On April 21, 2026, Odoo announced it had obtained the ISO/IEC 27001:2022 certification. Beyond the announcement, there is a real shift: for French companies facing NIS2, the September 2026 e-invoicing mandate and the growing requirements of their customers, the question is no longer “is my ERP secure?” but “does my ERP help me be compliant?”. The answer has just changed.
A standard, not a marketing label
ISO 27001 is the international reference standard for Information Security Management Systems (ISMS). It is not a sticker; it is a third-party audit, conducted here by SGS, that validates:
- continuous risk identification,
- the implementation of documented and measurable controls,
- governance with roles, responsibilities and documented decisions,
- mandatory improvement and re-audit cycles.
The standard rests on the triad of confidentiality, integrity, availability. In practice: only authorized users access the data, this data cannot be altered outside the process, and it remains accessible when you need it to produce, invoice or close.
The scope of Odoo's certification
This is where the detail matters. The certification does not cover a subset of the offering, but the entire chain:
- the design, development and support of Odoo applications,
- the SaaS and Odoo.sh (PaaS) hosting environments,
- electronic exchanges of documents and financial flows with banks and public administrations,
- professional implementation and data migration services.
For a CIO, this scope is what makes the certification actionable: it covers both the platform and the project lifecycle.
Why the French calendar makes this announcement strategic
Three deadlines collide in 2026 and put security center stage.
- E-invoicing: 2026/2027 calendar. On September 1, 2026, all VAT-registered companies must be able to receive electronic invoices, and large companies and mid-sized companies must issue them. SMEs, very small businesses and micro-enterprises will switch to issuing on September 1, 2027. Everything goes through Partner Dematerialization Platforms (PDP) approved by the DGFIP (French tax authority). ISO 27001 provides the organizational foundation expected to operate as a PDP or to connect to one with confidence.
- NIS2 Directive. The French transposition, driven by the Resilience bill, is expected by mid-2026. On March 17, 2026, ANSSI published the Référentiel Cyber France (ReCyF) so that future essential and important entities can prepare. Between 15,000 and 18,000 companies are affected, a majority of them SMEs and mid-sized companies. Choosing an ISO 27001-certified vendor does not automatically make you compliant, but it drastically shortens your own process: the framework is in place, audited, and recognized by your auditors.
- Peppol and European interoperability. Odoo has been an operational Peppol access point since version 16.4, with some forty countries eligible for registration, including France, Belgium, Germany, the Netherlands and Italy. The ISO 27001 certification also allows it to operate as a formally accredited Peppol access point by local authorities in the Netherlands, Singapore, Japan and the United Arab Emirates, a status these countries make conditional on the standard. For Franco-Belgian groups, the issue is immediate: B2B e-invoicing has been mandatory in Belgium since January 1, 2026, exclusively via Peppol.
What this changes in tenders
If you work with large accounts, local authorities, or regulated sectors (healthcare, finance, sensitive industry), you know supplier security questionnaires. Fifteen to fifty pages, weeks of answers, and often a blockage as long as no reference framework is provided.
ISO 27001 on Odoo means:
- pre-filled security questionnaires for the vendor/hosting layer,
- a tangible argument against heavy proprietary ERPs (SAP, Microsoft Dynamics, Oracle) on the compliance front,
- a reduction in legal risk in the event of an incident, as the chain of responsibility is clarified.
For mid-sized companies and SMEs aiming to get listed with larger accounts, a major roadblock has just been removed.
What remains your responsibility
Important: Odoo's certification covers the vendor and its managed environments. It does not cover:
- your access rights and business permission settings,
- your custom developments if they fall outside the Odoo framework,
- your integrations with uncertified third-party systems,
- your internal processes for account management, local backups and data exports.
In other words, security remains a shared responsibility. The good news is that half the journey has now been covered by the vendor.
The ANOR position
We have long supported clients on Odoo projects where security is a board-level topic, not a checkbox. This certification reinforces three key pillars of our approach:
- Sovereignty and control: Odoo is open source, can be hosted on-premise or in a sovereign cloud, and is now ISO 27001-certified on its own infrastructure. A rare triad that lets companies keep control without giving up a high security standard.
- French compliance: our implementations build in, by design, the requirements of 2026 e-invoicing, GDPR and NIS2 when the client is concerned.
- Aligned project framework: our methods for migration, rights configuration and access management fit within the logic of Odoo's ISMS, which simplifies audits on the client side.
What now?
If you are already running Odoo in production, no action is required. The certification applies de facto to the environments concerned.
If you are evaluating Odoo against other ERPs, its security credentials are now aligned with the standards of the most expensive suites on the market, without the cost or the lock-in.
If you are facing a demanding tender or NIS2 compliance, it is time to put Odoo back on the shortlist.