ISO 9001:2026: Changes and Transition Plan from ISO 9001:2015

Updated 18 September 2026. ISO 9001:2026 was officially published on 16 September. This article has been revised against the published edition.

I have clients who have just finished their ISO 9001:2015 certification. The first question once the certificate is in hand: “Do we have to redo everything?”

My short answer: no. This is not a rebuild of the system.

ISO 9001 is the world’s most widely used quality management standard. ISO 9001:2026 was officially published on 16 September 2026. It is the 6th edition and it replaces ISO 9001:2015.

The revision remains a targeted update. The 2015 foundations still hold: customer focus, the process approach, risk-based thinking and continual improvement.

The transition timeline

Organizations certified to ISO 9001:2015 have three years to move to ISO 9001:2026. In practice, that points the deadline toward September 2029.

Your certification body will specify how and when the transition is built into your audit cycle. ISO indicates that, for most organizations, it can be integrated into a surveillance or recertification audit rather than requiring a separate assessment.

So if you are certifying or recertifying to the 2015 version, do not delay. You have three years ahead of you.

What ISO puts forward

ISO presents five main changes. This is not a magic list. It is a useful frame for prioritizing the work.

1. Leadership, quality culture and ethical behaviour (clause 5.1)

This is clearly one of the central additions in the 2026 edition. Top management must promote a quality culture and ethical behaviour, not only sign a policy.

My reading of the text: the intent is clearer than the evidence required. The hard part will be deciding which evidence auditors will treat as enough to show that top management actually fosters that culture.

In my audits, I would expect to see more than a word pasted into a document. Concrete examples: management-review decisions, internal messages, training, how a nonconformity is handled when it costs money. That will vary from one auditor to another.

2. The quality policy more clearly tied to context (clause 5.2)

This is a point too many summaries underplay. ISO now states more explicitly that the quality policy is more closely linked to the organization’s context and strategic direction.

In practice: a generic policy copied from a template will stand out faster. If your policy says nothing about your market, your customers or your issues, this is the time to rewrite it.

3. Risks and opportunities, each with their own treatment (clause 6.1)

Clause 6.1 separates the treatment of risks and opportunities more clearly. In 2015, the two were often glued together, with the risk that one of them would be neglected. ISO confirms that this clearer distinction is among the significant changes.

The change clarifies and further separates how they are handled. It does not overturn the risk-based approach. The word “opportunity” is still fuzzy for many organizations. The work is not inventing a new register for show. It is showing that you also act when a chance to improve quality appears, not only when a risk looks scary.

4. Awareness is broadened (clause 7.3)

ISO’s official communication puts the accent on clause 7.3 (awareness). People need to better understand the organization’s quality culture and ethical behaviour, on top of the usual quality management system processes.

In practice, that means reviewing onboarding and ongoing training to add these notions, not only mentioning them in a procedure that gathers dust.

5. A much fuller Annex A

The new Annex A is about 15 pages. It clarifies structure, terminology and the intent behind the requirements. ISO presents it as one of the five significant changes, precisely because it explains the concepts.

This annex does not create a new set of auditable requirements like clauses 4 to 10. That said, ignoring it during a transition would be a poor idea. It is often the best place to understand what the committee meant, especially on quality culture, opportunities, and the link between policy and strategy.

The 2024 climate amendment is now integrated

This is not a novelty born in 2026. The 2024 climate amendment (ISO 9001:2015/Amd 1:2024) already existed. The 2026 edition takes that consideration into the body of the standard, in clauses 4.1 and 4.2, with knock-on effects on 4.3 and 6.1.

You must determine whether climate change is a relevant external issue for your quality management system and, if it is, factor it into your planning. If it is not relevant, the reasoning still has to hold up. A “no” with no analysis shows.

Also worth noting: change management (clause 6.3)

Change-planning requirements are expanded in several readings of the revision, with possible links to 5.3, 8.1, 8.2 and 9.3. The focus is often communication, monitoring and evaluation.

I do not place it among the five changes ISO puts forward. Keep it in your gap analysis, without making it the centre of the project.

What does NOT change

This is probably the most useful angle of the revision.

ISO confirms that the harmonized structure remains and that the fundamental principles stay: customer focus, the process approach, risk-based thinking and continual improvement. 2026 does not require you to rebuild the QMS.

There is no new technical requirement on artificial intelligence, cybersecurity or cloud computing. The standard does not become a sustainability standard: only the climate change already introduced in 2024 is carried forward. There is no specific clause on supply-chain resilience.

On continual improvement: ISO insists it remains a central principle. A clause number can move. A requirement is something else. Do not keep the shortcut “10.3 disappears.” What matters is still showing that you correct, learn and improve.

A targeted update, not a rebuild

After reading the final text, I still see this revision as a targeted update rather than a rebuild of the system. That is also compatible with ISO’s official description, which itself speaks of targeted changes rather than a new fundamental approach.

Talk around a revision often inflates the size of the job. The text itself mainly moves leadership, policy, the risk/opportunity split, awareness and the guidance in Annex A. Operational clauses move little.

The amount of work depends on your current system. An organization that already has an aligned policy, a real opportunity analysis and involved top management will adjust. An organization that survived 2015 with generic documents will have to do more than change version dates.

2015 → 2026 → Action

Transition plan

ISO recommends five moves: understand the changes, analyse the current system, make the adjustments, engage people, then plan the transition with the certification body.

Here is the version I give my clients.

1. Gap analysis. Compare your current system with the revised clauses, prioritizing 4.1/4.2, 5.1, 5.2, 6.1 and 7.3. Annex A helps you read the intent.
2. Top management and policy. Go through the management review and the quality policy. The link with context and strategic direction has to be visible, not only written.
3. Risks and opportunities. Separate what you do about risks from what you do with opportunities. If everything sits in the same fuzzy list, this is the time to clean it up.
4. Culture and awareness. Update onboarding and ongoing training. People should be able to explain, in their own words, what your organization means by quality and by ethical behaviour.
5. Documentation and affected processes. Change what actually moved. Avoid a full rewrite “to make it 2026.”
6. Internal audit. Audit the transition gaps before the certification body. That is where you see whether quality culture is only a slogan.
7. Transition audit. Agree the timing with your certification body: surveillance or recertification, depending on your cycle.

If you already have ISO 14001, look at the transition in an integrated way. Both 2026 revisions share terminology and climate requirements.

In short, this revision deserves a plan, not panic. The foundations of your quality management system stay the same. The real work is tying the policy to context, treating opportunities as well as risks, and making quality culture visible without reducing it to a word in a manual.

If your question is what you can still declare not applicable (the old “exclusions”), that is covered in ISO 9001 exclusions: non-applicable requirements.

An audit or recertification is coming up and you are not sure what this edition changes for you? Let’s talk.