ISO 9001:2026 transition: timeline, changes vs 2015, deadline
ISO 9001:2026 was published on 16 September 2026 — the first full revision of the quality management standard since 2015. This guide lays out the transition window, what changed, and how to get it done, with a ready-to-use document pack.
What this revision changes
The 2026 edition keeps the Annex SL high-level structure but adds a climate-change consideration to organizational context (4.1), strengthens leadership and governance expectations, and tightens supply-chain resilience and operational controls. The full clause-by-clause mapping is in the pack below.
Complete the transition in 5 steps
- 1Confirm your certification body’s transition plan
- 2Run a gap analysis against the 2026 edition
- 3Update documentation (manual, procedures, risk/opportunity register)
- 4Train staff, run an internal audit and management review
- 5Book the transition audit before the cutoff
ISO 9001:2026 Transition Pack
$19ISO 9001:2026 was published on 16 September 2026; the transition cutoff is 2029-09-30. This pack turns every ISO-confirmed change (including BSI’s clause-by-clause comparison) into nine ready-to-run working documents: clause diff, before→after for the five procedures, an opportunity-register masterclass, gap checklist, document revisions, auditor probes & evidence prep, and a back-planned timeline.
What actually changed (ISO-confirmed)Fifteen ISO- and BSI-confirmed changes, each with a “what it means on the ground” line — not just what changed, but what it forces you to do. The four operational refinements in 8.2-8.5 and the new performance-evaluation requirements are all listed.
01What actually changed (ISO-confirmed)
- 5.1 Leadership: quality culture & ethics — Explicit quality culture and ethical behaviour; leaders must create an environment where everyone actively contributes to QMS effectiveness. On the ground: culture can no longer be a slogan — define 3-5 observable behaviours, 2-3 measurable indicators (first-pass yield, rework / cost of quality, awareness surveys) and keep evidence of day-to-day leadership engagement.
- 5.2 Policy: aligned with strategy — The policy is more explicitly linked to context (4.1) and strategic direction — the QMS becomes a tool for business objectives, not a compliance ornament. On the ground: rewrite the policy intro, cite the strategy explicitly, and show the “policy → objectives → performance” chain at management review.
- 6.1 Risk & opportunity: formally split — A clear separation between addressing risks (for informed decision-making) and pursuing opportunities (for continual improvement). On the ground: keep two registers — risks and opportunities — and tie every opportunity to an improvement project with an owner and a due date.
- 7.3 Awareness: from knowing to understanding — New: people must understand quality culture and ethical behaviour, not just know the procedures. On the ground: upgrade training from process briefings to case-based culture modules, and keep sign-in sheets, quiz results and communication records.
- 6.3 Change management: seven factors to weigh — 2026 clause 6.3 is explicit: before implementing a change, consider all seven factors — a) purpose and potential consequences; b) impact on QMS integrity; c) availability of resources and information; d) allocation/reallocation of responsibilities; e) communication of the changes; f) how effectiveness will be monitored and evaluated; g) how results will be reviewed. Most legacy procedures lack f)/g), the post-change evaluation — changes get archived, never re-checked. On the ground: write the seven factors into your change checklist, with records for f)/g).
- 7.1.6 Organizational knowledge: retain, apply, share — Note: 7.1.6 Organizational knowledge already existed in the 2015 edition — the upgrade is in wording. 2026 shifts from “maintain and make available” to “maintain, apply and, as necessary, share”, so knowledge can no longer sit in a list; it must flow. On the ground: add a sharing mechanism on top of the knowledge list (mentoring, case libraries, rotation debriefs, offboarding handover templates) and keep records of the sharing activities.
- Clause 8 review points: 8.2 sharpened, 8.3-8.5 carried over — After a line-by-line check of the standard text: 8.2.1 e) is sharpened from the 2015 “establishing specific requirements for contingency actions” to “providing information related to contingency actions, including any related to disruptions to the provision of products or services” — sales needs one more communication line for customer notification during disruptions. 8.3 design outputs (acceptance criteria and essential characteristics), 8.4 direct delivery by external providers, and 8.5 “availability and use” of documented information all read close to 2015 — treat them as review-and-confirm points, not new gaps to rebuild.
- Internal audit: objectives for every audit — One of the hard new performance-evaluation requirements: each internal audit must define its objective — a schedule with dates and departments no longer suffices. On the ground: add a mandatory “audit objective” column to the plan (e.g. “verify the post-change review closed the loop”, “check the opportunity register works”).
- 9.3 Management review: new input on interested parties — A new management-review input: changes in the needs and expectations of interested parties. On the ground: add the row to your review-input checklist, owned by the system function with an updated interested-party analysis as the supporting material — drift in customer / regulator / employee expectations now has a fixed entry point.
- New Annex A (≈11 pages of structure clarification) — It replaces the old informative annex (Annex B is removed) with ≈11 pages clarifying concepts, terminology and clause intent, including clause-level notes A.4-A.10. On the ground: it is the best single reference for internal training — translate each clarification into your organization’s own language and keep the training evidence.
- Climate change in the main text — The Amd1:2024 climate-change consideration is carried into the main text (4.1/4.2). On the ground: your context analysis must show a conclusion on climate — analyse the impact if relevant, and record the assessment either way; leaving it blank is a nonconformity.
