QUALITY INTL CERTIFICATIONSHow to Get ISO Certification in UAE — 90-Day Plan
Plan roughly 90 days: gap assessment and project launch in days 1–15, documentation and implementation by day 45, training and internal audit by day 60, management review and certification body selection by day 75, then stage 1 and stage 2 audits closing at day 90. Realistic timelines move with company size, scope and how mature your existing processes already are.
A week-by-week roadmap from gap analysis to certificate, written for UAE companies.
The 90-Day Plan at a Glance
Ninety days is a realistic window for a focused UAE company to reach ISO certification, provided leadership treats it as a project with a calendar rather than an occasional paperwork chore. The plan splits into five phases, each with a clear output that the next phase consumes.
The pace genuinely moves with company size. A ten-person Dubai trading firm with tidy records can compress the phases; a multi-site Abu Dhabi contractor with headcount across several emirates usually needs the full window, and the certification body's own scheduling can add time at the tail. What does not compress well is evidence — the system must run for real before an auditor walks in.
| Days | Phase | What happens |
|---|---|---|
| 1–15 | Gap assessment + project launch | Compare current practice to the standard, appoint the project team, prioritise fixes |
| 16–45 | Documentation + implementation | Write procedures and records, then run them for real |
| 46–60 | Training + internal audit | Train every affected role, audit the system, close findings |
| 61–75 | Management review + CB selection | Review results, choose an accredited certification body |
| 76–90 | Stage 1 + stage 2 audits | Readiness review, then the full certification audit |
Days 1–15: Gap Assessment and Project Launch
The gap assessment is the anchor of the whole plan. Someone competent — an internal quality manager or an external consultant — compares what your company actually does today against every clause of the standard you are pursuing, and writes the differences down. The output is a prioritised action list, not a general essay.
Launch the project properly in the same fortnight. Appoint a project leader with real authority, confirm the certification scope — which sites, which processes, which products or services — and put the 90-day calendar in front of management. UAE companies that skip the launch step routinely watch week three dissolve back into business-as-usual.
Use days 12–15 to clear the quick wins the gap assessment exposed: missing registers, undocumented responsibilities, supplier contracts without review dates. Small items fixed early keep the documentation phase focused on the structural work instead of drowning in housekeeping.
Days 16–45: Documentation and Implementation
Documentation takes the largest block of the calendar, because the standard expects you to say what you do and then prove you do what you say. The typical document list: a policy, a manual or process map, procedures for the core clauses, work instructions where tasks are complex, and the records those procedures generate.
Write lean. Procedures that describe your real workflow get followed; procedures copied from a template get ignored, then fail the stage 2 audit. Involve the people who do the work — a Dubai fabrication shop should write its inspection procedure with its inspectors, not around them.
Implementation runs alongside the writing, which is why this phase spans thirty days. From the moment a procedure is issued, staff work to it and records start filling. A certification body expects evidence that the system has been running, so the earlier your logs and review records accumulate real entries, the stronger your audit position. If day 45 arrives with core procedures still unissued, extend the plan honestly rather than audit a paper system.
Days 46–60: Training and Internal Audit
With the system live, train the people who must operate it. Training means targeted, role-based briefings — how the warehouse team raises a nonconforming product, how sales handles customer complaints, how the document controller withdraws an obsolete version — not a single company-wide lecture on the whole standard. Record who was trained on what, because auditors sample training records early.
The internal audit in this phase is your rehearsal. An internal auditor, trained and independent of the area being audited where company size allows, checks whether documented procedures are actually followed and whether the records prove it. Every finding gets an owner and a fix.
Expect findings. The point of an internal audit is to surface problems while they are still cheap; the same issues found by a stage 2 auditor become nonconformities on your certification record. Close every internal finding before the phase ends, and verify the fixes actually held.
Days 61–90: Management Review, Certification Body and the Stage Audits
The management review, held in days 61–75, formally closes the build phase. Management reviews audit results, customer feedback, process performance and corrective actions, and decides in a minuted meeting that the system is ready. Certification auditors ask for those minutes by name.
The same window is when you select a certification body, and the only check that matters is accreditation: a legitimate CB is accredited by a recognised accreditation body, and you can verify that accreditation directly with the accreditor. This matters in the UAE market, where certificates issued through unaccredited routes still circulate — certification bodies such as QIC (Quality International Certifications), a UAE calibration and certification company since 1998, publish their accreditation details precisely so buyers can verify rather than take a salesperson's word. Costs at this stage are indicative, not fixed: consulting is optional, and the certification body fee scales with scope, headcount and site count, so request quotations against your actual scope. And refuse the shortcut entirely — never buy a certificate without audits. A document that arrives without stage 1 and stage 2 audits is a fake certificate, and it collapses the moment a tender committee verifies it.
Days 76–90 belong to the certification body. Stage 1 is the readiness review, largely documentary: scope, mandatory records, internal audit results, management review minutes. Fix anything it flags immediately. Stage 2 is the full on-site audit — auditors walk the floor, interview staff and trace records — and the certificate follows once any findings are closed with corrective action evidence.
Checklist
Before you commit to a 90-day ISO plan, confirm each item:
- Gap assessment completed and a prioritised action list issued.
- Project leader appointed with authority, and certification scope confirmed.
- Core procedures written with the people who actually do the work.
- Records accumulating real entries — not blank forms in a folder.
- Role-based training delivered and documented.
- Internal audit performed, findings closed and verified.
- Management review held and minuted.
- Certification body accreditation verified with the real accreditation body.
- Consulting kept optional; certification fees quoted against actual scope and headcount.
- Stage 1 and stage 2 audits both scheduled — no certificate without audits.
For the Dubai market specifically, the ISO 9001 certification in Dubai step-by-step guide lists the locally active accreditation bodies and typical consultant plus audit fee ranges.
Frequently Asked Questions
How long does it take to get ISO certification in UAE?
Around 90 days for a prepared single-site company: gap assessment and launch by day 15, documentation and implementation by day 45, training and internal audit by day 60, management review and certification body selection by day 75, then stage 1 and stage 2 audits. Larger or multi-site companies need longer, mainly for implementation evidence and audit scheduling.
What are the steps to get ISO 9001 certified?
Gap assessment, project launch, documentation and implementation, training, internal audit, management review, certification body selection, then the stage 1 and stage 2 certification audits. The order matters, because each phase produces the evidence the next one consumes. Skipping the internal audit and management review steps is the most common reason the stage 2 audit fails.
How much does ISO certification cost in Dubai?
Costs are indicative rather than fixed: consulting is optional, and the certification body fee scales with scope, headcount and the number of sites. A lean small-company project spends mainly the certification body fee and staff time, while larger scopes raise both. Request quotations against your actual scope, and budget across the certificate cycle rather than the initial audit alone.
Can I get ISO certified without a consultant?
Yes. A consultant accelerates the gap assessment and documentation, but the standard requires a working system and successful audits — not a consultant on the payroll. Companies with disciplined staff and mature processes routinely certify self-driven, while complex or multi-site organisations benefit more from external help. If you self-drive, invest in internal auditor training, because that is the step self-driven projects under-resource most.
Who issues ISO certificates in UAE?
Certification bodies — independent organisations that audit your management system and issue the certificate. They are themselves overseen by accreditation bodies, so verify any CB's claimed accreditation directly with the recognised accreditation body before signing. ISO itself does not issue certificates to companies, and anyone offering an ISO-branded certificate without stage 1 and stage 2 audits is issuing a fake.