Defence Procurement, ISO 37001
ISO 37001:2025 — What Ukraine’s Defence Procurement Certification Means for Suppliers
Ukraine’s Defence Procurement Agency has confirmed compliance with ISO 37001:2025. But what does this mean for defence suppliers? We examine how anti-bribery certification affects supplier due diligence, conflicts of interest, contractual safeguards and compliance risks for Ukrainian and international defence companies.
ISO 37001:2025 at Ukraine’s Defence Procurement Agency: What Suppliers Need to Know
Complex law. Clear action.
Reviewed by Oleksandr Sobovyi, Founder & CEO of CORVUS AI — editorial responsibility statement below.
Ukraine’s Defence Procurement Agency has confirmed compliance with the updated ISO 37001:2025 anti-bribery standard. For suppliers, the significance goes beyond the Agency’s institutional credibility. A certified anti-bribery management system requires risk-based scrutiny of business partners, potentially affecting due diligence, conflict-of-interest disclosures and contractual safeguards.
The important distinction is that certification does not automatically impose new legal obligations on suppliers. Those obligations arise through applicable legislation, procurement requirements and contracts.
For Ukrainian and foreign defence companies, understanding that distinction is essential.
1. What happened?
On 27 October 2026, Ukraine’s Ministry of Defence announced that the Defence Procurement Agency DOT had successfully completed a surveillance audit by MSECB and obtained certification against ISO 37001:2025.
This was not the Agency’s first anti-bribery certification.
DOT had previously obtained certification under ISO 37001:2016 in October 2025. The latest audit concerned the transition to the updated standard.
Following the institutional consolidation of the Defence Procurement Agency (AOZ) and the State Operator for Non-Lethal Acquisition (DOT), the scope of certification deserves particular attention.
Management-system certification applies to a defined organisation and scope of activities. Public confirmation that an agency is certified does not necessarily establish that every procurement process, organisational unit or contractual activity falls within the certified scope.
For suppliers assessing a particular procurement, the relevant questions are therefore straightforward:
Which legal entity holds the certificate?
What activities and organisational units are covered?
Does the certified management system extend to the procurement process concerned?
These are questions of documentary verification, not grounds for questioning the Agency’s certification.
2. What changed under ISO 37001:2025?
ISO 37001:2025 replaced the 2016 edition of the international anti-bribery management-system standard.
The updated edition places greater emphasis on organisational integrity, leadership, anti-bribery culture and conflicts of interest.
However, the most relevant provisions for suppliers are not limited to the revised treatment of conflicts of interest.
Three areas of the standard are particularly important:
Clause 8.2 — Due diligence
The organisation must apply risk-based due diligence to relevant transactions, projects, activities and business partners where the assessed bribery risk warrants further scrutiny.
Clause 8.5 — Anti-bribery controls by business partners
The organisation must consider whether business partners have appropriate anti-bribery controls and, where relevant and practicable, take measures to address identified deficiencies.
Clause 8.6 — Anti-bribery commitments
Where bribery risks exceed a low level, the standard provides for procedures concerning anti-bribery commitments and the ability to terminate relationships in the event of bribery, subject to practical feasibility and the applicable circumstances.
These provisions do not mean that every supplier must obtain ISO 37001 certification.
They do mean that an organisation operating a certified system needs a defensible approach to assessing and managing bribery risks associated with its business partners.
For defence suppliers, that distinction matters.
3. What the certificate does not establish
Certification is not proof that corruption cannot occur
ISO 37001 certification is an assessment of a management system against defined requirements.
It does not guarantee the absence of bribery, establish immunity from investigation or replace statutory oversight.
The Agency remains subject to applicable Ukrainian law, public-sector accountability mechanisms and relevant procurement controls.
Certification should therefore be understood as evidence of management-system conformity within the certified scope, rather than a guarantee of outcomes.
Certification does not automatically extend to suppliers
A supplier does not become ISO-compliant merely because its customer holds a certificate.
Equally, the customer’s certification does not automatically require every supplier to maintain an independently certified anti-bribery management system.
The practical consequences depend on the risk assessment, procurement documentation and contractual arrangements.
Certification does not establish the content of every contract
ISO 37001 supports risk-based anti-bribery controls, but it does not prescribe an identical set of contractual clauses for every supplier.
Rights of audit, disclosure obligations, termination provisions and compliance representations must be assessed against the actual contractual documents.
