ISO 9001:2026: what changes, and what to do about it

16 September 2026. The Final Draft International Standard ballot is complete and the technical content is settled, so work you do against the FDIS now stays valid at publication.

No. Certification to ISO 9001:2015 remains valid throughout the transition period. Existing certificates do not become invalid on the publication date. You transition at a normal surveillance or recertification audit during the transition period rather than doing anything special on publication day.

Three years is what certification bodies currently anticipate, which would put the deadline at September 2029. The three-year transition period is the length ISO has used for recent management-system revisions and is what certification bodies currently anticipate. The binding rules — when new certifications to the old edition stop, when audits must switch over, and when old certificates expire — are set by the International Accreditation Forum, and no IAF resolution for the 2026 edition has been published yet. Treat every date after publication as expected rather than fixed, and confirm with your own certification body.

Small, structurally. The clause structure — 4 through 10 — is unchanged, there is no renumbering of the familiar sections, and the process approach works exactly as before. Certification bodies are describing it as evolutionary rather than revolutionary. The work is in a handful of specific additions, not in rebuilding your system.

Almost certainly 2015, and not because it is the safe choice — because it is likely the only one on offer. Certification bodies have to be accredited to audit against the new edition before they can issue a certificate to it, which typically takes 9 to 12 months after publication. For roughly the first year, most bodies will still be training auditors — so certifying to ISO 9001:2015 remains the normal path well into 2027. Certify to 2015 now, build the 2026 additions in as you go (they are small), and transition at a later surveillance audit. Ask your certification body what they can actually offer and when; it varies between bodies.

Yes, for a while. Last time round, the equivalent cut-off came two years after publication: ISO 9001:2015 published in September 2015, and certification bodies stopped accepting new applications against ISO 9001:2008 in September 2017. If the same pattern holds, new certifications against the 2015 edition would run until around September 2028. That is a projection from precedent, not a published rule — the IAF has not issued the 2026 resolution yet.

In the 2015 transition, all initial, surveillance and recertification audits had to be conducted against the new edition from March 2018 — two and a half years after publication, six months before old certificates expired. The equivalent point for this revision would be around March 2029. Again: precedent, not a published rule.

Only if your certification body can actually audit you to it, which for most bodies will not be true until well into 2027. Certification bodies have to be accredited against the new edition before they can issue a certificate to it, and that accreditation typically takes 9 to 12 months after publication. Waiting for that means waiting a year to get certified — which is usually a worse outcome than certifying now and transitioning later at a routine audit.

If you are maintaining the system yourself, yes — eventually. You cannot audit yourself properly against a document you have not read, and the text is only available from ISO or your national standards body. Note that ISO's licence is single-user: you cannot put the PDF on a shared drive for the team, which catches out a lot of small companies.

It applies already — this is the most commonly missed point. ISO 9001:2015/Amd 1:2024 (climate action) was published on 23 February 2024 and applies now. The IAF confirmed no separate transition programme is needed for it, and it does not affect the validity of an existing certificate. It adds one sentence to clause 4.1 requiring the organization to determine whether climate change is a relevant issue, and a note to 4.2 that interested parties can have climate-related requirements. Clause 4.1 requires you to determine whether climate change is a relevant issue for your organization, and 4.2 asks whether interested parties have climate-related requirements of you. Deciding it is not relevant is a perfectly acceptable answer, but you need a recorded reason for that decision. Silence is the finding, not the conclusion.

It means an auditor can ask your staff what happens when quality and a deadline conflict, and expects a consistent answer. In a small company this is usually already true in practice and simply not written down anywhere. The practical work is making the expectation explicit — in your induction, your toolbox talks, and in how leadership demonstrably behaves when it costs something.

Because in practice almost everyone filled in the risk half and left the opportunity half blank. Splitting 6.1 into 6.1.2 for risks and 6.1.3 for opportunities forces opportunities to be identified, resourced or consciously declined, and reviewed — rather than being a column nobody completes.

No — and it has not since the 2015 edition, which removed the requirement that was in clause 5.5.2 of ISO 9001:2008. What clause 5.3 requires is that specific responsibilities and authorities are assigned to named people and communicated. Many companies still use the job title, and some customers still ask for one by name, but the standard itself does not require the role to exist.

Yes, as a drafting tool. The consensus among practising auditors is that AI-drafted documentation is acceptable where a competent person reviews, edits and formally approves it — and that AI as the final author with no human review would be a serious finding. Clause 7.5.2 still requires review and approval before use, regardless of how the draft was produced. Keep the records that show the review happened, and expect to be asked about it: AI use is becoming a routine audit question.

A new informative annex — around fifteen pages of guidance on how to interpret the requirements, including risk-based and opportunity-based thinking and how much formality is proportionate for your size. Informative means it is guidance, not requirements you are audited against. It is genuinely useful if you have ever wondered whether you are over-engineering your system.