If you sell to public buyers in Germany or Romania, ISO 9001 is named routinely: 4,897 and 4,743 tender notices over the last 365 days, six in ten of every mention across the EU-27. If you sell to public buyers in Romania, Bulgaria or Hungary, it is named in one notice in ten to fourteen, the highest shares in the Union. If you sell to public buyers in the Netherlands, Czechia or Sweden, it is named in about one notice in a thousand or fewer, although all three publish more notices than Hungary. The source is TED, the EU's own procurement portal, and the query is at the end so you can re-run it.
This continues the count of ISO 27001 by country, with the same method and the same window, and adds the number that count could not show: how often a buyer that names ISO 27001 names ISO 9001 in the same notice.
The table
Full-text mentions of ISO 9001 (spellings "ISO 9001" and "ISO9001") in TED notices published between 12 September 2025 and 12 September 2026, by the buyer's country as TED records it. "Notices" is everything that country's buyers published in the same window, and "share" is the first as a percentage of the second. ISO 27001 is counted the same way, for the same window, and "naming both" is the notices that contain both.
| Buyer country | Notices | Naming ISO 9001 | Share | Naming ISO 27001 | Naming both |
|---|---|---|---|---|---|
| Germany | 165,757 | 4,897 | 2.95% | 1,539 | 580 |
| Romania | 45,263 | 4,743 | 10.48% | 115 | 72 |
| Bulgaria | 30,616 | 2,248 | 7.34% | 67 | 46 |
| Poland | 127,379 | 1,705 | 1.34% | 835 | 354 |
| Hungary | 11,138 | 782 | 7.02% | 81 | 49 |
| Greece | 10,318 | 558 | 5.41% | 213 | 207 |
| Belgium | 20,551 | 325 | 1.58% | 97 | 17 |
| France | 92,446 | 323 | 0.35% | 45 | 10 |
| Spain | 72,803 | 163 | 0.22% | 58 | 15 |
| Italy | 38,247 | 161 | 0.42% | 47 | 35 |
| Denmark | 8,574 | 78 | 0.91% | 11 | 5 |
| Slovenia | 12,956 | 77 | 0.59% | 52 | 23 |
| Slovakia | 10,157 | 72 | 0.71% | 33 | 22 |
| Finland | 15,978 | 56 | 0.35% | 25 | 5 |
| Croatia | 17,695 | 38 | 0.21% | 24 | 3 |
| Czechia | 53,649 | 33 | 0.06% | 25 | 2 |
| Netherlands | 23,488 | 24 | 0.10% | 46 | 11 |
| Latvia | 19,527 | 18 | 0.09% | 9 | 4 |
| Sweden | 23,437 | 14 | 0.06% | 14 | 10 |
| Austria | 13,151 | 10 | 0.08% | 9 | 0 |
| Portugal | 18,753 | 9 | 0.05% | 3 | 1 |
| Ireland | 11,840 | 8 | 0.07% | 5 | 0 |
| Luxembourg | 2,956 | 8 | 0.27% | 4 | 4 |
| Malta | 2,629 | 3 | 0.11% | 0 | 0 |
| Estonia | 8,006 | 2 | 0.02% | 1 | 0 |
| Cyprus | 2,290 | 1 | 0.04% | 3 | 0 |
| Lithuania | 17,122 | 0 | 0.00% | 0 | 0 |
Across the EU-27: 16,356 notices naming ISO 9001, out of 876,726 published, 1.87% of European public procurement, against 3,361 naming ISO 27001. Norway, which publishes to TED as an EEA member, adds 695 at 5.37% of its 12,947 notices; Switzerland 20, Iceland 1, Liechtenstein none, and the United Kingdom 1 of the 165 notices it still sends to TED.
What the table says
Three things stand out, and none of them is what a company selling into "Europe" would guess.
The first is concentration by absolute count. Germany and Romania together are 9,640 of the 16,356 mentions, 59%. Germany publishes more notices than any other state, so a high count there says little on its own; the 2.95% share says more, and it is well above the EU average. Romania is the surprise: a quarter of Germany's notices and almost the same number of ISO 9001 mentions.
The second is share. Romania (10.48%), Bulgaria (7.34%), Hungary (7.02%) and Greece (5.41%) name ISO 9001 in a large fraction of what they buy, which is what a standing qualification criterion looks like in the data: a certificate asked for as a matter of course in works and services contracts, not in a few specialised ones. Poland, with the second-largest number of notices, names it in 1.34%, and Belgium in 1.58%.
The third is absence. France names ISO 9001 in 0.35% of its 92,446 notices, Spain in 0.22%, Italy in 0.42%, the Netherlands in 0.10%, Czechia in 0.06%, Sweden in 0.06%. Those six publish 304,000 notices between them and name the standard in 718. In these markets a quality certificate is not a routine tender requirement, whatever it is in private procurement, and the certificate is a differentiator rather than a ticket.
The overlap with ISO 27001
1,475 EU-27 notices name both standards in the same text, 44% of the 3,361 that name ISO 27001. The share varies by country: in Greece, 207 of the 213 notices naming ISO 27001 also name ISO 9001, in Poland 354 of 835, in Germany 580 of 1,539, in the Netherlands 11 of 46. A software company that holds ISO 27001 for its security customers and sells to public buyers is, in almost half the notices that matter to it, also being asked for ISO 9001.
That is the case for holding both on one management system rather than two. Clauses 4 to 7, 9 and 10 of ISO 9001 are the same Harmonized Structure as ISO 27001, context, leadership, planning, support, evaluation and improvement, and a company that runs one already has the documented information, the management review and the audit cycle for the other. What ISO 9001 adds is clause 8, the operational clause about the product or service itself, which is where the second certificate's real work is. What StandardOS covers of it, clause by clause, is published.
What the number is and is not
These are mentions, not requirements. A notice matches if the string appears anywhere in it, for any reason: as a selection criterion, as a description of the buyer's own certification, as an equivalent that will also be accepted. "Named in 16,356 notices" is defensible; "required by 16,356 tenders" is not, and this page does not say it. The buyer's country is who buys, not where the work is done, and a contract awarded by a German federal agency to a Dutch supplier counts as German.
The comparison between standards survives the caveat, because both are counted the same way in the same notices. The comparison between countries does too, with one reservation: the share is a share of all notices, and countries differ in how much of their procurement is works, services and supplies, which differ in how often any certificate is asked for.
Run it yourself
TED's search API is public and needs no key. The query for one country is a full-text search for the spellings, restricted by buyer country and publication date:
(FT~"ISO 9001" OR FT~"ISO9001") AND buyer-country=ROU AND publication-date>=20250912
posted to https://api.ted.europa.eu/v3/notices/search with fields: ["publication-number"] and limit: 1; the totalNoticeCount in the response is the number in the table. Replace the term with (FT~"ISO 27001" OR FT~"ISO/IEC 27001" OR FT~"ISO27001") for the other column, and combine the two with AND for the overlap. The script that produced every row is in our repository as scripts/ted-by-country.mjs, and the figures above are a dated snapshot of it: re-run it and the numbers will have moved, without either being wrong.
This is not procurement advice. Whether a given tender requires a certificate is in that tender's documents, not in a count.