Without reviewing those documents, it would be inappropriate to claim that the Agency has introduced particular obligations across all procurement contracts.
4. Ukrainian law: when is an anti-corruption programme mandatory?
The legal starting point is Article 62 of Ukraine’s Law on Prevention of Corruption, read together with the applicable public procurement legislation.
Under the current Law No. 922-VIII on Public Procurement, the absence of an anti-corruption programme or an authorised compliance officer may constitute a ground for rejecting a participating legal entity, other than a non-resident, where the procurement value reaches UAH 20 million, including the relevant lot.
The statutory obligation and the procurement-law consequence must be considered together, rather than treated as interchangeable rules.
Three qualifications are particularly important.
First, the procurement procedure matters.
Defence procurement may be governed by special legislation and wartime procurement arrangements. It is therefore necessary to determine which statutory requirements apply to the particular procedure before concluding that the general public procurement rules govern the supplier.
Second, the supplier’s legal status matters.
The exclusion for non-residents in the relevant public procurement provision should not be interpreted as a general exemption from Ukrainian anti-corruption law, contractual obligations or other applicable requirements.
Third, the legislative framework is changing.
Ukraine adopted Law No. 4888-IX on Public Procurement in May 2026. The existing Law No. 922-VIII is scheduled to cease to apply on 24 March 2027.
Suppliers planning future tenders should therefore distinguish between the current legal framework, special defence procurement rules and forthcoming legislative changes.
A supplier should not rely solely on the UAH 20 million threshold when assessing its anti-bribery obligations.
5. Where the commercial risk arises: contractual compliance
For many suppliers, the immediate issue is not whether the law expressly requires a formal anti-corruption programme.
It is whether the customer’s procurement and contractual requirements demand evidence of adequate anti-bribery controls.
Depending on the risk profile and applicable procurement documentation, suppliers may encounter requirements concerning:
Beneficial ownership and corporate structure: identifying controlling persons, ownership arrangements and relevant intermediaries.
Conflicts of interest: disclosing relationships involving procurement officials, advisers, former employees or other persons whose connections may create an actual or perceived conflict.
Intermediaries and agents: explaining the services performed, compensation arrangements, authority to represent the supplier and commercial justification for payments.
Contractual safeguards: anti-bribery representations, reporting obligations, termination provisions and, where agreed, audit or verification rights.
Subcontractors: ensuring that relevant compliance commitments can be implemented throughout the contractual supply chain.
Incident response: documenting how improper requests, suspicious payments and allegations of bribery are identified, escalated and addressed.
Not all these measures are automatically required by ISO 37001 in every supplier relationship.
Their relevance depends on the assessed risks and the measures selected by the contracting organisation.
Nevertheless, they represent foreseeable areas of scrutiny for companies operating in a sensitive procurement environment.
6. A particular issue for foreign defence manufacturers
Foreign manufacturers may operate sophisticated corporate compliance systems while relying on local distributors, consultants or consortium partners to interact with Ukrainian contracting authorities.
That structure can create a significant governance gap.
The manufacturer may have effective internal policies, but insufficient visibility over the individuals negotiating with the customer, the services performed by intermediaries or the payments made through local partners.
This is particularly relevant where a Ukrainian partner is responsible for tender preparation, government relations, logistics or contract administration.
A success-based commission is not inherently unlawful. However, it is an important risk indicator requiring assessment of the intermediary’s actual services, payment arrangements, authority and relationships with public officials.
The same applies to former public officials employed by suppliers. Previous government service is not itself evidence of misconduct, but certain relationships may create conflicts of interest or other legal risks.
For foreign manufacturers, the appropriate response is not simply to request a general compliance declaration from the local partner.
It is to establish a documented allocation of responsibilities, information rights, escalation procedures and proportionate contractual safeguards.
The objective is to ensure that the manufacturer can demonstrate effective oversight of the relationships through which it enters the Ukrainian defence market.
7. Six actions for suppliers' legal and compliance teams
1. Review existing contracts.
Identify current agreements with the Defence Procurement Agency, including contracts originally concluded with DOT before the institutional consolidation. Verify the contracting entity, any succession arrangements and the applicable anti-bribery provisions.
2. Determine the applicable procurement regime.
Establish whether the relevant procurement is governed by general public procurement law, special defence procurement rules or another lawful procurement mechanism. Confirm the applicable requirements rather than relying on the contract value alone.
