By Craig Jacobs, CQP MCQI — Founder, Affirm8 Consultancy Ltd — September 2026
ISO 9001, the world's most widely used quality management standard, is being revised for the first time since 2015. ISO 9001:2026 keeps the same 10-clause structure and core requirements certified organisations already know. The real changes sit in a small number of places: leadership must now actively promote quality culture and ethical behaviour, risk and opportunity become separate requirements, change management gets stronger controls, and the explanatory Annex A guidance is expanded to cover every clause. A three-year transition period is expected to run to around September 2029.
Below are the questions quality professionals are actually asking about the update, answered directly.
Yes. ISO 9001:2026 is the first full revision of ISO 9001 since 2015. It has progressed through ISO's Draft International Standard and Final Draft International Standard stages, with formal publication expected in Sept 2026. It replaces ISO 9001:2015 as the current edition, but existing 2015 certificates remain valid throughout a transition window and are not invalidated the day the new edition is published.
It is a measured revision, not a rewrite. The Harmonised Structure that ISO 9001 shares with other management system standards, such as ISO 14001 and ISO 27001, is unchanged, as is the 10-clause layout, the Plan-Do-Check-Act cycle, the seven quality management principles, and the process approach. Several clauses, including large parts of Clause 8 on Operation, carry over with only terminology tidy-ups.
“Organisations with a well-run ISO 9001:2015 system should expect a real but narrow gap to close, not a rebuild.”
Five things stand out:
● Quality culture and ethical behaviour become explicit requirements. Top management must actively promote both under Clause 5.1.1, and staff must be made aware of the organisation's expectations on both under Clause 7.3.
● Risk and opportunity are structurally separated. What was one combined clause, 6.1, is now three distinct sub-clauses: determining risks and opportunities, addressing risks, and addressing opportunities.
● Change management is strengthened. Planning a QMS change under Clause 6.3 now has to consider how the change will be communicated, how its effectiveness will be monitored, and how the results will be reviewed.
● Annex A is substantially expanded, from covering a handful of topics in the 2015 edition to explanatory guidance against every clause. Annex B is removed and folded into Annex A instead.
● Terminology is harmonised. Core management system terms are now defined directly in the standard under Clause 3, and documented information requirements are standardised to the single phrase, shall be available as evidence.
Not immediately, and not automatically. Publication does not change anything for an existing ISO 9001:2015 certificate on the day it happens. Certification bodies typically need several months after publication to gain accreditation to audit against the new edition, so the earliest compliant certificates are unlikely to appear until well into the following year. A transition period, expected to run around three years, then gives certified organisations time to move across.
No. If you are working toward ISO 9001:2015 certification now, keep going. Certify to the current edition and update at your next surveillance or recertification audit once your certification body is ready to assess against 2026. There is no advantage to delaying.
No. Nothing in the revision requires reorganising your documentation to mirror the standard's structure, renumbering procedures, removing a management representative role if you still find one useful, or replacing terminology you are already comfortable with. Conformity is judged against whether the requirements are met, not against how closely your document set mirrors ISO's own layout.
ISO 9000:2026 defines it as the culture within an organisation that supports achieving the quality policy and objectives, and delivering products and services that meet customer and stakeholder expectations. It is an outcomes-based definition, not a prescribed set of values.
“ISO 9001:2026 does not tell you what your culture should look like, only that top management has to promote it and people have to be aware of what is expected.”
Deliberately not. ISO 9001:2026 does not define ethical behaviour, and a definition that does exist elsewhere, in ISO 26000, is not a normative reference for ISO 9001. An auditor should not be applying an external ethics framework unless an organisation has specifically adopted one as part of its own QMS. The requirement is that top management actively promotes ethical behaviour as the organisation itself defines it, and that this is visible in practice, not just written down.
Often, yes, in substance if not always on paper. GMP regulation, through guidance from bodies like the MHRA and PIC/S and frameworks such as ICH Q10, has been building quality culture and ethical, non-punitive escalation into inspection expectations for years, well ahead of ISO 9001. Data integrity requirements already function as a practical ethics requirement, since organisations are expected not to falsify or backdate records and to report problems rather than concealing them.
“The gap for GMP-certified sites is usually not the underlying behaviour — it's connecting existing culture and data integrity work explicitly to the QMS documentation.”
It is now embedded directly in the body of the standard, under Clauses 4.1 and 4.2, rather than sitting as a bolt-on amendment as it did after ISO's 2024 update. Organisations still have to determine whether it is a relevant issue for their own context. It is not a requirement to act on climate change regardless of relevance, it is a requirement to have genuinely considered it and be able to show that consideration, even where the conclusion is that it does not materially affect the QMS.
No, not as a formal requirement. This is one of the most common questions being asked right now, and one of the most misunderstood. A lot of content circulating online, some of it from training providers and consultancies, suggests the 2026 revision introduces AI governance, AI risk clauses, or digital transformation requirements. Based on the confirmed FDIS text, that is not accurate. ISO 9001:2026 remains technology neutral. It does not name AI, mandate AI-specific controls, or add a clause dealing with automated decision-making.
What is actually happening is that AI is being addressed by a separate, dedicated standard, ISO/IEC 42001, published in 2023, which is an AI management system standard in its own right. If your organisation is deploying AI tools and wants a certifiable framework for governing that responsibly, ISO/IEC 42001 is the relevant standard, not ISO 9001:2026.
Treat claims that ISO 9001:2026 is ‘the AI update’ with scepticism — it isn't.
This article is based on the ISO/FDIS 9001:2026 text, cross-checked against public commentary from certification bodies including BSI, SGS, DQS and NQA.
Affirm8 Consultancy Ltd is a UK-based life sciences quality culture consultancy, working with Quality Directors and Operations Directors across pharmaceuticals, supplements, medical devices and cosmetics. Founder Craig Jacobs, CQP MCQI, has over 24 years of practitioner experience in quality management and root cause analysis. For questions on how the ISO 9001:2026 revision applies to your organisation, contact cjacobs@affirm8.co.uk.