The invisible filters of vendor approval: ISO certifications, audits and seals that decide which law firms big companies hire
ISO 27001, 37301, 37001 or 42001: big companies increasingly demand certifications from their legal advisers during vendor approval.
Hiring a law firm is no longer just a matter of prestige and fees. The vendor-approval processes through which banks, insurers, large listed companies and multinationals select their legal advisers increasingly incorporate questionnaires, audits and certifications that act as invisible filters: those who fail them never reach the negotiating table. And accreditation is not free, the sector warns: firms bear the cost of submitting their internal procedures to external audits certifying quality and management standards.
A dozen standards in play
Internal sources at one firm consulted by El Confidencial identify up to a dozen standards and evaluation systems that may appear in large companies' supplier-selection procedures. They include ISO 27001 on information security, ISO 9001 on quality control, ISO 37301 on compliance management, ISO 37001 on anti-bribery management and ISO 42001, focused on the governance of artificial intelligence. Not all are always required, but the trend is clear: certifiable compliance increasingly outweighs declared reputation.
The phenomenon also has a measured economic side: according to an Iberian Lawyer report published this month from the responses of more than 70 general counsel in Spain and Portugal, 38.8% of companies use formal panels of external advisers and another 20.9% rely on informal lists, while 83.6% concentrate most of their legal work in a maximum of five firms. In public procurement, moreover, the law bars contracting with companies of 50 or more employees that fail to have a registered equality plan.
The latest example of the race for seals is Eversheds Sutherland: the firm led in Spain by Jacobo Martínez has just become the first law firm in the country to obtain Aenor certification in diversity and inclusion management. Behind these certifications lies a strictly commercial factor: being eligible in the procurement processes of major clients.
What each seal actually measures
Behind the acronyms lie concrete operational demands. ISO 27001 requires an audited information-security management system: access control, encryption, incident management and business continuity, especially sensitive for firms handling confidential documentation on major transactions, litigation strategies and their clients' personal data. ISO 37301 certifies the compliance management system; 37001, the whistleblowing channel and anti-bribery controls; 9001, quality processes; and the newly arrived ISO 42001 brings the governance of AI systems into the firm, an issue increasingly present in listed companies' risk questionnaires.
To these standards are added the clients' own audits: cybersecurity questionnaires, verification of professional indemnity insurance, diversity policies, ESG criteria and periodic continuity reviews. The result is a demanding approval process that turns the first engagement into a sunk investment if the firm fails the filter.
An asymmetric barrier to entry
The cost of the race for seals is not evenly distributed. Large firms already operate with certified systems at the demand of their international clients; for mid-sized firms, each certification means a relevant line in the annual budget in consulting, implementation and audits, with no guaranteed return if the client finally awards the mandate to another firm. Vendor approval has thus become a silent barrier to entry that redraws competition: no longer between the prestige of one set of lawyers and another, but between certifiable management systems. The trend links to the wider transformation of the sector: the reorganisation of large firms with consultants' help, the entry of financial capital into law firms and the professionalisation of management.
For clients, the system has an obvious advantage: comparable, auditable criteria that reduce dependence on personal relationships in supplier selection. For firms, the strategic question is which seals to prioritise: the portfolio that a bank demands does not necessarily match that of an insurer or a technology company, and prioritising becomes a business-development decision in itself: certify what the clients you want to win demand, not everything that is certifiable.
Source: El Confidencial (27 October 2026), verified 3 November 2026.
Related links
Fuentes
- elconfidencial.com. Accessed 3 November 2026.
The specific data in this article come from the official sources cited.
