ISO 9001:2026: what changed?
Standards briefing · 1 October 2026
Quality management
ISO 9001 has its first new edition since 2015. The structure stays. Some requirements are new.
Jonathan Phillips, Lead Auditor. 1 October 2026.
ISO 9001 is the rulebook a company follows to run a quality management system. That system is how it makes sure it does what customers need, every time, and keeps getting better at it.
The 2026 version was published on 16 September 2026. It keeps the same 10 sections, and most clauses keep their number. Most of the day-to-day work of making the product or delivering the service, in section 8, keeps the same requirements. But some requirements are new, and every certified company will need to act on them. Most ask management to do more and show more, especially on risk and on company culture.
In short: separate your risks from your opportunities, show that leaders build a quality culture, and manage change properly. Every change below has been checked against the published standard.
At a glance
Main changes from ISO 9001:2015 to ISO 9001:2026:
Risks and opportunities handled separately 6.1
Leaders promote quality culture and ethical behaviour 5.1
Staff awareness covers culture and ethics 7.3
Changes managed more fully 6.3
Management review agenda rebuilt 9.3
Knowledge retained, applied and shared 7.1.6
Customers told about contingency plans 8.2.1
Every internal audit has defined objectives 9.2.2
Quality policy reworded 5.2
Climate change moved into the main text 4.1, 4.2
Final section reorganised 10
Key terms defined in ISO 9001 itself 3
Annex A revised as clarification Annex A
Risks and opportunities are handled separately Section 6.1
This is the biggest change. In 2015, risks and opportunities sat together in one requirement, and many companies kept one combined list. They are still identified together, in 6.1.1. But the actions are now separate: 6.1.2 for risks and 6.1.3 for opportunities. Each one has to be analysed and evaluated, not just listed. For example: how likely is it, how much does it matter, and what will we do about it? Checking whether the action worked was already required, and still is.
Risk: "Our only supplier of a key part might stop trading." Likely? Medium. Impact? High, because production would stop. Action: approve a second supplier. Check later: has the second supplier delivered on time?
Opportunity: "A large customer has asked for next-day delivery." Worth it? Possibly, as it could grow orders. Action: run a three-month trial. Check later: did orders grow, and did quality hold?
Leaders promote quality culture and ethics Section 5.1
A policy on the wall is not enough. Top management has to show by what they do that quality and doing the right thing matter. They must also promote thinking about opportunities, not just risks. An auditor will look for evidence of what leaders actually do. The standard also links culture and ethics to the working environment, in a note to 7.1.4.
The managing director starts each monthly team meeting with one quality problem and what was learned from it. Staff who report their own mistakes are thanked, not blamed. A manager holds back a late order rather than ship parts that failed inspection.
Staff awareness covers culture and ethics Section 7.3
Staff need to understand the quality culture and ethical behaviour expected of them. In practice, this goes into induction and refresher training.
A new starter's induction includes a short session on what good work looks like here, how to raise a concern, and why a test result is never signed off unless the test was done.
Changes must be managed more fully Section 6.3
Planning changes was already required in 2015. The 2026 version adds more: communicate the change, monitor and evaluate how well it works, and review the results afterwards.
A company moves to a new order-processing system. It plans the switch, tells staff and customers in advance, tracks order errors in the first month, and reviews the result after three months.
The management review agenda is rebuilt Section 9.3
Management review has a new input: changes in what customers and other interested parties need and expect. Risks and opportunities are now reported as separate items. Every input must be covered at the review.
A quarterly review agenda gains two lines: what customers, suppliers and regulators now expect of us, and a report on opportunities alongside the report on risks.
Knowledge is retained, applied and shared Section 7.1.6
In 2015, the company had to keep the knowledge it needs and make it available. Now that knowledge must be retained, applied and shared, so the quality system gets the results it intends.
After a difficult product launch, the team writes up three lessons learned and adds them to the design checklist used on the next project.
Customers are told about contingency plans Section 8.2.1
In 2015, the company had to set requirements for contingency actions. Now it has to give customers information about them, including disruption to the products or services it provides.
A supplier tells its customers in advance how it will let them know if a delivery is going to be late, and who they can call.
Every internal audit has defined objectives Section 9.2.2
In 2015, each audit needed defined criteria and scope. Now it also needs defined objectives: what the audit is for.
An audit plan reads: Objective: check the new risk and opportunity process works. Criteria: ISO 9001:2026 clause 6.1 and the company's risk procedure. Scope: sales and purchasing.
The quality policy is reworded Section 5.2
The requirement is the same. The link between the quality policy and the company's context and strategic direction is now a separate item, so it stands out more.
Climate change is now part of the main text Sections 4.1 and 4.2
A 2024 amendment already added this. It has been moved into the main standard. The company still only has to decide whether climate change is a relevant issue for its business. Most auditors will expect to see that decision written down.
