ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 9001:2026 is published. ISO issued the sixth edition of the quality management standard in September 2026, and it cancels and replaces ISO 9001:2015 — including the 2024 climate-change amendment, which it absorbs. This guide, updated from the published text on 17 September 2026, sets out what actually changed, the clause-by-clause map from the old numbering to the new, what the transition means for a certified organisation, and what to do first.
Free gap assessment
Are you ready for the 2026 edition of ISO 9001?
Score yourself against the new edition, free, including the risk and opportunity split and the clause 10 renumbering that breaks converted checklists.
On iso.org the sixth edition shows as published, edition 6, dated 2026-09, at stage 60.60. ISO 9001:2015 and its Amendment 1:2024 are marked withdrawn. The Foreword states plainly that the sixth edition cancels and replaces the fifth, which has been technically revised, and lists six main changes. Everything below is taken from that published text, not from draft commentary.
The clause skeleton is the same. Clauses 4 to 10 — context, leadership, planning, support, operation, performance evaluation, improvement — are all still there, and most sub-clauses keep their numbers. The revision is evolutionary. But a 2015 pack with the year changed on the cover is not a 2026 pack, for the reasons that follow.
| Change (from the Foreword) | What it means in practice |
|---|---|
| Core management-system terms in clause 3 | Twenty terms are now defined in the standard itself — organization, interested party, top management, management system, policy, objective, risk, process, competence, documented information, performance, continual improvement, effectiveness, requirement, conformity, nonconformity, corrective action, audit, measurement and monitoring. ISO 9000 remains the reference for the rest of the quality vocabulary. |
| Quality culture and ethical behaviour | Now inside the requirements: top management must promote them (5.1.1), they are recognised as influencing the environment for the operation of processes (7.1.4), and people must be aware of them (7.3). This is the change a 2015 system has no document for. |
| Risks and opportunities separated | Clause 6.1 becomes three sub-clauses: 6.1.1 determining risks and opportunities, 6.1.2 actions to address risks, 6.1.3 actions to address opportunities. Each has its own determine–analyse–evaluate–act cycle; risk actions must be proportionate to potential impact, opportunity actions appropriate to context. Their effectiveness is then evaluated separately in 9.1.3 and reviewed separately in 9.3.2. |
| Strengthened management of change | Clause 6.3 lists seven considerations instead of four: purpose and consequences, QMS integrity, resources and information, responsibilities and authorities, plus — new — communication of the change, how its effectiveness will be monitored and evaluated, and how the results will be reviewed. |
| Enhanced Annex A | Annex A now clarifies structure, terminology and the intent of each clause. It is informative and adds no requirements — but it is the place to look when a clause is ambiguous. |
| Annex B removed | The list of other ISO/TC 176 standards is gone from the body; references live in Annex A notes and the bibliography. |
Two further points every transitioning organisation needs. Climate change is now in the main text: clause 4.1 requires you to determine whether it is a relevant issue, and a note at 4.2 observes that interested parties can have climate-related requirements. If you applied the 2024 amendment you already have this; if not, you need a recorded determination. And the documented-information wording changed throughout: “maintain documented information” became “shall be available as documented information”, and “retain” became “shall be available as evidence of”. The obligations are unchanged; the phrasing in your procedures should follow the new form.
Counted one requirement per numbered sub-clause, ISO 9001:2026 has 65 requirements in clauses 4 to 10. Forty-six are unchanged in substance, sixteen are revised or expanded, two are new as separate requirements (6.1.2 and 6.1.3) and one is renumbered. The table lists everything that is not simply unchanged.
