Quality culture, ethical behaviour, the approach to risks and opportunities, and change management are among the key features of ISO 9001:2026. Organisations need to understand the new requirements, apply them appropriately to their management practices and demonstrate effective implementation through actual results.
ISO 9001:2026 was officially published on 16 September 2026. This article analyses the key changes, explains their implications for quality management systems, provides guidance on implementation and outlines transition planning based on information from ISO and Global ACI. [1][2]
Build on the foundations and improve operational effectiveness
ISO 9001:2026 continues to use the harmonised structure for management system standards, retaining the process approach and the Plan–Do–Check–Act (PDCA) cycle. Its core purpose remains to help organisations consistently provide products and services that meet applicable requirements and enhance customer satisfaction.
Organisations with an effective ISO 9001:2015 system can build on what they already have. The transition should focus on identifying added or clarified requirements, assessing their impact on each process and adapting working practices accordingly. Updates to documents, forms and checklists should reflect substantive changes in management and operations.
Key changes include leadership responsibility for promoting quality culture and ethical behaviour; a clearer distinction between how risks and opportunities are considered and addressed; and stronger requirements for planning changes. Annex A has been expanded to clarify terminology and the intent of the requirements. Clause 3 includes core terms and definitions, with ISO 9000:2026 serving as a normative reference. [1]
How effectively does the quality management system help the organisation control quality, prevent recurring errors and implement changes? The answer should be supported by practical evidence of management decisions, the way work is organised and the performance of processes.
Quality culture and ethical behaviour: from commitment to practice
Clause 5.1.1 adds a responsibility for top management to promote quality culture and ethical behaviour. At the same time, Clause 7.3 requires people working under the organisation’s control to be aware of these matters. Together, these requirements connect leadership direction and example with the awareness of those carrying out the work.[1]
Quality culture is revealed under pressure
Quality culture can be seen in how an organisation handles a nonconforming batch, a data discrepancy or the risk of a late delivery. When employees are encouraged to report problems and management responds fairly and consistently, errors are more likely to be identified and corrected promptly. Unfair blame, on the other hand, can lead to problems being concealed.
Within a quality management system, ethical behaviour is reflected in recording inspection results honestly, providing accurate information to customers, correctly confirming whether products and services meet requirements, and honouring commitments. These are examples of how the concept can be applied in context; the standard does not prescribe a single cultural model or ethical framework for every organisation.
Illustrative scenario: A batch is urgently needed for delivery, but a mandatory test has not yet been completed. How management allocates resources to complete testing, controls release and communicates with the customer will demonstrate the priority given to quality. Test results, release authorisation records and communications can provide evidence of how the situation was handled.
Where should organisations begin?
- Clarify expected behaviours: report honestly, respect approval authority and raise discrepancies promptly.
- Make communication relevant to the work: use practical scenarios and check how well people understand what is expected.
- Review management practices: ensure that objectives, rewards and responses to errors encourage quality and do not create incentives to conceal problems.
- Verify implementation in practice: use discussions, observation and internal audits to examine how leaders promote these values and how well employees understand them.
These are practical suggestions, not a mandatory list of measures or records. Auditors should base their findings on the requirements of the standard, the organisation’s context and objective evidence, avoiding the imposition of personal ethical views or requirements beyond the established audit criteria.
A clearer distinction between addressing risks and pursuing opportunities
Clause 6.1 is organised into three parts: 6.1.1 Identifying risks and opportunities; 6.1.2 Actions to address risks; 6.1.3 Actions to address opportunities. This structure clarifies how each group is considered and how actions are selected, while highlighting the role of opportunities in achieving the intended results of the quality management system. [1]
For risks, organisations need to identify, analyse and evaluate risks that could affect the intended results of the system, then select actions proportionate to their potential impact. Issues such as supply disruptions, shortages of key personnel or loss of operational knowledge should be considered where relevant. The analysis should provide a sufficient basis for setting priorities and selecting appropriate measures.
For opportunities, organisations need to identify, analyse and evaluate the potential for better results, select appropriate actions, integrate them into processes and evaluate their effectiveness. Opportunities may arise from adopting technology, using customer feedback or improving collaboration between departments.
| Context | Risks to address | Opportunities to pursue |
|---|---|---|
| Implementing an order management system | Data errors or disruption during the changeover. Possible actions include checking data, running trials and preparing an incident response plan. | Less duplicate data entry and faster responses to customers. Set objectives and monitor the improvements achieved. |
| Unreliable supplier deliveries | Input shortages affecting production and delivery schedules. Assess the potential impact and prepare alternative supply arrangements. | Improve supply chain reliability by sharing demand forecasts, improving ordering practices and working more closely with suppliers. |
Organisations can use a single management tool, provided it clearly distinguishes how risks and opportunities are analysed, how actions are selected and how results are monitored. Separate subclauses do not imply a requirement for two independent registers or a fixed scoring matrix.
