance of the compliance culture;
conflicts of interest were addressed;
the concept of the anti-bribery function was clarified;
the wording was harmonized with other standards where appropriate and reasonable;
the latest harmonized structure was introduced.

Licensing and use terms

The ISO publications, as well as any updates and/or corrections, and any intellectual property or other rights pertaining thereto, are owned by ISO. ISO publications are licensed, not sold. Nothing in this document shall operate to assign or transfer any intellectual property rights from ISO to the user. The ISO publications are protected by copyright law, database law, trademark law, unfair competition law, trade secrecy law, or any other applicable law, as the case may be. Users acknowledge and agree to respect ISO’s intellectual property rights in the ISO publications.

The use of ISO publications is subject to the terms and conditions of the applicable licensing agreement.

ISO publications are provided under different licensing agreement types (“License Type”) allowing a non-exclusive, non-transferable, limited, revocable right to use/access the ISO publications for one or more of the following purposes described below (“Purpose”), which may be internal or external in scope. The applicable Purpose(s) must be captured in the licensing agreement.

License Type:
1. a single registered end-user license (watermarked in the user’s name) for the specified Purpose. Under this license the user cannot share the ISO Publication with anyone, including on a network;
2. a network license for the specified Purpose. The network license may be assigned to either unnamed concurrent end-users or named concurrent end-users within the same organization.
Purpose:
1. Internal Purpose: internal use only within user’s organization, including but not limited to own implementation (“Internal Purpose”).
The scope of permitted internal use is specified at the time of purchase or through subsequent agreement with ISO, the ISO member body in the user’s country, any other ISO member body or an authorized third-party distributor, including any applicable internal reproduction rights (such as internal meetings, internal training programs, preparation of certification services, integration or illustration in internal manuals, internal training materials, and internal guidance documents). Each internal use must be explicitly specified in the purchase order, and specific fees and requirements will apply to each permitted use.
1. External Purpose: external use, including but not limited to certification services, consulting, training, digital services by user/user’s organization to third parties, as well as for commercial and non-commercial purposes (“External Purpose”).
The scope of permitted external use is specified at the time of purchase or through subsequent agreement with ISO, the ISO member body in user’s country, any other ISO member body or an authorized third-party distributor, including any applicable external reproduction rights (e.g. in publications, products, or services marketed and sold by user/user’s organization). Each external use must be explicitly specified in the purchase order, and specific fees and requirements will apply to each permitted use.

Unless users have been granted reproduction rights according to the above provisions, they are not granted the right to share or sub-license the ISO publications in- or outside their organization for either Purpose. If users wish to obtain additional reproduction rights for ISO publications or their content, users may contact ISO or the ISO member body in their country to explore their options.

In case the user or the user’s organization is granted a license for the External Purpose of providing any or all activities in the delivery of certification services, or for auditing for a customer, the user or user’s organization agrees to verify that the organization operating under the management system subject to certification or auditing has obtained a license for its own implementation of the ISO Standard used for the certification or auditing from the ISO member body in their country, any other ISO member body, ISO or an authorized third-party distributor. This verification obligation shall be included in the applicable license agreement obtained by the user or user’s organization.

The ISO publications shall not be disclosed to third parties, and Users shall use them solely for the purpose specified in the purchase order and/or applicable licensing agreement. Unauthorized disclosure or use of ISO publications beyond the licensed purpose is prohibited and may result in legal action.

Use restrictions

Except as provided for in the applicable License Agreement and subject to a separate license by ISO, the ISO member body in user’s country, any other ISO member body or an authorized third-party distributor, users are not granted the right to:

use the ISO Publications for any purpose other than the Purpose;
grant use or access rights to the ISO Publications beyond the License Type;
disclose the ISO Publications beyond the intended Purpose and/or License Type;
sell, lend, lease, reproduce, distribute, import/export or otherwise commercially exploit ISO Publication(s). In the case of joint standards (such as ISO/IEC standards), this clause shall apply to the respective joint copyright ownership;
assign or otherwise transfer ownership of the ISO Publications, in whole or in fragments, to any third party.

Regardless of the License Type or Purpose for which users are granted access and use rights for ISO publications, users are not permitted to access or use any ISO publications, in whole or in fragments, for any machine learning and/or artificial intelligence and/or similar purposes, including but not limited to accessing or using them (i) as training data for large language or similar models, or (ii) for prompting or otherwise enabling artificial intelligence or similar tools to generate responses. Such use is only permitted if expressly authorized through a specific license agreement by the ISO member body in the requester’s country, another ISO member body, or ISO. Requests for such authorization may be considered on a case-by-case basis to ensure compliance with intellectual property rights.

If ISO, or the ISO member body in the user’s country, has reasonable doubt that users are not compliant with these terms, it may request in writing to perform an audit, or have an audit performed by a third-party auditor, during business hours at user’s premises or via remote access.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Bribery is a widespread phenomenon. It raises serious social, moral, economic and political concerns, undermines good governance, hinders development and distorts competition. It erodes justice, undermines human rights and is an obstacle to the relief of poverty. It also increases the cost of doing business, introduces uncertainties into commercial transactions, increases the cost of goods and services, diminishes the quality of products and services, which can lead to loss of life and property, destroys trust in institutions and interferes with the fair and efficient operation of markets.