- Terminology & structure harmonized: 20 core terms in Clause 3 — The 2026 edition writes 20 core terms (3.1 organization through 3.20 monitoring) directly into Clause 3, with quality-specific terms (QMS, quality policy, quality objectives) entering the text for the first time; ISO 9000 remains normative — closer alignment with 14001/45001. On the ground: run a site-wide wording review of controlled documents — especially leadership, culture and risk vocabulary — to prepare for integrated management.
- Documented information: “retain” → “available” — Documented-information requirements shift toward an “availability” basis. On the ground: review your documented-information list — relax what can move from “must retain” to “available on demand”, and strengthen access to what truly matters (culture indicators, opportunity-loop status).
- Certification calendar (incl. accreditation milestones) — The official Global ACI-TECH-3-TR 2029-09-30 (M) timeline: published 2026-09-16; accreditation bodies (ABs) ready and announcing arrangements by 2027-03-31; certification bodies (CBs) submit transition declarations by 2027-06-30; AB transition decisions on CBs due 2027-09-30 — only then may a CB issue 2026-edition certificates; from 2028-03-31 new initial certificates are issued only to the 2026 edition; 2029-09-30 is the cutoff when 2015 certificates lapse. On the ground: before booking a transition audit, confirm your CB has passed its AB transition decision — otherwise what you get is not a 2026-edition certificate.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Clause-by-clause reading (clauses 3–10 + Annex A)A formal clause-by-clause reading from clause 3 to clause 10: each entry covers the substance of the requirement, the evidence auditors look for, the common traps, and the bridge from the 2015 edition — usable as your transition-plan introduction and internal-training outline.
01Clause-by-clause reading
Clause 3 now lists 20 core terms directly (3.1 organization through 3.20 monitoring); the quality-specific terms — QMS, quality policy, quality objectives — enter the main text for the first time, while ISO 9000 remains the normative reference. The substance: key concepts across your system now have text-level definitions, and controlled-document wording must line up with them. What auditors check: high-frequency terms in procedures and floor records (process, risk, documented information, nonconformity) against the clause 3 wording, and whether the manual still cites outdated definitions. The common trap: treating this as pure editing — the manual is updated but forms and record templates still carry 2015-era phrasing. The bridge from 2015: most terms carry over from ISO 9000, so a wording mapping plus targeted re-issues is enough — no structural rebuild needed.
The substance: determine internal and external issues relevant to purpose and strategic direction, and explicitly decide whether climate change is a relevant issue — the hardest requirement in clause 4, with 4.2 noting that interested parties may raise climate-related requirements. What auditors check: whether your context analysis carries a reasoned relevant/not-relevant call on climate, whether the interested-party register is refreshed annually, and whether expectation drift is tracked. The common trap: writing “not relevant” without an argument, or leaving it blank — both draw findings; others do the analysis once and never maintain it. The bridge from 2015: the 4.1/4.2 framework is unchanged — add the climate call and ongoing monitoring on top and keep the existing skeleton.
Among the twelve commitments of 5.1.1 a)-l), a new i) requires promoting quality culture and ethical behaviour, and k) lists risk-based and opportunity-based thinking side by side; a new NOTE 2 adds that culture and ethics show up in shared values, attitudes and established practices. The substance: culture is part of leadership accountability and must land in behaviours and indicators, not posters. What auditors check: observable leadership behaviour — quality topics in routine meetings, named owners for culture indicators, records of how ethics issues were handled. The common trap: running one culture training and archiving it, or defining indicators that never reach departments and that nobody owns. The bridge from 2015: the rest of 5.1, the 5.2 policy and the 5.3 roles framework carry over — add the culture/ethics sections and matching assignments.
6.1 splits into 6.1.1 determining, 6.1.2 actions to address risks and 6.1.3 actions to address opportunities — risk actions proportionate to potential impact, opportunity actions suited to the context; 6.3 gives seven factors for planning changes, with communication, effectiveness monitoring/evaluation and results review now front-loaded; and 6.2 objectives remain an audit staple on measurability, monitoring and availability as documented information. The substance: opportunities must be systematically managed, no longer a footnote in the risk register. What auditors check: two separate registers, whether opportunities drive real improvement projects, and whether the latest change ran the seven factors with a post-evaluation record. The common trap: a register that spins idle — entries without closure; or post-evaluations that never feed back into the process. The bridge from 2015: 6.2 stands as-is and the 6.1 split is structural, so existing risk analyses migrate into the new frame.
7.1.6 organizational knowledge carries over from 2015 but upgrades to maintain, apply and, as necessary, share; 7.3 awareness adds understanding of the organizational quality culture and ethical behaviour; 7.5 stresses documented information being available where and when needed and suitable for use. The substance: knowledge must flow, and awareness must reach values, not just procedures. What auditors check: records of knowledge-sharing activities (mentoring, case libraries, offboarding handovers), whether floor staff can name concrete culture and ethics expectations, and whether up-to-date work documents are actually at hand. The common trap: a knowledge list refreshed yearly but never shared; awareness sessions handed out as slides with no quiz — attendance is not understanding; or superseded forms still printed on the floor. The bridge from 2015: the 7.1-7.5 subclause structure is unchanged, so upgrades are wording and content items — close them one by one.
The line-by-line conclusion: 8.2.1 e) is sharpened to providing information on contingency actions, including disruptions to the provision of products or services — sales needs one more notification line for disruption scenarios, the only real change in clause 8; 8.3 design outputs (acceptance criteria and essential characteristics), 8.4 direct delivery by external providers and 8.5 production control (incl. measures to prevent human error) all read close to 2015 — review-and-confirm points, not new requirements. What auditors check: customer-communication records in disruption scenarios, and floor evidence that 8.5 documented information is actually used — “available and used” existed in 2015, so the test is real usage. The common trap: rebuilding clause 8 processes as if they were new and burning budget; or ignoring the clause entirely and missing 8.2.1 e). The bridge from 2015: the 8.1-8.7 structure stands — verify references and wording item by item; this is the low-risk zone of your transition.
