ISO 9001: non-applicable requirements

The classic question: “Can we drop design? We only carry out what the client asks for.”

Sometimes yes. Often no. And even when the answer is yes, the written justification does not always hold up in front of an auditor.

ISO 9001:2026 has been published since 16 September 2026. This is the time to clean that up. The exercise is short, and it can spare you a nonconformity on a clause you thought was settled since your 2015 certification.

A clarification before we start. ISO 9001:2026 is now the current edition of the standard. Organizations already certified to ISO 9001:2015 have a transition period, set out in Global ACI-TECH-3-TR, published the same day as the standard. Two dates matter: from 31 March 2028, new accredited certifications can be issued only to the 2026 version. 30 September 2029 is the deadline to complete the transition. Depending on your calendar and the agreement with your certification body, your next audit may still be to the 2015 edition, or it may serve as a transition audit.

The applicability mechanism in clause 4.3 remains essentially the same in both editions. I flag the differences when there are any.

The word “exclusion” no longer exists in the standard

A short historical reminder, because it explains the confusion.

ISO 9001:2008 had a clause 1.2 that explicitly allowed “exclusions”, limited to the requirements of clause 7 (Product realization). Everyone got used to saying “we exclude 7.3”.

ISO 9001:2015 removed that mechanism. The word exclusion disappeared from the text. It was replaced by a different notion: applicability, dealt with in clause 4.3. ISO 9001:2026 does not go back on that. Clause 4.3 keeps the same mechanics, including the obligation to justify any requirement declared not applicable.

The difference is not cosmetic. In 2008, you removed a clause from the scope. Since 2015, every requirement of the standard applies by default to your quality management system (QMS). You demonstrate that a specific requirement cannot apply, given the nature of your activities. The burden of proof is reversed.

The practical consequence: the question is no longer “which clauses do we want to remove?” It is “is there a requirement that cannot apply here?”

The two-barrier test in clause 4.3

Clause 4.3 asks you to determine the boundaries and applicability of your QMS, to keep the scope as documented information, to state the types of products and services covered, and to justify any requirement of the standard that you consider not applicable.

A non-applicability has to clear two barriers at the same time.

Barrier 1: the requirement cannot be applied to your processes, products or services within the determined scope. It is not enough to say it is not currently implemented. You have to show that the conditions the requirement addresses do not arise in your context, or that the requirement is conditional and its condition for application is not met.

Barrier 2: the decision does not affect your ability or responsibility to provide conforming products and services, or to enhance customer satisfaction.

The two conditions are cumulative, not alternatives. If the requirement can actually apply, it must be applied. That is the logic of clause 4.3. Annex A of the 2026 edition clarifies the meaning of “applicable”.

A word on the guides from the ISO/TC 176 Auditing Practices Group (APG) that I cite later. They are useful, but they are not normative: the APG itself states that its documents have not been officially approved by ISO, ISO/TC 176 or the IAF.

The table, clause by clause

Here is where you have room, and where you have practically none. Two warnings before you read the table.

The standard publishes no official list of requirements that can or cannot be excluded. The criterion is clause 4.3, applied to your case. This table is a practical reading of that criterion, based on the APG audit guides. An auditor may conclude otherwise in a particular context, but they will have to justify it with the same test.

The numbering holds for both editions, except clause 6.1, which is subdivided, and clause 10.3, which disappears in 2026. “Normally always applicable” means a non-applicability would be exceptionally hard to sustain, not that a text forbids it.