How were risks and opportunities analysed? Why were those actions selected? Who is responsible, which processes incorporate the actions, and do the results meet the objectives set?
Control changes from planning through to evaluation
Clause 6.3 strengthens the requirements to consider necessary resources and information, communication of changes, how effectiveness will be monitored and evaluated, and review of the results. These matters need to be considered when an organisation changes its quality management system, for example through restructuring, relocation, process digitalisation or changes to responsibilities across departments. [1]
The effectiveness of a change needs to be verified during implementation and operation. Organisations should establish whether information has reached the right people, resources are adequate, controls continue to work effectively and the results meet the original objectives.
- What objectives is the change intended to achieve, and what consequences could it have?
- How will the change affect processes and the integrity of the quality management system?
- What resources and information are needed, and how will responsibilities and authorities be allocated?
- Who needs to be informed, instructed or trained, and when?
- How and when will the effectiveness of the change be monitored and evaluated?
- Who will review the results and decide on any necessary adjustments?
Practical example: When replacing warehouse management software, an organisation can define criteria in advance for inventory data accuracy, processing time and traceability. Once the software is in use, actual results can be compared with those criteria to establish how far the objectives have been achieved and where adjustments are needed.
Clause 6.3 does not prescribe a separate form or type of record for planning changes. Organisations can use existing management tools and choose a level of documentation appropriate to the scale, complexity and risks of the change, while meeting relevant requirements for documented information.
Points that can be overlooked when updating the system
Context and interested parties
The climate change provisions introduced by the 2024 amendment are retained and integrated into the new edition. Organisations need to determine whether climate change is a relevant issue for their quality management system. For example, extreme weather may affect storage conditions, transport or continuity of service delivery. The outcome should be reflected in planning where relevant.
Clause 4.2 clarifies the determination of relevant interested-party requirements to be addressed through the quality management system. Organisations need to link these requirements to appropriate processes, responsibilities and actions, while ensuring that applicable requirements relating to products, services and customers are met.[1]
Knowledge needs to be retained, applied and shared
Clause 7.1.6 broadens consideration of the knowledge needed to operate processes and achieve the intended results of the quality management system, while emphasising its retention, application and sharing to the extent necessary. Knowledge needs to reach the right people and be used effectively in their work.
Lessons from complaints, experience in resolving incidents, customer knowledge and ways of coordinating work across departments can all be knowledge that needs to be managed. Organisations should pay particular attention to work that relies heavily on individual experience, especially where staff departures or transfers could disrupt operations or reduce problem-solving capability.
Documented information still needs to be controlled
Many clauses now use wording that requires documented information to be “available” or “available as evidence”. This change does not remove the document and record controls required by Clause 7.5. Organisations still need to ensure that information is suitable for its intended use, accessible when needed and adequately protected, while controlling updates, retention and disposal in line with applicable requirements.
| Clause | Key point | Review guidance |
|---|---|---|
| 8.2.1 Customer communication |
Provide information about response actions and disruptions affecting the provision of products and services, where relevant. | Define the contact person, timing and content of notifications, and how customers will receive updates. |
| 8.2.3.2 Review of requirements |
Documented information available as evidence covers both new and changed requirements. | Check whether changes, review results and communication to the departments carrying out the work can be traced. |
| 8.3.2, 8.3.5, 8.3.6 Design and development |
Consider the involvement of relevant interested parties; clarify the information needed for safe and intended use of products and services; and determine the impact of design changes. | Review planning, design outputs and the basis for evaluating the impact of changes, within the applicable scope. |
| 8.4.3 Information for external providers |
Communicate requirements for interaction with customers and relevant interested parties to external providers, where applicable. | Clarify the scope of information, responsibilities and coordination arrangements when an external provider communicates with customers or interested parties. |
This table provides a guide for review; organisations need to consult all applicable clauses and select approaches suited to their actual activities.[1]
Link internal audits and management review to improvement decisions
Define objectives for each audit
Clause 9.2.2 adds a requirement to define objectives for each audit, alongside the audit scope and criteria. Objectives clarify what the audit needs to establish, guiding sampling, evidence collection and conclusions.[1]
Example: When auditing order processing after a software change, the objective might be to confirm that customer requirements are communicated fully to production and that changes are controlled. The scope could cover relevant activities in sales, planning, production and the warehouse; the criteria would include applicable requirements of the standard and internal rules.
Additional inputs for management review
Clause 9.3.2 adds an input on changes in the needs and expectations of interested parties relevant to the quality management system. The review of the effectiveness of actions addressing risks and opportunities is also more clearly differentiated. This information should support leadership decisions on improvement, changes to the system and resource needs.
For each issue, organisations can clarify what the data shows, what decision is needed, who is responsible and when the results will be reviewed. This approach helps track progress and accountability, reducing the likelihood of the same issue recurring across meetings without being resolved.