Two hard additions must land: 9.2.2 a) requires audit objectives, criteria and scope defined for each audit — an annual schedule of dates and departments no longer suffices; 9.3.2 c) adds changes in the needs and expectations of interested parties as a management-review input, with g)/h) splitting the effectiveness of risk actions and opportunity actions into two separate inputs; and 9.1.3 evaluates planning, risk-action and opportunity-action effectiveness separately under the split wording. The substance: not new processes but better use of data. What auditors check: whether the latest audit states its objective and reports against it, whether the review-input list carries the new row with real content, and whether 9.1.3 conclusions follow the split structure. The common trap: objectives phrased as “routine audit”; or reviews run on the old checklist with the new row left hollow. The bridge from 2015: the 9.1/9.2/9.3 frame is unchanged — additions, not a rebuild.
Clause 10 is renumbered: continual improvement moves up from old 10.3 to 10.1, nonconformity and corrective action follows as 10.2, and the old 10.1 general is deleted. 10.1 requires determining and acting on improvement opportunities based on analysis/evaluation results and management-review results — actions may include improving processes, addressing future needs, or correcting and reducing adverse effects. The substance: improvement needs real inputs, not only nonconformity tickets. What auditors check: clause references replaced site-wide, whether 9.1.3 and 9.3.3 outputs actually flow into 10.1, and whether corrective actions leave the 10.2 trail (cause review → action → effectiveness check → updating risks and opportunities as needed). The common trap: renumbering the manual only while procedures and forms still cite old numbers; or improvement stuck in reactive mode with no proactive evidence. The bridge from 2015: 10.2 content largely stands — the work is reference replacement and making improvement inputs explicit.
About 11 pages of structural, terminological and clause-level clarification (A.1-A.10) explaining the 2026 intent — A.6.1.1, for instance, states that risks and opportunities are distinct and can be determined and addressed through separate processes; the former Annex B content is folded into annex notes and the ISO/TC 176 website. For the first time ISO 9001 ships systematic supplementary guidance — a key benefit for new and existing users. The substance: Annex A adds no requirements, but it is the official reading of the standard. What auditors check: auditors themselves read the standard through Annex A, so training materials and audit checklists aligned with it cut communication cost and misjudgement. The common trap: shelving Annex A as reference material while internal auditors apply old-edition habits, drifting from the intended reading. The bridge from 2015: it is entirely new informative material — translate A.1-A.10 into your own language and keep the training evidence, and it has landed.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Clause-by-clause diff (2015 → 2026)A 17-row comparison you can paste straight into your transition plan and management-review deck; every row is a must-check at the 2026 audit — the four clause-8 refinements and both new clause-9 requirements are all in the table.
01Clause-by-clause diff (2015 → 2026)
| Clause | 2015 edition | 2026 edition |
|---|---|---|
| 5.1 Leadership | Leaders drive the process approach and continual improvement | 5.1.1 a)-l) twelve items: new i) promoting quality culture and ethical behaviour, k) risk-based and opportunity-based thinking side by side; new NOTE 2 — culture and ethics show up in shared values, attitudes and established practices. Action: assign owners and measures for i)/k) in the leadership procedure, put culture indicators on a dashboard and keep evidence of leadership behaviour |
| 5.2 Quality policy | Suitable to the organization’s purpose | Explicitly aligned with context (4.1) and strategic direction. Action: rewrite the policy intro to cite the strategy, and show the policy→objectives→performance chain at management review |
| 6.1 Risk & opportunity | Risks and opportunities addressed together | Reorganised into 6.1.1 determining risks and opportunities / 6.1.2 actions to address risk / 6.1.3 actions to address opportunities — opportunities get their own subclause. Action: manage risks and opportunities in separate registers, tying every opportunity to an improvement project with owner and due date |
| 7.3 Awareness | Know the policy, quality objectives, and one’s contribution to the QMS | Adds understanding of quality culture and ethical behaviour. Action: add culture and ethics case modules to awareness material, and file sign-ins, quizzes and communication records |
| 6.3 Change management | Plan changes and retain documented information | Changes must be communicated, monitored, evaluated, with results reviewed — legacy procedures lack the post-change review. Action: write the a)-g) seven factors into the change checklist, add a dedicated post-evaluation node and its record form |
| 7.1.6 Organizational knowledge | Maintain and make knowledge available | Maintain, apply and share knowledge to achieve QMS outcomes — a knowledge-flow mechanism is required (clause carried over from 2015; wording upgraded). Action: add mentoring / case-library / rotation-debrief / offboarding channels and keep activity records |
| 8.2 Customer communication | Establish requirements for contingency actions | Sharpened to “providing information related to contingency actions, incl. disruptions to provision” — customer notification now has an explicit entry point. Action: define the notification line and channel for disruptions, and test it once |
| 8.3 Design outputs | Meet inputs, adequate for processes, acceptance criteria and essential characteristics | Review-and-confirm: reads close to 2015 (outputs incl. acceptance criteria and essential characteristics). Action: map the 8.3.5 output requirements against your design-output documents and update clause citations to the new edition |
| 8.4 Externally provided | Includes delivery directly to customers by external providers | Review-and-confirm: the direct-delivery case already existed in 2015 b) — verify against the text. Action: check that purchasing and supplier-management documents cover and control the “delivery to customers on your behalf” case |
