ISO 9001:2026 is here, and it is evolution rather than revolution
- 01The sixth edition of the world’s most widely used quality management standard replaces ISO 9001:2015. The quality management model itself is intact.
- 02Six expectations that used to be implied are now explicit: quality culture, ethical behaviour, opportunities, management of change, organisational knowledge, and strategic alignment.
- 03Clause 6.1 separates risks from opportunities, so pursuing a beneficial outcome becomes a visible activity with its own selection, resourcing and evaluation.
- 04Clause 6.3 requires change control to close the loop. Implementing a change is no longer the end of it: communicate, monitor, evaluate, and review the result.
- 05Your ISO 9001:2015 certificate did not expire on 16 September 2026, but the accreditation framework and audit-duration arrangements are not yet published. Treat September 2029 as a planning assumption, not a deadline.
Evolution, not revolution
The quality management model is intact. What changes is how explicit the standard is about expectations that used to be implied. That distinction matters for planning, because it determines whether you are adapting a system or rebuilding one.
| Unchanged | Now explicit |
|---|---|
| Process approach | Quality culture |
| Plan-Do-Check-Act | Ethical behaviour |
| Risk-based thinking | Opportunities |
| Customer focus | Management of change |
| Clause architecture | Organisational knowledge |
| Continual improvement | Strategic alignment |
Change 01, quality culture and ethics enter the text
Clause 5.1.1 requires top management to promote quality culture and ethical behaviour. Clause 7.3 requires people across the organisation to be aware of that culture and of relevant ethical expectations.
No ethics committee, culture survey, code of conduct or culture programme. Culture is examined through leadership behaviour, decisions and communication.
Fairness, bias and transparency are not ISO 9001 requirements. They sit in an AI management system under ISO/IEC 42001, alongside your QMS rather than inside it. The life-cycle approach to AI governance paper sets out how the two connect.
Change 02, risks and opportunities part ways
Clause 6.1 now treats them separately, so pursuing beneficial outcomes becomes a visible activity of its own.
| Clause 6.1.2, risks | Clause 6.1.3, opportunities |
|---|---|
| Prevent what can go wrong. Identify it, act on it, check the action worked. | Act on what could go right. Select it, resource it, evaluate the result. |
An opportunity is no longer a positive line in the risk register.
Evidence can come from performance trends, customer feedback, new technology, capability and lessons learned.
Example. A rising trend of late deliveries is the risk. The supplier offering vendor-managed stock is the opportunity: selected, resourced, and evaluated against on-time delivery three months later.
Change 03, change control has to close the loop
Clause 6.3 extends the change cycle. Plan and implement were always there. Communicate, monitor, evaluate and review results are what 2026 adds.
| 2015 stopped at | 2026 stops at |
|---|---|
| "We implemented the change." | "We implemented it, communicated it, checked whether it worked and reviewed the result." |
Example. A revised work instruction is released, briefed to the line, monitored over the next two production runs, then reviewed for scrap and rework before the change is closed.
Change control in Qity carries the communication step, the monitoring period and the effectiveness review on the same record as the change itself, so closing the loop is the workflow rather than a separate follow-up nobody schedules.
Change 04, organisational knowledge has to travel
Knowledge now supports the intended results of the whole management system, not only conformity of products and services. Clause 7.1.6 expects it to be retained where it can be found again, applied in decisions and daily work, and shared with the people who need it.
No formal knowledge platform is required. But a system where critical know-how lives only in one person's head becomes much harder to defend.
Example. One engineer knows how the validated test rig is set up. Write it down, train a second person, and link it from the procedures that depend on it.
Change 05, climate change is incorporated, not introduced
In 2024 ISO amended ISO 9001:2015 so that organisations determine whether climate change is relevant to the context of the QMS, and recognise that interested parties may have climate-related requirements. In 2026 that amendment becomes part of the main text, inside the context and interested-party requirements.
Determine relevance and record the reasoning. ISO 9001 does not ask for an environmental programme, ESG reporting or sustainability governance.
Clauses 8, 9 and 10 stay familiar
| Clause | What changed |
|---|---|
| 8, Operation | Mainly terminology adjustments. Design, purchasing, production and nonconforming output controls carry over. |
| 9, Performance evaluation | Monitoring, internal audit and management review are intact, with more emphasis on using what they produce. |
| 10, Improvement | Same cycle of nonconformity, corrective action and continual improvement, with leadership more visibly involved. |
Annex A does the heavy lifting. Around 15 pages of new explanatory guidance on structure, terminology and intent. Annex B is removed. Annex A stays informative, so it adds no certification requirements.
What the revision did not introduce
AI, digitalisation and supply-chain pressure are why ISO revised the standard. They did not become clauses inside it.
- An AI governance clause
- A cybersecurity framework
- An ESG or sustainability programme
- A digital-transformation requirement
- A supply-chain resilience clause
- A wholesale redesign of your QMS
If AI is in your processes, ISO 9001 stays technology-neutral, so AI governance, fairness, bias and transparency sit in ISO/IEC 42001, a separate management system that runs alongside your QMS.
Quality moves closer to the business
Quality policy and objectives are tied more visibly to context and strategic direction. A mature 2026 system can answer this chain.
The transition is confirmed, the dates are not
| Status | Position |
|---|---|
| SETTLED | Your ISO 9001:2015 certificate did not expire on 16 September 2026. A transition period will apply. |
| STILL PENDING | The accreditation framework and audit-duration arrangements have not been finally published. |
| WORTH KNOWING | IAF ceased operations on 1 January 2026. Its role now sits with Global Accreditation Cooperation Incorporated (Global ACI). |
So treat "September 2029" as a planning assumption, not a published deadline, and confirm dates with your certification body.
Four phases, no rebuild
An effective ISO 9001:2015 system is the starting point, not the problem. Work through it in order.
| Phase | What to do |
|---|---|
| 01, Read | Buy the published standard and use Annex A. Never gap-assess against draft material. |
| 02, Compare | Gap-assess only the six changed areas: culture and ethics, opportunities, QMS change, knowledge, climate context, strategic alignment. |
| 03, Adapt | Extend change records to communication, effectiveness and review. Capture critical knowledge. Refresh awareness and audit plans. |
| 04, Confirm | Use management review as the transition checkpoint, then agree audit timing with your certification body. |
ISO 9001:2026 makes quality harder to separate from how the business is run.
Did ISO 9001:2015 certificates expire on 16 September 2026
No. A transition period will apply. The accreditation framework and audit-duration arrangements had not been finally published at the time of writing, so treat September 2029 as a planning assumption and confirm dates with your certification body.
Does ISO 9001:2026 add an AI governance clause
No. ISO 9001 stays technology-neutral. AI governance, fairness, bias and transparency sit in ISO/IEC 42001, a separate management system that runs alongside the QMS.
Does the revision require a quality culture programme
No. Clause 5.1.1 requires top management to promote quality culture and ethical behaviour, and clause 7.3 requires awareness of it. No ethics committee, culture survey, code of conduct or culture programme is required.
Do I need to rebuild my quality management system
No. The process approach, Plan-Do-Check-Act, risk-based thinking, customer focus, clause architecture and continual improvement all carry over. The gap assessment covers six changed areas.
Document control, change control, risk, training and design control, inside Jira and Confluence. If AI is in your processes, ISO/IEC 42001 runs alongside the same QMS.
Summary and interpretation only, current as at 17 September 2026, and not a substitute for the published standard. Transition arrangements are set by your accreditation and certification bodies.
