ISO 9001:2026 was published on 16 September 2026, and within a day we had the first call from a client asking whether their certificate was now worthless. It isn’t. Your 2015 certificate stays valid to its printed expiry, the clause structure you know is still there, and nobody is going to fail you on Monday for not having a “quality culture procedure.”
But the revision is real, and several of the changes are the kind auditors love: they turn things good organizations already do into things you now have to show.
What actually changed
The harmonized structure survives intact, clauses 4 to 10. The changes sit inside it:
- Quality culture and ethics (5.1.1, 7.3, 7.1.4). Top management must now promote and demonstrate a quality culture and ethical behaviour, and people must be aware of those expectations alongside the policy and objectives.
- Policy tied to strategy (5.2.1). The quality policy has to reflect the context of the organization and support its strategic direction. The generic policy downloaded in 2016 will get a harder look.
- Risks and opportunities split (6.1). Clause 6.1 now separates general requirements, actions on risks, and actions on opportunities, and expects you to judge the effectiveness of each separately.
- Change planning (6.3). Planning a change now explicitly covers how it will be communicated, what information people need, how it will be monitored, and how you will decide, up front, whether it worked.
- Knowledge (7.1.6). Organizational knowledge now covers what the whole QMS needs to achieve results, not just product delivery, with clearer expectations to retain, use, and share it.
- Context and climate (4.1, 4.2). The 2024 climate amendment is folded in, and 4.2 more clearly asks you to decide which interested-party requirements the QMS will address.
- Audit objectives (9.2.2). Each internal audit needs defined objectives, not just scope and criteria.
- Improvement (10.1). The old 10.1 and 10.3 are consolidated, with leadership’s role in continual improvement made more explicit.
- Clause 8 sharpening. Mostly terminology, but with teeth in places: evidence that amended orders were reviewed and that updated requirements reached the people who need them (8.2.3.2, 8.2.4), and, in 8.5.1, verification that staff actually use current information at the point of use, not merely that a current master exists.
- Annex A. A new informative annex explaining requirements and how clauses relate. Useful reading; no new obligations.
What did not change
No new mandatory forms. No software requirement; the standard stays technology neutral. Artificial intelligence was discussed during the revision and was not added as a specific requirement, whatever the webinar invitations in your inbox suggest. Process approach, PDCA, risk-based thinking, and customer focus are unchanged in principle.
The transition is shorter than it looks
The transition period is three years, with 2015 certificates expected to lapse around September 2029. Treat that date as expected and confirm it with your certification body. The real window is tighter: certification bodies need accreditation and trained auditors before they can offer transition audits, which may not be widely available until late 2026 to mid 2027. That leaves roughly two usable years, and everyone else is aiming for the same auditors.
Our advice is consistent: combine the transition audit with a scheduled surveillance or recertification audit, and do not plan for the last available date.
Where a system of record earns its keep
Most of the 2026 changes share a pattern. They ask you to show that something happened, reached people, and worked. That is a linkage and evidence problem, and it is where software helps most.
Risks and opportunities. Keep separate risk and opportunity registers, each entry linked to the actions it produced and an effectiveness review with a date and an outcome. When the auditor asks how you evaluated opportunity actions differently from risk actions, you filter, not reconstruct.
Change planning. A change record with fields for communication plan, information provided, monitoring method, and effectiveness criteria makes 6.3 a form people fill in rather than a memory test. The effectiveness criteria are set before the change, which is precisely what the clause now asks.
Point of use. Document control that retires superseded revisions on release, plus read acknowledgements from the people who use the document, is the cleanest evidence available for 8.5.1. You can show who has confirmed the current revision, and who hasn’t.
Awareness and culture. Training records that include culture and ethics briefings, tied to the people required to attend, give you evidence for 7.3. Awareness is still demonstrated in conversation during the audit; the records show it was delivered to everyone, not just whoever was in the room.
Audit programme. An audit record with a mandatory objectives field makes 9.2.2 impossible to forget, and linking findings to the corrective action process keeps the loop closed.
Management review. When risks, opportunities, audit results, and nonconformities are structured records, the 9.3 inputs, now split for risks versus opportunities, assemble from live data instead of a slide deck built the night before.
Knowledge. Capturing lessons learned, setup notes, and hard-won process knowledge as controlled documents gives 7.1.6 an owner, a revision history, and a way to share it.
What software cannot do
Software cannot install a quality culture. Clause 5.1.1 is about what top management visibly does: how they respond to bad news, whether they stop a shipment, whether ethics concerns get heard. A system gives you consistency and evidence; leadership provides the culture. An auditor who interviews three operators will find out which one you have.
The usual caveat applies too: software does not fix a system that has not been defined. If ownership and processes are unclear, digitizing them only makes the gaps easier to search.
What to do this quarter
- Buy and read the published standard. Do not implement from the drafts.
- Run a gap analysis against the changed clauses above, starting with 5.1.1, 6.1, 6.3, and 9.2.2.
- Revise the quality policy so it actually reflects your context and strategy.
- Split your risk register into risks and opportunities, with linked actions and effectiveness reviews.
- Add objectives to every internal audit in the current programme.
- Call your certification body to confirm their accreditation timeline and pair the transition with your next scheduled audit.
The bottom line
ISO 9001:2026 is an evolution, and a sensible one. It asks organizations to prove what good ones already do: lead with integrity, plan changes properly, and make sure the right information reaches the people doing the work. If your evidence lives in linked records, as it does in My ISO QMS, most of the transition is configuration and a few new fields. If it lives in scattered spreadsheets, now is a good time to fix that, well before the 2029 queue forms.