| 8.5 Production control | Documented information “available and used” | Review-and-confirm: “available and used” was already in 2015 — re-verify floor evidence of actual use. Action: spot-check whether operators know where the work documents are and actually use them — exactly what the auditor probes |
| 9 Internal audit | Conduct per plan, report results | Each audit must define its objective (9.2.2 a). Action: add a mandatory objective column to the audit plan, keep objectives specific (e.g. “verify the post-change review closed the loop”), and report against the objective |
| 9.3 Management review | Fixed input list | New input: changes in needs and expectations of interested parties (9.3.2 c), with risk/opportunity action effectiveness split into inputs g)/h). Action: add the row with a named owner; refresh the interested-party analysis quarterly as supporting material |
| 9.1.3 Analysis and evaluation | Effectiveness of risk and opportunity actions evaluated as one item | Split into d) effectiveness of planned arrangements, e) effectiveness of risk actions, f) effectiveness of opportunity actions. Action: issue the 9.1.3 evaluation in three sections matching the split, mapped to the 6.1.2/6.1.3 registers |
| 4.1/4.2 Context | Climate change not explicit | Climate-change considerations formally incorporated (carrying forward Amd1:2024). Action: add the climate dimension to your context analysis with a relevant/not-relevant call — not applicable only when argued and recorded |
| Documented information | Centred on “retaining documented information” | Shifts to an “availability” basis — less formality, more emphasis on access to information. Action: review the documented-information list, decide what relaxes to “available on demand” and what needs stronger access (culture indicators, opportunity-loop status), and keep the rationale |
| Annex | Informative annex + Annex B (sector guidance) | New Annex A (≈11 pages of concept clarification, A.1-A.10); Annex B removed. Action: translate A.1-A.10 into your own language for internal training with materials and sign-ins on file — auditors read the standard through Annex A |
| Terms & definitions | 2015 vocabulary, ISO 9000 as the normative reference | Clause 3 now lists 20 core terms (3.1-3.20) directly; quality-specific terms (QMS, quality policy, quality objectives) enter the text for the first time, ISO 9000 remains normative. Action: build a term-mapping table, review controlled-document wording against clause 3, and re-issue affected documents |
| High-level structure | Based on the Annex SL high-level structure | Uses the latest harmonized structure — closer alignment with 14001:2026/45001. Action: pre-wire interfaces for integration — dimension columns in shared documents and per-standard tags in registers, so each transition paves the way for the next |
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Gap checklist (tick off as you close)Thirteen executable actions, each with a clear “done when” definition — tick them off and your gap closure is complete; usable as-is as your transition project list.
01Gap checklist (tick off as you close)
- Give “quality culture” an operational definition: pick 3-5 observable behaviours (e.g. stop-the-line authority, nonconformity reporting rate) and 2-3 indicators (first-pass yield, rework / cost of quality, awareness survey), with measurement frequency and owners. Suggested lead: the management representative, with quality owning indicators and HR owning the behaviour list. Done when: the definition is in a controlled document, indicators are on a dashboard, and someone owns the data.
- Rewrite the quality-policy intro: cite strategic direction and 4.1 context explicitly. Suggested lead: top management finalizes, the system function drafts. Done when: the new policy is published with briefing and sign-off records.
- Split 6.1 into two registers: risks and opportunities managed separately. Suggested lead: the system function, with departments contributing entries. Done when: every opportunity links to an improvement project with owner and due date, and at least one has closed the loop.
- Upgrade 7.3 awareness material: add case-based modules on quality culture and ethics. Suggested lead: HR develops the course; the management representative reviews the messaging. Done when: everyone is trained, with sign-ins, quizzes and communication records filed.
- Add the climate analysis to 4.1/4.2: analyse impacts on interested parties and scope if relevant; record the assessment either way. Suggested lead: the system function or the ESG owner. Done when: the context document is updated and signed off.
- Run internal training against Annex A: translate the ≈11 pages of clarifications (A.1-A.10) into your own language. Suggested lead: the system function; internal auditors learn first, then teach. Done when: training is complete with materials and sign-in evidence.
- Site-wide terminology review: reconcile controlled documents against the 2026 terms (20 core terms in Clause 3). Suggested lead: document control, countersigned by process owners. Done when: a term-mapping table exists and affected documents are revised and re-issued.
- Review the documented-information list on the “availability” basis. Suggested lead: document control, with using departments stating needs. Done when: the list is updated with recorded rationale for each relax/strengthen decision.
- Consolidate change management: trigger, impact assessment, approval, verification, closure — evidence at every step. Suggested lead: the system function, with one pilot user each from production and R&D. Done when: the process is published and at least one real change in the last 6 months shows a full trail.
- Land the 7.1.6 knowledge-flow mechanism: add mentoring / case-library / rotation-debrief / offboarding channels on top of the knowledge list. Suggested lead: HR builds the mechanism; senior engineers as first sharers. Done when: the knowledge procedure includes sharing clauses and at least one sharing activity in the last 6 months has records.
- Add a mandatory “audit objective” column to the audit plan: one clear objective per audit (e.g. verify post-change closure, check the opportunity register). Suggested lead: the lead internal auditor maintains the plan. Done when: the plan is re-issued and the latest audit states its objective and reports against it.