Clause	Not applicable?	Comment
4.1 Context, 4.2 Interested parties, 4.3 Scope, 4.4 Processes	Normally always applicable	The foundation of the system.
5.1 Leadership, 5.2 Policy, 5.3 Roles and authorities	Normally always applicable	Including in a one-person business.
6.1 Risks and opportunities, 6.2 Objectives, 6.3 Planning of changes	Normally always applicable	In 2026, 6.1 is split into 6.1.1, 6.1.2 and 6.1.3. Clause 6.1.3 on opportunities is the real addition of the revision.
7.1.1 to 7.1.4 Resources, people, infrastructure, environment	Normally always applicable	The scale varies. The requirement stays.
7.1.5.1 Monitoring and measuring resources	Rarely, depending on the activities	First check whether resources are used to produce valid results when verifying conformity. The notion is broader than calibrated instruments.
7.1.5.2 Measurement traceability	Conditional	Applies when metrological traceability is a requirement, or when the organization considers it essential to the validity of the results. The absence of those conditions must be demonstrated. The APG example: a hair salon with no measuring equipment that requires traceability.
7.1.6 Organizational knowledge	Normally always applicable
7.2 Competence, 7.3 Awareness, 7.4 Communication, 7.5 Documented information	Normally always applicable	In 2026, awareness extends to quality culture and ethical behaviour.
8.1 Operational planning	Normally always applicable	Restructured in 2026: acceptance criteria for products and services, and process criteria, become distinct elements.
8.2 Requirements for products and services	Normally always applicable	Customer communication, determination and review of requirements, changes. In 2026, 8.2.1 clarifies communication on contingency measures and disruptions.
8.3 Design and development	Yes, the classic case	See below. This is the non-applicability you meet most often. It is also the easiest one to justify badly.
8.4 External providers	Depends on relevant externally provided processes, products or services	Applies as soon as an externally provided process, product or service affects conformity. Some particular requirements may be not applicable if the corresponding responsibility legitimately belongs to another authority. The APG example: a police force that does not have to determine the selection criteria for its suppliers (part of 8.4.1). Outsourcing never makes a requirement not applicable.
8.5.1 Control of production and service provision	Normally always applicable as a whole
8.5.1, validation and revalidation of processes	Conditional	Applies when the outputs cannot be verified by subsequent monitoring or measurement. Welding, heat treatment and sterilization are classic examples, but some services delivered in real time can be covered too. In 2015 this is item f): check the letter in your edition before you cite it.
8.5.2 Identification and traceability	Conditional by its own wording	Identify outputs when necessary to ensure their conformity. Control their unique identification and retain the necessary evidence when traceability is a requirement.
8.5.3 Property belonging to customers or external providers	Yes, but be careful	Often declared not applicable for the wrong reason. See the section on traps.
8.5.4 Preservation	Rarely	Also applies to intangible outputs: data, records, digital deliverables.
8.5.5 Post-delivery activities	Conditional	The extent of the activities required depends on your obligations, possible undesired consequences, the nature and lifetime of the product or service, customer requirements and feedback received.
8.5.6 Control of changes	Normally always applicable
8.6 Release of products and services	Normally always applicable
8.7 Nonconforming outputs	Normally always applicable	An organization that claims it never produces a nonconformity is telling the auditor it does not detect them.
9.1 Monitoring and measurement, 9.1.2 Customer satisfaction, 9.2 Internal audit, 9.3 Management review	Normally always applicable
10.1 Improvement, 10.2 Nonconformity and corrective action	Normally always applicable	In 2026, clause 10.3 of 2015 is merged into 10.1. The requirements remain.

In practice, declarations of non-applicability cluster in certain conditional requirements of clauses 7 and 8, particularly 7.1.5.2, 8.3 and some elements of 8.4 and 8.5. That is not an official or closed list: each decision has to be assessed under clause 4.3.

The four justifications that do not hold

“It costs too much.” Cost is not an applicability criterion. It is a criterion for sizing your system, not for exclusion.

“It is outsourced.” The APG is explicit on this: no clause becomes not applicable because the activity is given to a third party. If you subcontract design, clause 8.3 remains applicable and the auditor will check how you control that outsourced process, through clause 8.4. You cannot subcontract your responsibility.

“No client asked for it.” The standard is not a client contract. It stands on its own once you ask for certification.

“We drew the scope so it would not be included.” The scope may be limited to a division, a site or a range of services. What you cannot do is draw an artificial scope whose only purpose is to escape a requirement that actually touches the services included. A scope that misleads the market about what your certificate covers will be challenged by the certification body, which has its own obligations under ISO/IEC 17021-1.

The three traps that cost nonconformities

Trap 1: design that does not call itself design. The justification “we only execute to the client’s specifications” can be valid when a client or another entity truly holds design authority and provides complete, approved requirements. That is the case of a machine shop that receives a fully dimensioned drawing. It becomes fragile as soon as your organization defines or changes the characteristics of the product or service, turns an incomplete need into specifications, sets an architecture specific to the client, or takes responsibility for a solution that meets functional requirements.

Simply choosing a tool, a work sequence or a manufacturing method is not automatically design. For a service, though, defining a new method of provision can fall under 8.3 when that method is part of the characteristics promised to the client.

The right question: who holds the authority and the responsibility to define or change the characteristics of the product or service delivered?

An IT, engineering or professional services firm that declares 8.3 not applicable should redo the analysis before an auditor does it for them. That is not a rule written in the standard. It is a warning sign, because these firms often turn an incomplete need into a solution.

