ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 15189:2022 changes stopped being a transition topic on 6 December 2025, when the 2012 edition ceased to be valid and every accredited medical laboratory was expected to have been reassessed against the fourth edition. They did not stop being an assessment topic.
UKAS’s own gap analysis for the transition — the template every UK laboratory had to complete — marks fifteen clauses as major changes from ISO 15189:2012, four as new, and the rest as minor, and those fifteen are where assessors now spend their surveillance days: risk management, nonconforming work, corrective action, internal audit, method verification and validation, internal and external quality assessment, personnel authorisation, reagent acceptance testing and the request process. This guide sets out the ISO 15189:2022 changes as UKAS graded them, the three headline changes ISO itself names, what a laboratory that transitioned in a hurry should now revisit, and what happens to a laboratory that never completed the transition.
ISO’s foreword to the fourth edition names three: alignment with ISO/IEC 17025:2017, which moved the management system requirements to the end of the document; incorporation of the point-of-care testing requirements previously in ISO 22870, which the new edition replaces; and increased emphasis on risk management. The introduction adds that risk management is aligned with the principles of ISO 22367, laboratory safety with ISO 15190, and sample collection and transport with ISO 20658. The clause structure that resulted — 4 general, 5 structural and governance, 6 resource, 7 process, 8 management system — is the one our guide to ISO 15189 vs ISO 17025 sets against the testing-laboratory standard.
| ISO 15189:2022 clause | 2012 clause | What changed (our reading of the two editions) | What assessors now look for |
|---|---|---|---|
| 5.6 Risk management | 4.14.6 | Risk moved from an evaluation activity to a governance requirement; 5.6(b) is new | A risk process owned at director level, aligned to ISO 22367, with patient-harm risks identified and treated |
| 7.1 Process requirements: general | — | Risk-based thinking now frames every process clause | Risks to patients identified per process, not only in a central register |
| 8.5 Actions to address risks and opportunities | 4.11 Preventive action | Preventive action replaced by risk-based planning | Evidence that risks and opportunities feed planned actions, with effectiveness evaluated |
| 7.5 Nonconforming work | 4.9 | Restructured; explicit steps for evaluation, release decisions and recall of results | Records showing the decision on each nonconformity and its clinical consequence |
| 8.7 Nonconformities and corrective actions | 4.10 | Root cause, evaluation of need for action, and effectiveness review made explicit | A corrective action record that closes with an effectiveness check, not a fix |
| 8.6 Improvement | 4.12 | Continual improvement plus 8.6.2 patient, user and personnel feedback | Feedback sought, analysed and acted on, with records |
| 8.8.3 Internal audits | 4.14.5 | Audit programme must consider risks, including risks to patients, previous audits and nonconformities | A risk-based audit schedule and checklists keyed to the 2022 clauses |
| 6.2.3 Personnel: authorisation | — | Explicit authorisation for specified activities — method selection, result review and release, system access | An authorisation register per person per activity |
| 6.6.3 Reagents and consumables: acceptance testing | 5.3.2.3 | Verification of performance before use, including lot changes | Lot verification records for reagents that affect results |
| 7.2.3 Requests for providing laboratory services | 5.4.3 | Request content and the laboratory’s handling of oral and inadequate requests expanded | A request policy covering information required, urgent requests and additions |
| 7.3.1 Examination processes: general | 5.5.1.1 | Methods must be verified or validated before use and fit for intended use; risk-based | A method register showing validation or verification status for every examination on the schedule |
| 7.3.2 Verification of examination methods | 5.5.1.2 | Verification required for every method before introduction, with a defined protocol | Verification records with acceptance criteria and authorisation |
| 7.3.3 Validation of examination methods | 5.5.1.3 | Validation for non-standard, modified or laboratory-developed methods, with performance characteristics | Validation plans, data and sign-off; change control on validated methods |
| 7.3.7.2 Internal quality control | 5.6.2 | IQC design expanded: materials, frequency, acceptance, action on failure, and review of results released since the last acceptable QC | IQC rules per examination and records of action on QC failure |
| 7.3.7.3 External quality assessment | 5.6.3 | Participation, review of results, action on unsatisfactory performance and coverage of the schedule made explicit | EQA registered for each examination and evidence of action on poor scores |
UKAS’s template grades the extent of change but does not describe it — the middle column is our reading of the two editions side by side. Read the list as a pattern: nine of the fifteen sit in clause 7 and 8 process and management requirements, and every one of them asks for a record of a decision rather than a procedure. That is what changed in the assessment room. Our guide to ISO 15189 covers where medical laboratories lose findings under the new edition.