3. Review the anti-corruption programme.
Check whether the company is legally required to maintain a formal programme and appoint an authorised officer. Even where no statutory obligation applies, assess whether existing policies adequately address the contractual and operational risks.
4. Prepare a proportionate due diligence file.
Maintain current beneficial ownership information, relevant sanctions-screening records, intermediary disclosures and policies concerning gifts, hospitality and improper payments.
5. Map conflicts of interest and third-party exposure.
Review relationships involving agents, consultants, former officials and subcontractors. Pay particular attention to unclear services, unusual payment structures and insufficiently documented decision-making.
6. Establish an incident-response procedure.
Ensure that employees and representatives know how to report improper requests, preserve evidence, escalate concerns and obtain legal advice without compromising the integrity of an investigation.
A documented response to a suspected improper request can be important evidence of effective compliance controls.
8. When should suppliers seek legal advice?
Routine supplier due diligence can often be managed internally.
A targeted legal assessment becomes particularly important where:
an intermediary receives compensation linked to the award or performance of a defence contract;
a supplier employs former officials who may have relevant connections with the contracting authority;
a foreign manufacturer relies on a Ukrainian consortium partner to manage procurement interactions;
the applicable procurement regime or mandatory anti-corruption programme requirements are uncertain;
contractual anti-bribery obligations conflict with existing distribution, agency or subcontracting arrangements.
In these situations, the objective should be to identify the relevant legal obligations, allocate responsibilities and implement proportionate controls before the commercial commitment is made.
9. The broader lesson
ISO 37001:2025 certification is a positive institutional development for Ukraine’s defence procurement system.
But suppliers should not interpret it merely as a reputational signal from the customer.
Its practical significance lies in the growing importance of documented, risk-based anti-bribery controls throughout procurement relationships.
The certificate belongs to the contracting authority. The supplier’s compliance obligations must still be established through law, procurement documentation and contract.
For companies entering or expanding in Ukraine’s defence market, that is the distinction that turns compliance from a formal declaration into a defensible business decision.
Disclaimer
This article has been prepared by CORVUS AI for general informational and educational purposes only. It is intended to make complex legal and regulatory developments easier to understand.
It does not constitute legal advice and does not create a professional adviser–client relationship. The information should not be relied upon as a substitute for advice based on the specific facts, circumstances and applicable law relevant to your organisation or project.
The article reflects our understanding of the law and regulatory framework as of the date of publication. Legislation, case law, regulatory guidance and administrative practice may subsequently change. While reasonable care has been taken in preparing this article, CORVUS AI does not warrant that the information is complete or remains current after the date of publication. We do not undertake to update this content.
To the fullest extent permitted by applicable law, CORVUS AI excludes liability for loss arising from reliance on this article. Nothing in this article constitutes an offer or solicitation to provide regulated legal services in any jurisdiction where doing so would be unlawful.
AI-assisted preparation: This article was prepared with the assistance of AI tools. Its legal analysis, conclusions and final text were subject to human review and editorial control and were reviewed and approved prior to publication by Oleksandr Sobovyi, Founder & CEO of CORVUS AI. CORVUS AI retains editorial responsibility for the published content.
For advice tailored to your organisation, project or specific circumstances, please contact CORVUS AI.
About the author
Oleksandr Sobovyi
Founder & CEO, CORVUS AI
Oleksandr has more than 20 years of experience in legal and public-sector work, including senior legal positions within Ukraine’s Ministry of Justice, Ministry of Defence and Ministry of Agrarian Policy.
CORVUS AI is a Netherlands-based legal and regulatory advisory firm focusing on complex regulatory matters, defence and dual-use activities, governance and EU–Ukraine cross-border projects.
Complex law. Clear action.
contact@corvusai.eu
www.corvusai.eu
This article reflects CORVUS AI’s analysis as of 29 October 2026. It is provided for general information and does not constitute legal advice concerning any particular procurement, supplier or contractual relationship.
Editorial responsibility
This article was prepared with the assistance of artificial intelligence tools and subjected to human legal and editorial review.
CORVUS AI assumes editorial responsibility for the publication. The responsible editor is Oleksandr Sobovyi, Founder & CEO.
This editorial process takes account of the transparency framework in Article 50(4) of Regulation (EU) 2024/1689, including the provisions concerning human review, editorial control and editorial responsibility.