- Add “changes in interested parties’ needs and expectations” to the review-input checklist: the system function maintains the updated analysis. Suggested lead: the system function supplies the input; top management decides at the review. Done when: the checklist is re-issued and the latest review covers it with decisions.
- Align internal audit and management review: re-cut checklists to the new clauses; add strategy alignment, culture and opportunity usage as standing management-review items. Suggested lead: the lead auditor re-cuts the checklist; the management representative sets the review agenda. Done when: the new checklist has run once and review outputs include decisions on all three new items.
How to run the gap analysis, in order (the order matters): Step 1, desk comparison — walk your manual and procedures against the clause-by-clause diff, marking each as met / partly met / not met; office work only, producing the draft gap list. Step 2, floor sampling — take the draft to the shop floor and check that what documents say matches what people do, focusing on change records, knowledge sharing and awareness training, the three places where paper is complete but practice idles. Step 3, interview verification — interview a few people at each level (top management on culture and policy, middle management on processes and registers, the floor on awareness and operations) to confirm real understanding. Only then set the ownership matrix and deadlines and sign off the gap-analysis report. Why the order cannot flip: interviews first bias you, and conclusions before floor sampling miss the gaps that never show on paper.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Controlled-document revision listRevision points for twelve controlled documents — follow the list and you have your document-revision plan; each row maps to a real 2026 change. All five must-revise procedures (change / audit / review / knowledge / opportunity) are on the list. How to use it: tick the applicable rows against your gap analysis first, then re-issue document by document along the six-step workflow at the end — issuing and training each as it lands, so the revision trail becomes the core document-level evidence at the transition audit; every row reads as “what changes + what must appear in the revised document”, ready to lift into a draft.
01Controlled-document revision list
| Document | Revision points |
|---|---|
| Quality manual | Add quality-culture / ethical-behaviour sections with expected behaviours and indicator definitions; cite Annex A as the concept baseline (an A.1-A.10 mapping table in the annex); update the document map and clause numbers per the new terms and the renumbered clause 10; record the 2026-edition publication basis on the manual’s version page so the auditor can trace why this re-issue happened |
| Quality policy (published) | Intro explicitly aligned with strategy and 4.1 context (one sentence each — no fluff); add briefing plan, sign-off sheet and communication-record templates so launch evidence is collectable from day one |
| Leadership process | Turn the new 5.1 requirements into auditable role descriptions: who measures culture indicators, who owns ethics topics, how engagement is fostered — each assigned to a role and frequency, with a minimum share of quality topics in leadership meetings |
| Risk & opportunity process | Split into two registers and two process lines: a 6.1.2 risk line (proportionality criteria) and a 6.1.3 opportunity line (identify → plan → implement → evaluate effectiveness); opportunities must link to improvement projects with closure requirements, and dropping one needs a recorded reason |
| Context analysis | Add the climate-change assessment and conclusion (record the reasoning either way); refresh the interested-party register and set the annual-update mechanism behind the new 9.3.2 c) review input |
| Awareness & training materials | Add culture and ethics case modules (real-scenario discussion beats reading clauses); include quiz and effectiveness-record templates, coverage tracked per department — so “understanding” is verifiable, not just attendance |
| Change-management procedure | Revise to the 6.3 closed loop: attach the a)-g) seven-factor checklist to change requests (communicate / monitor / evaluate / review results all mandatory), the key add being the post-evaluation node — review effectiveness 30-90 days after implementation, with a record form and a feedback-into-process clause |
| Organizational-knowledge procedure | Upgrade per 7.1.6: one section each for retain + apply + share, with the sharing channels fixed as mentoring / case-library / rotation-debrief / offboarding, plus activity record forms, frequency requirements and an offboarding handover template |
| Opportunity-management procedure (new) | Most 2015 systems have no dedicated procedure; build identify → plan → implement → evaluate effectiveness, write the six fixed intake sources into the procedure (customer input / supplier review / audit / review / market & regulation monitoring / staff proposals), backed by the nine-field opportunity register (see its dedicated doc) |
| Audit-plan and review-input templates | Add the mandatory objective column to the audit plan (objectives must be specific — no “routine audit” filler — with two example phrasings); add the interested-parties row to the review-input checklist with a named maintaining function and its deliverable |
| Internal-audit checklist & programme | Re-cut the checklist to the new clauses; make 5.1/5.2/6.1/7.3/change management mandatory items with sampling guidance (how many people, which records, what to interview); mark in the annual programme which audit carries the transition checkpoints, and confirm that audit’s objective is defined per 9.2.2 |
| Management-review agenda + glossary | Add strategy-alignment, culture and opportunity items as standing agenda points (each with a presenter); update and control the glossary against the 20 core terms of 2026 clause 3, marking superseded definitions as void |
The six-step document-revision workflow (keep evidence at every step — on audit day this is your “revisions under control” trail): 1) change request — state the driver (which 2026 change) and the blast radius; document control logs the number; 2) drafting — revise per the points, mark the issue level and attach an old/new clause mapping; 3) review — cross-functional sign-off focused on interface consistency (a revised procedure forces its checklist and record forms to change too); 4) approval — sign per the authority matrix, verifying clause references are replaced site-wide first; 5) distribution — controlled issue and old-copy withdrawal completed the same day, void-stamped supersessions; 6) training sign-off — brief everyone within the deadline and file sign-ins and quiz records. Miss one step and the auditor will ask how this document was ever controlled. Sequence the twelve documents by blast radius: the manual and the five procedures first, templates and checklists next, the glossary last as the final sweep.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
The five must-revise procedures (before → after)The five procedures most often missed in transition document work, each with the before wording, the after wording, at least three items to write into the revised procedure, and a practical tip — revise one by one and the bulk of your procedure transition is done.