Governments have made progress in addressing bribery through international agreements such as the Organization for Economic Co-operation and Development Convention on Combating Bribery of Foreign Public Officials in International Business Transactions^[¹⁹^] and the United Nations Convention against Corruption^[¹⁸^] and through their national laws. In most jurisdictions, it is an offence for individuals to engage in bribery and there is a growing trend to make organizations, as well as individuals, liable for bribery.

However, the law alone is not sufficient to solve this problem. Organizations have a responsibility to proactively contribute to combating bribery. This can be achieved by an anti-bribery management system, which this document is intended to provide, and through leadership commitment to establishing a culture of integrity, transparency, openness and compliance. The nature of an organization's culture is critical to the success or failure of an anti-bribery management system.

A well-managed organization is expected to have a compliance policy supported by appropriate management systems to assist it in complying with its legal obligations and commitment to integrity. An anti-bribery policy is a component of an overall compliance policy. The anti-bribery policy and supporting management system help an organization to avoid or mitigate the costs, risks and damage of involvement in bribery, to promote trust and confidence in business dealings and to enhance its reputation.

This document reflects international good practice and can be used in all jurisdictions. It is applicable to small, medium and large organizations in all sectors, including public, private and not-for-profit sectors. The bribery risks facing an organization vary according to factors such as the size of the organization, the locations and sectors in which the organization operates, and the nature, scale and complexity of the organization's activities. This document specifies the implementation by the organization of policies, procedures and controls which are reasonable and proportionate according to the bribery risks the organization faces. Annex A provides guidance on implementing the requirements of this document.

Conformity with this document cannot provide assurance that no bribery has occurred or will occur in relation to the organization, as it is not possible to completely eliminate the risk of bribery. However, this document can help the organization implement reasonable and proportionate measures designed to prevent, detect and respond to bribery.

This document can be used in conjunction with other management system standards (e.g. ISO 9001, ISO 14001, ISO/IEC 27001, ISO 37301 and ISO 37002) and management standards (e.g. ISO 26000 and ISO 31000).

Guidance for the governance of organizations is specified in ISO 37000 and requirements for a general compliance management system are specified in ISO 37301.

1 Scope

This document specifies requirements and provides guidance for establishing, implementing, maintaining, reviewing and improving an anti-bribery management system. The system can be stand-alone or can be integrated into an overall management system. This document addresses the following in relation to the organization's activities:

bribery in the public, private and not-for-profit sectors;
bribery by the organization;
bribery by the organization's personnel acting on the organization's behalf or for its benefit;
bribery by the organization's business associates acting on the organization's behalf or for its benefit;
bribery of the organization;
bribery of the organization's personnel in relation to the organization’s activities;
bribery of the organization's business associates in relation to the organization’s activities;
direct and indirect bribery (e.g. a bribe offered or accepted through or by a third party).

This document is applicable only to bribery. It sets out requirements and provides guidance for a management system designed to help an organization to prevent, detect and respond to bribery and comply with anti-bribery laws and voluntary commitments applicable to its activities.

The requirements of this document are generic and are intended to be applicable to all organizations (or parts of an organization), regardless of type, size and nature of activity, and whether in the public, private or not-for-profit sectors. The extent of application of these requirements depends on the factors specified in 4.1, 4.2 and 4.5.

NOTE 1 See Clause A.2 for guidance.

NOTE 2 The measures necessary to prevent, detect and mitigate the risk of bribery by the organization can be different from the measures used to prevent, detect and respond to bribery of the organization (or its personnel or business associates acting on the organization's behalf). See A.8 for guidance.

2 Normative references

3 Terms and definitions

4 Context of the organization

4.1 Understanding the organization and its context

4.2 Understanding the needs and expectations of interested parties

4.3 Determining the scope of the anti-bribery management system

4.4 Anti-bribery management system

4.5 Bribery risk assessment

5 Leadership

5.1 Leadership and commitment

5.2 Anti-bribery policy

5.3 Roles, responsibilities and authorities

6 Planning

6.1 Actions to address risks and opportunities

6.2 Anti-bribery objectives and planning to achieve them

6.3 Planning of changes

7 Support

7.1 Resources

7.2 Competence

7.3 Awareness

7.4 Communication

7.5 Documented information

8 Operation

8.1 Operational planning and control

8.2 Due diligence

8.3 Financial controls

8.4 Non-financial controls

8.5 Implementation of anti-bribery controls by controlled organizations and by business associates

8.6 Anti-bribery commitments

8.7 Gifts, hospitality, donations and similar benefits

8.8 Managing inadequacy of anti-bribery controls

8.9 Raising concerns

8.10 Investigating and dealing with bribery

9 Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation

9.2 Internal audit

9.3 Management review

9.4 Review by anti-bribery function

10 Improvement

10.1 Continual improvement

10.2 Nonconformity and corrective action

Bibliography