Monitor customer satisfaction and use data to improve
The wording in Clause 9.1.2 places direct emphasis on monitoring customer satisfaction. Organisations should review whether their existing methods adequately reflect customer perceptions and experiences. Feedback on product and service quality, delivery times, communication and complaint handling can provide complementary perspectives for evaluation.
Clause 10 has been reorganised, with continual improvement covered in Clause 10.1; nonconformity and corrective action remain in Clause 10.2. Organisations should review references in documents and checklists where relevant, and use the results of monitoring, measurement, analysis, evaluation and management review to identify opportunities for improvement.
Annex A has been expanded to explain the structure, terminology and intent of the clauses. It is informative and does not add to, amend or remove requirements of the standard. When reporting a nonconformity, auditors should clearly identify the unmet requirement and the objective evidence; examples or explanations in the annex should not be turned into separate mandatory requirements.
Annex B of the 2015 edition has been removed, and the relevant references have been reorganised. Organisations should review terminology, clause numbers, cross-reference tables and training materials to ensure consistency with the new edition.[1]
Plan according to how well the system meets the requirements
Transition should begin by identifying which requirements the existing system already meets and what needs to be added or adjusted. Organisations can follow the five steps below, adapting the scope and timing of the work to the size, complexity and maturity of their quality management system.
- Establish a shared understanding
Study the official standard and update the knowledge of leaders, process owners and internal auditors. Clearly distinguish the requirements of the standard from explanations and practical guidance.
- Assess gaps by process
Compare current practices and available evidence with the applicable requirements. For each gap, determine its impact, priority, responsible person and completion deadline.
- Make targeted adjustments
Update the management of risks, opportunities and changes; promote quality culture and ethical behaviour; and strengthen awareness. Revise documents where needed while retaining tools that already work effectively.
- Implement and verify
Put the adjustments into practice, collect evidence, conduct internal audits and carry out management review. Address gaps and check the effectiveness of the actions taken.
- Agree on the transition audit plan
Discuss conditions, audit timing and required documentation with the certification body early. Allow sufficient time for the audit, resolution of any nonconformities, review and certification to the new edition.
| Date | Implications for accredited certification |
|---|---|
| 31/3/2028 | From this date, initial accredited certification may only be issued to ISO 9001:2026. |
| 30/9/2029 | Deadline for completing the transition from ISO 9001:2015 to ISO 9001:2026 certification. Organisations must be certified to the new edition on or before this date. |
Source: Global ACI announcement dated 16 September 2026. The transition requirements apply to accreditation bodies participating in the Global ACI Multilateral Recognition Arrangement (MRA) and the accredited certification bodies within the relevant scope.[2]
A transition audit may be combined with a surveillance or recertification audit, or conducted separately. Organisations need to confirm with their certification body when transition audits and accredited certification to ISO 9001:2026 will be available, in line with that body’s accreditation transition timetable.
- Related article: Global ACI Sets ISO 9001:2026 Transition Requirements: Key Dates for Organisations.
- E-learning course: An Overview of ISO 9001:2026 Quality Management Systems.
Common questions clarified
Does the entire documentation system need to be rebuilt?
No. Organisations need to assess how well their system meets the requirements and update the areas affected by the changes. Procedures, tools and records that remain suitable can continue to be used.
Is a separate code of ethics mandatory?
A separate code is not mandatory. Organisations need to clarify expected behaviours, ensure that leaders promote quality culture and ethical behaviour, and raise awareness among those carrying out the work. A code of ethics is one possible approach, depending on the context.
Does considering climate change mean a greenhouse gas inventory is required?
No. The requirement to consider climate change in a quality management system does not in itself create an obligation to prepare a greenhouse gas inventory. Organisations need to determine its relevance to the system and the applicable requirements. Any inventory obligation needs to be established from legislation or other relevant requirements and commitments.
Does Annex A add mandatory requirements?
No. Annex A clarifies terminology and the intent of the requirements. Audits need to be based on applicable requirements, objective evidence and the organisation’s context; examples or explanations in the annex should not be treated as separate mandatory requirements.
The value of transition is demonstrated through improvements in management and operations: leaders have reliable information for decision-making, processes are effectively controlled, and customers receive products and services of consistent quality.
Transitioning to ISO 9001:2026 is an opportunity to address persistent issues such as recurring errors, opportunities left unexplored, changes whose effectiveness has not been evaluated, or knowledge concentrated in a few individuals. The transition plan should link fulfilment of the new edition’s requirements with practical improvements to the organisation’s activities.
References
- International Organization for Standardization (2026), ISO 9001:2026 – Quality management systems – Requirements, Edition 6, Published 16 September 2026; and the announcement of the new edition.
- Global ACI (2026), Global ACI Publishes Transition Requirements for ISO 9001:2026, dated 16 September 2026; introducing document Global ACI-TECH-3-TR 2029-09-30 (M).