01Procedure revision comparison (5 documents)
| Procedure | 2015 practice | 2026 requirement (after) | Action |
|---|---|---|---|
| Change management (6.3) | Before: plan changes and retain records; changes get archived once done, with no post-evaluation and no effectiveness check | After: all seven 6.3 factors a)-g) considered — purpose and consequences, impact on QMS integrity, availability of resources and information, reallocation of responsibilities, communication, effectiveness monitoring/evaluation, results review; post-evaluation becomes mandatory, and its conclusions must feed back into the process | Write in at least three: 1) the seven-factor checklist as an attachment to change requests; 2) a post-evaluation node (30-90 days after implementation) with its record form; 3) a results-review and feedback-into-process mechanism. Tip: pilot the full flow on one low-risk change and keep the pilot trail as your first evidence |
| Internal audit (9) | Before: an annual plan and audits against criteria; objectives not defined per audit, reports written as loose narrative | After: 9.2.2 a) requires audit objectives, criteria and scope defined for each audit — specific to what that audit verifies, with impartial auditor selection and prompt corrective action | Write in at least three: 1) the mandatory “audit objective” column in the plan; 2) wording requirements for objectives (no “routine audit” filler) with example phrasing; 3) reports must conclude against the objective and state whether it was met. Tip: template the objective as “verify / check + object + what is judged”, and run the very first new-edition audit on it |
| Management review (9.3) | Before: periodic reviews on a fixed input list, outputs often lacking trackable decisions | After: 9.3.2 inputs become a “shall include” list, adding c) changes in needs and expectations of interested parties, with g)/h) splitting risk-action and opportunity-action effectiveness into two inputs; outputs must carry improvement decisions and change/resource needs | Write in at least three: 1) the new input row with a named owner and deliverable; 2) a standing “quality-culture status” agenda item; 3) numbered output decisions tracked to closure. Tip: have the system function refresh the interested-party analysis quarterly and finalize it a week before the review — never drafted live in the meeting |
| Organizational knowledge (7.1.6) | Before: a knowledge list, maintained and made available — knowledge sits still | After: 7.1.6 upgrades to maintain, apply and, as necessary, share; when facing changing needs and trends, assess existing knowledge and determine how to obtain or access additional knowledge — knowledge must flow | Write in at least three: 1) the channel list (mentoring / case-library / rotation-debrief / offboarding) with frequencies; 2) sharing-activity records with applied outcomes; 3) a knowledge-gap assessment clause (when, who, what). Tip: start with the offboarding handover template — fastest to show value and easiest to evidence; map critical roles first and tailor the template per role. |
| Opportunity management (6.1, new) | Before: usually no dedicated procedure — opportunities buried in the risk register, relying on individual inspiration | After: 6.1.3 gives opportunities their own subclause — determine, analyse and evaluate, plan actions and evaluate effectiveness, actions suited to the context; opportunities are systematically managed and drive improvement | Write in at least three: 1) the identify → plan → implement → evaluate flow with records per node; 2) the nine-field register (description / source / action / due date / owner / status / effectiveness / state); 3) six fixed intake sources with defined entry points. Tip: enter two real opportunity examples before publishing — auditors probe “a procedure with no cases” |
Note: four of the five are upgrades to existing procedures; only opportunity management is a brand-new document — do the upgrades first (low resistance, fast wins), then focus on the register. Suggested order: change management first (the seven factors plus post-evaluation are the hardest new requirements), then audit and review (template changes, effective immediately), then knowledge, with opportunity management last. Issue and train each procedure as it is revised instead of batching re-issues — a batch creates a window between “procedures changed” and “people trained”, exactly where transition auditors like to dig. On each re-issued revision page, cite the 2026 clause it implements, so an auditor checking document-level coverage sees the mapping at a glance.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
The opportunity register (making the 6.1 split real)After the 6.1 split, opportunities must be systematically managed — nine register fields, two worked examples, identification sources and the effectiveness-evaluation standard, all in one place. This is the positive answer when auditors find “risks everywhere, opportunities nowhere”.