| 2026 clause | 2015 clause | What changed |
|---|---|---|
| 4.1 Context | 4.1 | Climate-change determination in the main text; notes describe external and internal context factors |
| 4.2 Interested parties | 4.2 | Note: interested parties can have climate-related requirements |
| 5.1.1 Leadership and commitment | 5.1.1 | Twelve commitments, was ten: promoting quality culture and ethical behaviour; risk-based and opportunity-based thinking named together; the process approach as its own item |
| 5.2.1 Quality policy | 5.2.1 | Taking account of context and supporting strategic direction is a separate criterion |
| 5.3 Roles, responsibilities and authorities | 5.3 | Title shortened; reporting on performance and reporting on improvement opportunities are separate items — six in all |
| 6.1.2 Actions to address risks | 6.1.2 (part) | New as a separate clause; determine, analyse, evaluate; proportionate actions; note on disruption |
| 6.1.3 Actions to address opportunities | 6.1.2 (part) | New as a separate clause; determine, analyse, evaluate; actions appropriate to context |
| 6.3 Planning of changes | 6.3 | Seven considerations instead of four |
| 7.1.3 Infrastructure | 7.1.3 | Note now covers on-site, remote and hybrid work |
| 7.1.4 Environment for the operation of processes | 7.1.4 | Psychological factors expanded (burnout prevention, emotionally protective); link to quality culture and ethical behaviour |
| 7.1.6 Organizational knowledge | 7.1.6 | Note adds knowledge held in digital systems and other media |
| 7.3 Awareness | 7.3 | New item: awareness of the organisational quality culture and ethical behaviour |
| 8.3.1 and 8.3.3 Design and development | 8.3.1, 8.3.3 | Notes recognise iterative design cycles and inputs that evolve |
| 9.1.2 Customer satisfaction | 9.1.2 | Note adds social media as an information source |
| 9.1.3 Analysis and evaluation | 9.1.3 | Eight evaluations, was seven: effectiveness of risk actions and of opportunity actions evaluated separately |
| 9.3.2 Management review inputs | 9.3.2 | Effectiveness of risk actions and of opportunity actions are separate inputs; feedback from relevant interested parties named |
| 9.3.3 Management review results | 9.3.3 | Retitled from “outputs” to “results” |
| 10.1 Continual improvement | 10.1 and 10.3 | 2015’s 10.1 General and 10.3 Continual improvement are merged. There is no clause 10.3 in 2026. Nonconformity and corrective action stays at 10.2. |
The clause 10 renumbering is the one that bites: every procedure, audit checklist, training slide and software field that cites “10.3” now points at a clause that does not exist. Search for it.
No quality manual is required — that went in 2015 and has not come back. Documentation does not have to follow the clause structure; Annex A says so explicitly. The seven quality management principles, the process approach, the Plan–Do–Check–Act cycle and risk-based thinking remain the foundations, with “opportunity-based thinking” now named beside the last. Clause 8 — from customer requirements through design, external providers, production, release and nonconforming outputs — is substantively the same, with small clarifications in notes. If your 2015 system is effective, the transition is a set of specific additions and re-pointings, not a rebuild.
For certified organisations the transition period is set by the IAF in a resolution issued when the standard publishes, and applied by accreditation and certification bodies. Previous ISO 9001 transitions allowed three years from publication, which would put the end of the period around September 2029. Confirm the exact date with your certification body, and plan to transition well before it — certification bodies’ capacity is limited in the final months, and a transition audit is normally combined with a scheduled surveillance or recertification visit rather than run separately.
Sector schemes that build on ISO 9001 — IATF 16949, AS9100, ISO 13485, ISO 17025 — reference it by edition and will update on their own timetables. Until they do, the sector standard’s stated basis is what you are audited against for that scheme.
Because we are asked: the ISO 9001 Toolkit was rewritten from the published text on 17 September 2026. It is now 84 documents — 60 Word and 24 Excel — with every one of the 65 requirements owned by a named document, separate risk and opportunity registers, a quality culture and ethical behaviour policy, a climate-change determination record, the seven-consideration change procedure, an internal audit checklist seeded with all 65 requirements, and a transition section: a guide with the full clause map and a gap-assessment workbook pre-loaded with every changed requirement.
Existing customers have the new edition in their account downloads at no charge. It does not include a copy of the standard itself — ISO standards are copyrighted and cannot be redistributed — so obtain ISO 9001:2026 from iso.org or your national standards body and keep it beside the templates.
ISO has withdrawn it, but certificates to the 2015 edition remain valid through the IAF transition period. Organisations certifying for the first time should implement against the 2026 text now; those already certified transition at a surveillance or recertification audit before the period ends.
Evolutionary. Of 65 requirements, 46 are unchanged in substance, 16 revised, 2 new as separate clauses and 1 renumbered. The additions are specific — culture and ethics, separated opportunities, seven change considerations, the climate determination — and an effective 2015 system needs additions and re-pointing, not a rebuild.
No. Neither the 2015 nor the 2026 edition requires one. Many organisations keep one because it is a convenient map from the clauses to their evidence.
The standard prescribes no register. It does require opportunities to be determined, analysed, evaluated and actioned with their effectiveness evaluated separately from risks — which two registers evidence far more easily than one.
The IAF sets it on publication; three years from September 2026 is the precedent, so around September 2029. Confirm with your certification body.
All of these are covered by the ISO 9001 Toolkit, or start with the free ISO templates.
September 24, 2026
September 23, 2026
September 22, 2026
September 22, 2026
September 21, 2026