Trap 2: customer property misunderstood. Service businesses declare 8.5.3 not applicable because they think the clause only covers physical parts left in their care. If a client entrusts you with data, documents, personal information or intellectual property, clause 8.5.3 can apply even when there are no physical parts. You have to identify what is entrusted, verify it when relevant, protect it, and report any loss, damage or unsuitability for use.

This is also a natural bridge between the QMS and Bill 25 when you process personal information entrusted by a client. Quebec’s Act respecting the protection of personal information in the private sector, as amended by Bill 25, requires a business to destroy that information once the purposes have been fulfilled, or to anonymize it in order to use it for serious and legitimate purposes, subject to a retention period required by law. One inventory can support both systems, provided you distinguish owners, the persons concerned, purposes, retention periods, protection measures, and methods of destruction or anonymization.

Trap 3: a justification copied from a template found online. An auditor recognizes a generic paragraph in three seconds. The text has to name your activities, your products and your services.

If you know ISO 27001: why there is no SoA in ISO 9001

This section is for people who manage both standards. If that is not you, skip to the next one.

This is the comparison that confuses everyone.

ISO/IEC 27001 requires a Statement of Applicability (SoA) because its structure makes one necessary. The standard has two levels: the requirements of clauses 4 to 10, and Annex A, which groups 93 reference controls in four themes. Clause 6.1.3 requires you to determine all controls necessary to treat your risks, wherever they come from, then compare them with Annex A to confirm that no necessary control has been omitted. The SoA then contains the necessary controls, the justification for including them, their implementation status, and the justification for Annex A controls you consider unnecessary. It is a selection document.

A point often misunderstood: in ISO 27001, clauses 4 to 10 are no more excludable than in ISO 9001. The SoA is about the controls, not about those clauses. Nobody has ever had the right to exclude management review.

ISO 9001 has no catalogue of controls. There is nothing to select. The whole text of clauses 4 to 10 is a requirement, so there is no selection document to produce.

Three practical differences follow:

	ISO/IEC 27001:2022	ISO 9001:2026
Subject	Necessary controls determined by risk treatment, compared with the 93 reference controls in Annex A	Applicability of the requirements in clauses 4 to 10
Basis of the decision	Risks, legal and contractual obligations, and other security needs	Nature of the activities, products, services, processes and responsibilities within the scope
Documented information	Mandatory SoA: necessary controls, justification for inclusion, implementation status, and justification for excluded Annex A controls	Documented scope stating the products and services covered and justifying any requirement declared not applicable

In ISO/IEC 27001, you document the necessary controls and you account for coverage of Annex A. In ISO 9001, you apply the relevant requirements of the standard and you justify the requirements you determine are not applicable.

Where and how to document it

The only documented information required by clause 4.3 is the scope. The justification of non-applicability has to be there. Not in a forty-page quality manual the standard has not required since 2015, not in an email to the auditor, not in a buried procedure.

Do not confuse two different moves. Limiting the scope is a bounded organizational choice: you have to take account of context, interested parties, products and services, and the processes needed to provide them. Determining that a requirement is not applicable is a different decision, and it must be justified in the documented information that describes the scope. In both cases, the result has to be accurate, not misleading, and consistent with the activities actually covered. Both live in the same document, which explains a good part of the confusion.

A template to adapt:

Quality management system scope

The quality management system of [Organization] covers [types of products and services], carried out from [sites and addresses].

Not covered by this scope: [activities, sites or ranges not covered, if any].

Requirements that are not applicable

Clause 8.3, Design and development of products and services: not applicable. [Organization] provides [precise description of the products or services] from complete specifications and characteristics established and approved by [the client or the entity responsible for design]. [Organization] does not hold the authority to define or change the design characteristics of the product or service. Any ambiguity or request for change is submitted to [the design authority] for decision and approval before execution.

The organization plans and controls its methods of realization in line with the applicable operational clauses, but it neither performs nor subcontracts any design or development activity that falls within its own area of responsibility.

This non-applicability does not affect the ability or the responsibility of [Organization] to provide products and services that conform to applicable requirements, or to enhance customer satisfaction.

All other ISO 9001 requirements are applicable.

Note the choice of “applicable”, not “applied”, in the last line. Declaring a requirement applicable is a scope decision. Showing that it is applied is the work of the rest of your system, and it is proved another way. An organization can perfectly well have an applicable requirement and a nonconformity in how it is implemented. Do not mix the two in the same document.