01Opportunity-register fields (9 columns)
| Field | How to fill it | Example |
|---|---|---|
| Description | One line on the opportunity and its expected benefit — no fluff; a good description lets an uninvolved colleague see what the chance is and what success yields | Customers want digital traceability — roll out online inspection |
| Source | Customer input / supplier review / audit / review / market & regulation / staff ideas — cite the concrete intake (which review, which monitoring report) to show opportunities come from the mechanism, not luck | Customer communication |
| Action | Concrete actions — never “keep monitoring”; each action must be startable and checkable, ideally opening with a verb (evaluate / develop / pilot / roll out) | Evaluate MES integration options |
| Due date | A real date; split long items into stage milestones — an opportunity without a date is not an opportunity, and milestones give quarterly reviews something to grip | (set by quarter) |
| Owner | A single accountable person or function — “shared across departments” means nobody owns it; partners belong in the action cell, not the owner cell | IT function |
| Implementation status | Stage progress, traceable to records — state which batch is verified or which review step is done; an auditor following your description should be able to pull the matching records | Options being evaluated |
| Effectiveness evaluation | Mandatory before closure: did the action deliver, with data — compare cost, delivery, yield or order metrics before and after; no baseline, no evaluation | Pending (required before closure) |
| Status | Open / done / closed / dropped (with a reason) — no fifth vague state; dropped entries get a consolidated re-check at the quarterly review | Open |
02Two complete worked rows (manufacturing scenarios, copy to get started)
| Field | Example 1: raw-material inflation → supplier development | Example 2: customer low-carbon demand → product-line upgrade |
|---|---|---|
| Description | Key material prices keep rising — develop alternate suppliers and materials early to lock cost and cut supply-disruption risk | Several customers ask for low-carbon products — upgrade the line to build a green selling point and pricing headroom |
| Source | Supplier review + market monitoring (cite the triggering review) | Customer communication (name the accounts and the feedback round) |
| Action | Qualify a second source with pilot runs; assess feasibility of the alternative material in parallel | Evaluate a low-carbon redesign (material substitution / process energy cuts) and draft the upgrade roadmap |
| Due date | Two stages: verification Q2, rollout Q3 | Roadmap finalized Q3, project chartered Q4 |
| Owner | Purchasing (named person) | R&D (named person) |
| Implementation status | Second-source samples in verification; alternative-material assessment started | Customer asks compiled; technical feasibility under evaluation |
| Effectiveness evaluation | Required before closure: procurement cost and on-time delivery before vs after rollout | Required before closure: order share and margin of the low-carbon line |
| Status | Open | Open |
03Operating rules (the four things auditors verify)
- Fixed intake channels: customer input, supplier reviews, audit findings, management review, market/regulation monitoring, staff proposals — six defined entry points with frequencies, so opportunities never depend on one person’s inspiration; name an intake owner per channel, with the system function screening entries within a week to complete the fields.
- A second worked example: “localize supply to cut disruption risk | source: supplier review | action: qualify a second source with pilot runs | owner: purchasing | status: second source onboarding | effectiveness: pending”.
- Closure rule: every opportunity links to an improvement project; a row without its effectiveness evaluation cannot be marked closed — exactly the “opportunities drive improvement” evidence the 2026 edition wants.
- Hook into audit and review: schedule one internal-audit objective to “verify the opportunity register works”, and include “opportunity-management results” in the management-review inputs.
Note: if the register genuinely has no entries, record “assessed — no applicable opportunities” with the assessment process and conclusion — a not-applicable call is allowed only when argued, mirroring the 4.1 climate-change treatment.
Register review cadence: review quarterly — walk each entry’s progress, refresh statuses, escalate overdue items to management, and re-check dropped ones; at the annual management review, report “opportunity-management results” (closure rate, realized gains) as a standing input, feeding the split 9.3.2 h) input on the effectiveness of opportunity actions. A thirty-minute stand-up is enough, but minute it — when the auditor asks who runs the register and how often it is reviewed, this is your answer.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
What the auditor will probe at the transition auditThe eight questions most likely on transition-audit day, with an answer-card method — for each, the form of evidence the auditor is really listening for.
01What the auditor will probe at the transition audit
- Probe: can leadership state what “quality culture” concretely means here and how it is measured? Why they ask: the new 5.1 turns on behavioural evidence, not paperwork — auditors want to confirm culture is not a values poster. A good answer: leadership quotes 3-5 observable behaviours and current values of 2-3 indicators, with who measures and how often. Evidence to show: the culture-indicator dashboard export and quality topics in leadership meeting minutes.
- Probe: is there documented or minuted evidence the policy aligns with strategic direction? Why they ask: 5.2 requires the policy to reference context and strategy explicitly — alignment without evidence is not alignment. A good answer: you point on the spot to the strategy-referencing passage and trace how it cascades into quality objectives. Evidence to show: the new policy text, the policy→objectives→performance passage in review minutes, briefing sign-off sheets.
- Probe: are risks and opportunities managed separately, and did opportunities actually drive improvement? Why they ask: after the 6.1 split opportunities must be systematically managed — “risks everywhere, opportunities nowhere” is the most common finding. A good answer: one full story from a register entry to a closed improvement — where it came from, who owned it, what was done, what it yielded. Evidence to show: the two separate registers and at least one closed case file with effectiveness data.
- Probe: do employees understand quality culture and ethics, not just recite the policy? Why they ask: the new 7.3 e) requires understanding — read-aloud briefings do not count. A good answer: floor staff say in their own words what they do first when hitting a quality problem (report, stop the line, who decides) and how to escalate. Evidence to show: awareness sign-ins and quiz papers plus interview outcomes — the auditor will chat with people regardless, so be ready.
- Probe: has one change in the last 6 months gone through the new flow? Show the full trail. Why they ask: the 6.3 seven factors are hard requirements — auditors verify the flow runs, not that it was published and filed. A good answer: narrate one change end to end — trigger, seven-factor assessment, approval, implementation, post-evaluation, and what the evaluation changed. Evidence to show: the change request with the seven-factor checklist, approval records, the post-evaluation form.
- Probe: how was climate change handled in 4.1/4.2? Why they ask: 4.1 requires an explicit relevance call — “we never looked at it” is a nonconformity. A good answer: state the conclusion and reasoning — if relevant, the impact on delivery, cost and compliance plus the response; if not, still walk through the assessment. Evidence to show: the climate-assessment page in your context analysis (with the argument) and climate-related expectations in the interested-party register.