| Clause | Requirement | What a compliant laboratory has |
|---|---|---|
| 4.3 Requirements regarding patients | Information, consent, access, dignity and the right to complain — the laboratory’s duties to the patient, not the requester | A patient-facing policy, consent levels per examination category, a complaints route that does not affect care |
| 5.6(b) Risk management | Risk to patients and to the laboratory identified, treated and monitored as a governance activity | A director-owned risk process aligned to ISO 22367 |
| 8.1.3 Management system awareness | Personnel aware of the management system and their role in it | Induction and refresher records; awareness tested at audit |
| 8.2.2 Management system documentation: competence and quality | Documented commitment to competence and quality across the management system | A policy statement the director owns and personnel can find |
UKAS’s transition update of January 2024 recorded the failure pattern for the ISO 15189:2022 changes: gap analyses full of statements like “SOP xxx will be updated” with no evidence of implementation, and its warning that “UKAS cannot grant accreditation on intent”. Laboratories that transitioned on the strength of a rewritten quality manual now face surveillance visits that sample the fifteen major clauses for records. Five are worth revisiting.
ISO 15189:2012 ceased to be valid on 6 December 2025, three years after publication of the 2022 edition on 6 December 2022. UKAS assessed all applications received after 1 July 2023 against the new edition, ran every scheduled assessment from 1 January 2024 as a transition assessment, and completed the programme — 560 laboratories, 850 assessment days — before the deadline.
A laboratory that had not transitioned by that date had its 2012 accreditation suspended for a maximum of six months, and withdrawal follows if the transition is not completed within that window, after which the laboratory reapplies as a new applicant. UKAS describes the three-year period as agreed from the date of publication rather than as its own rule, and national bodies elsewhere ran the same window. The ISO 15189 accreditation cost of a reapplication is a full initial assessment, which is the practical penalty.
What are the main ISO 15189:2022 changes?
ISO names three: alignment with the ISO/IEC 17025:2017 format, incorporation of point-of-care testing from the withdrawn ISO 22870, and increased emphasis on risk management. UKAS’s gap analysis grades fifteen clauses as major changes — risk management, nonconforming work, corrective action, improvement, internal audit, personnel authorisation, reagent acceptance testing, requests, method verification and validation, IQC and EQA — and four as new.
When did the transition end?
6 December 2025, three years after publication on 6 December 2022. ISO 15189:2012 ceased to be valid on that date across the ILAC arrangement.
What happens to a laboratory that did not transition?
Under UKAS’s process, accreditation to the 2012 edition is suspended for up to six months; if the transition is still not complete, it is withdrawn and the laboratory must reapply as a new applicant.
Is ISO 22870 still needed for POCT?
No. ISO 22870:2016 was withdrawn when ISO 15189:2022 was published; POCT requirements are inside the 2022 edition.
Which clause is quality indicators?
8.8.2, within 8.8 Evaluations, alongside 8.8.3 internal audits; the 2012 requirement at 4.14.7 also maps to 5.5 objectives and policies.
Treat the ISO 15189:2022 changes as the surveillance agenda, not a closed project: revisit the fifteen major clauses for records rather than procedures, build the authorisation register and the method status register, put risk at process level under the director, run a risk-based audit programme, and keep POCT inside scope. The deadline decided who is accredited; the major clauses decide what the next visit finds.
The Risk Management Procedure, the Competence Assessment and Authorisation Procedure, the Method Verification and Validation Procedure, the Internal Quality Control Procedure and the ISO 15189 Internal Audit Checklist are in the ISO 15189 Toolkit, or start with the free templates.
September 20, 2026
September 19, 2026
September 19, 2026
September 19, 2026
September 19, 2026