Alongside the scope, keep an internal applicability table. The standard does not require it. It saves you time in an audit, in annual surveillance, and when the scope changes.

Requirement	Applicable	Justification	Evidence or reference
8.3 Design and development	No	Complete characteristics established and approved by the client. The organization has no authority to define or change them	Standard contracts, client specifications
8.5.1, process validation	No	All outputs can be verified by monitoring or measurement before release	Final inspection procedure, form QC-04
8.5.3 Customer property	Yes	Hosting of client data	Client data management procedure
7.1.5.2 Measurement traceability	No	No metrological traceability required by law or contract, and none considered essential by the organization	Review of contractual requirements

Reread this table at every management review. Again, the standard does not require it: it is a practice I recommend. A non-applicability is valid at the moment you write it, not forever. The day you sign a first custom development contract, your 8.3 justification becomes false, and you are in nonconformity until someone notices.

The questions the auditor will ask

Test your justifications with these questions before someone else does it for you.

Show me where the non-applicability is documented in your scope.
Who made this decision, when, and on what basis?
Does this activity exist nowhere in your organization, or is it simply done by someone else?
If a client asks you tomorrow to propose a solution instead of executing theirs, what changes in your system?
On the contract I just read, who determined the characteristics of the deliverable, you or the client?
You say you do not design. Who defines and approves the characteristics of the product or service? Who decides on changes when the initial requirements are incomplete or ambiguous?
Is this requirement inapplicable, or simply not applied so far?
In what way does its absence not affect the conformity of your products and services?
How long has it been since this justification was reviewed? Have your activities changed since?
Does the wording of your scope and your certificate faithfully describe the products, services, sites and design responsibilities actually covered?

Question 7 sums up the whole article. If one of these questions makes you hesitate, you have found where to work.

What the 2026 edition changes on this

On applicability itself, ISO 9001:2026 changes little. Clause 4.3 keeps its mechanics. The published Annex A clarifies the meaning of “applicable”. The operational requirements from 8.3 to 8.7 remain substantially stable. Clause 8 does have a few changes beyond terminology: a restructuring of 8.1, and a clarification of customer communication on contingency measures and disruptions in 8.2.1. If your scope statement is solid today, it will stay that way.

Three points are still worth your attention.

Climate is not a 2026 novelty. Since the amendment ISO 9001:2015/Amd 1:2024, the organization must determine whether climate change is a relevant issue for its QMS. Clause 4.2 also notes that relevant interested parties may have requirements related to climate. The 2026 edition integrates that amendment into the main text. You may conclude that climate is not a relevant issue for your QMS, but you must have done the analysis and be able to show the result. That conclusion does not necessarily have to appear in the scope statement, even if it can influence the scope when it is relevant. If you have recorded nothing, you are not behind on 2026. You are behind on 2024.

Cite the title, not only the letter. Lists of items may have been restructured, as 8.1 was. If your scope statement cites a lettered item, check it in the 2026 edition. Cite the title of the requirement as well as its reference.

The transition is a chance to reopen the file. If your scope statement dates from your initial certification and the business has changed activities since, the 2015-to-2026 gap analysis is the moment to redo it without looking like a confession. You have until 30 September 2029, but the transition audit can take place during surveillance, recertification or a separate audit. Ask your certification body for its calendar: that is who will set your practical deadline.

For the rest of the revision, I covered it in ISO 9001:2026: changes and transition plan. The gap analysis and the steps to follow are in that same article.

To do this week

Open your scope statement. Clause 4.3 requires it to exist as documented information and to be available. If nobody in your organization can find it, the problem is not theoretical.
List every requirement you have declared not applicable. Count them. A long list is not forbidden, but it draws an auditor’s attention.
For each one, apply the two-barrier test and write the answer. If you cannot write it in three precise sentences that name your activities, the justification does not hold.
Pull your last three signed contracts. Read who defines the characteristics of the deliverable. If you define or change them, or you turn an incomplete need into specifications, your 8.3 non-applicability no longer holds.
Fill in the applicability table and add it as a standing item on your next management review.
Ask your certification body for the date of your next audit and the calendar of your transition to 2026.

In short, in ISO 9001 there is nothing to exclude. There are only requirements that cannot apply to you. It is up to you to prove it.

Does your scope statement or a non-applicability look fragile before the next audit? Let’s talk.

ISO 9001 exclusions: what you can declare not applicable (and what you cannot)