A line in the company's context review: "Climate change: relevant. Our site is in a flood-risk area. Added to the risk list." Or: "Not relevant to our office-based service, reviewed annually."
The final section has been reorganised Section 10
Section 10 now follows the same layout as other ISO management system standards. Clause 10.1 is now called Continual improvement and takes in the old 10.3. There is no 10.3 any more, so documents that refer to it will need updating.
A procedure says "see ISO 9001 clause 10.3". It is updated to 10.1.
Key terms are defined in ISO 9001 itself Section 3
Before, you had to look them up in a separate standard, ISO 9000. Now ISO 9001 defines 23 terms itself: 20 shared with other ISO management system standards, and three for quality. ISO 9000 is still the full vocabulary for anything else.
The appendix is rewritten Annex A
The appendix now explains, clause by clause, what each requirement is for. It is clarification only; implementation guidance is in ISO 9002. Nobody can be audited against it.
Other changes
A few smaller changes are worth knowing about:
The company decides which requirements of its interested parties the system will address (4.2).
The system must be kept intact at all times, including during changes (5.3).
Supplier control covers any externally provided process, not only ones the company chose to outsource (8.4).
Complaints move from the corrective action requirement to a note (10.2).
Annex B, the list of other quality standards, is removed.
Documents versus evidence
This is where most of the online advice goes wrong. Several sites say you now need an ethics policy, a separate opportunity register and a change management procedure. The standard says none of that.
What an auditor needs is evidence. Evidence is anything that shows the requirement is met. A conversation with your managing director is evidence. A management review minute is evidence. So is an email to customers about a late delivery.
A register or a policy is one way to hold evidence. It is often the easiest way, and I am not against it. But it is a choice, not a requirement, and a document nobody uses is worse than no document at all. An auditor will see through it in five minutes.
So the question for each change is not "which template do I need?" It is "what would I show someone who asked?"
What an auditor will ask
For culture and ethics, the questions go to top management first. How do you promote a quality culture here? Give me an example where quality or doing the right thing won over cost or deadline. Then the same ground is covered with staff. What would you do if you were asked to pass something you thought was wrong? Who would you tell? The auditor is checking whether the two answers match.
For risks and opportunities: pick one. What did you do about it? How do you know it worked? Show me an opportunity that is not simply the flip side of a risk.
For planning of changes: take me through your last change to the quality system. Who was told? How did you check it worked?
None of these can be answered with a template.
What has not changed
No separate new requirements for AI, digital tools, cybersecurity or sustainability. The standard stays technology-neutral.
Still no requirement for a quality manual, written procedures or a named "management representative".
Most clauses keep their number and their meaning.
The road to 2029
Transition timetable set by Global ACI (Global Accreditation Cooperation Incorporated). Every deadline is counted from 30 September 2026, the end of the publication month:
16 Sep 2026 ISO 9001:2026 published. Transition rules take effect.
31 Mar 2027 Accreditation bodies ready to assess against the 2026 version.
30 Sep 2027 Accreditation decisions on certification bodies complete.
31 Mar 2028 New and initial certifications may only be issued to the 2026 version.
30 Sep 2029 Deadline to complete the move. ISO 9001:2015 certificates stop being valid after this date.
Companies certified to 2015 have three years to move across. The move can happen at a routine surveillance audit, at a recertification audit, or at a separate transition audit. Your certification body must itself be accredited for the 2026 edition first, so ask yours when that will be.
Until your certificate is reissued, you are certified to ISO 9001:2015. Do not change your website, tender documents or email footers before then.
What to do now
Get a licensed copy of ISO 9001:2026. You cannot assess against a standard you do not hold.
Run a gap check against the changes above. It takes an afternoon.
Plan the transition as a change under 6.3.
Brief top management. The culture and ethics questions will go to them, not to the quality manager.
Update your internal audit criteria and audit the changed clauses at least once before your transition audit.
Hold a management review with the new inputs.
If you would like help, please contact us. We can:
run the gap check with you
plan your transition
brief your top management
audit the changed clauses before your transition audit
update your documents.
We also have ready-made templates for the transition. We can tailor them to your own system as an extra service. ■
A free clause cross-map
I have put together a map of every clause, 2015 against 2026: what changed, and what an auditor will look for. It is free: download the clause cross-map (PDF). For help with your transition, use the form below.
Sources
ISO 9001:2015 and ISO 9001:2026, published text. ISO, ISO 9001:2026 catalogue page (iso.org/standard/88464.html). Global ACI, Transition requirements for ISO 9001:2026 (Global ACI-TECH-3-TR 2029-09-30 (M), version 1.0, 4 September 2026).
Jonathan Phillips is Managing Director of B.S. Partnership Ltd, Cardiff, and has audited against ISO 9001 for 29 years. This page describes the standard in his own words and does not reproduce its text. You need your own licensed copy of ISO 9001:2026 to apply it. Updated 3 November 2026 after a clause-by-clause check against the published standard.