- Probe: did Annex A’s clarifications land in training? Why they ask: auditors read the standard through Annex A — if internal auditors still apply old-edition habits to new clauses, your system reading drifts. A good answer: any internal auditor or team lead can explain what at least one A.1-A.10 concept means in your organization (e.g. why risks and opportunities are handled separately). Evidence to show: Annex A training materials, sign-in sheets, quiz papers and coverage statistics.
- Probe: is ethical behaviour anchored in a mechanism? Why they ask: NOTE 2 ties ethics to established practices — auditors look for mechanisms and records, not slogans. A good answer: demonstrate one complete flow from report to resolution, including an anonymous path and anti-retaliation protection, ideally with a real (sanitized) case. Evidence to show: the channel description, handling records, and the protection arrangements for reporters.
02Answer-card preparation (one page per probe)
- Write one answer card per probe: a one-line conclusion + evidence index (document/record numbers) + owner + data source — on audit day, landing on evidence within three sentences beats ten minutes of explaining.
- Bind evidence by clause number into a “transition evidence pack” — anything findable within 30 seconds on audit day; the clause index page sits on top, and the electronic pack mirrors the same structure.
- Rehearse one interviewee per level (top / middle / floor), consistent but not scripted — auditors spot rehearsals instantly.
- For unfinished items, bring a remediation plan (milestones + owners); honesty beats concealment — transition audits allow plans, not hiding.
- Walk the inspection route in advance: shop floor, records room, training room — 2-3 staged “show this” points per stop.
- Carry the gap-analysis report — it is the first piece of evidence an auditor uses to judge your transition maturity.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Milestone timeline (back-planned from the 2029-09-30 cutoff)Five back-planned milestones, each with a “deliverables at this node” list — copy straight into your project tool.
01Milestone timeline
| Milestone | Action |
|---|---|
| 2026-09 published | Buy the standard; brief top management (use the changes doc); start the gap analysis (use the checklist); and confirm in writing with your certification body their transition arrangements and which audit will carry it — the earlier these are locked, the less leverage you lose later. |
| T-24 mo (≈2027-09) | Close the gap analysis with sign-off (ownership matrix and deadlines included); start document revisions per the list, the five must-revise procedures first; put culture indicators on a dashboard; start the opportunity register. |
| T-12 mo (≈2028-09) | Complete awareness training (Annex A internals incl. auditor retraining); run one internal audit on the new edition; close at least one opportunity loop; land at least one real change through the seven-factor flow within the last 6 months. |
| T-6 mo (≈2029-03) | Run a full internal audit + management review on the new edition (decisions on the three new items); close findings; issue the 9.1.3 evaluation under the split wording; assemble and clause-index the evidence pack. |
| T-0 (cutoff 2029-09-30) | Complete the transition audit and re-issue to the 2026 edition; the old certificate lapses with no fallback. If a surveillance or recertification visit carries the transition, lock the date and audit team with the certification body three months ahead. |
02Deliverables at each node
- Gap-analysis report (management-signed, with clause-level gaps, ownership matrix and closure plan) — before T-24; the first piece of evidence an auditor uses to judge your transition maturity.
- Revised controlled-document pack + briefing records (evidence kept at all six workflow steps: request / draft / review / approve / distribute / training sign-off) — re-issued before T-18.
- Training files (Annex A materials, sign-ins / quizzes / communication records, coverage 100% tracked per department) — before T-12.
- New-edition internal-audit report (per-audit objectives stated) + management-review decisions (covering the three new items) + the 9.1.3 evaluation under the split wording — before T-6.
- Transition evidence pack (clause-indexed, paper and electronic mirroring) + the eight answer cards — finalized before T-0.
03Official transition rules at a glance (Global ACI-TECH-3-TR 2029-09-30 (M))
- The official transition-audit scope: the changed requirements of the 2026 edition (vs the previous), changes to your context, and any other needed system changes — organize your evidence under these three and nothing is missing.
- The transition audit can ride on a surveillance or recertification visit or run standalone; it may be conducted remotely via ICT (IAF MD 4 / Global ACI TECH-3-003) if objectives are demonstrably met — remote is a legitimate option, not a compromise.
- Extra audit time is “possible”: the CB must justify any addition per ISO/IEC 17021-1 and IAF MD 5 (TECH-3-004), considering at minimum the degree of system change and whether it rides the annual audit; a full system audit may need none — ask for the justification before accepting a surcharge.
- Decline to transition and the certificate lapses at the end of the transition period (2029-09-30), possibly before the full certification cycle runs out — the CB may shorten the validity; the system keeps running but a lapsed certificate costs you tender and compliance eligibility.
- If your certification body opts out: it must notify all affected clients in writing by 2027-06-30 (validity and consequences included) — treat such a notice as the trigger to switch bodies immediately, not in the final year.
Why the transition audit should ride a surveillance or recertification window: Global ACI-TECH-3-TR states the transition audit may be conducted with the organization’s surveillance or recertification audit, or as a separate special audit. Riding the annual visit wins three ways: fewer audit days — extra time is only “possible”, and the official note says a full system audit may need none, leaving the least justification room when combined; less preparation — the surveillance visit already assembles system-running evidence, and the transition checkpoints (changed requirements, context changes, other needed changes) fold into the same evidence pack; and scheduling leverage — slots tighten toward the end of the transition period, and a late booking risks landing after 2029-09-30, when the old certificate lapses with no fallback. Bottom line: confirm in writing, in your annual CB communication, which surveillance visit carries the transition.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Evidence-prep checklist for transition-audit dayEight evidence classes, each with what it must contain, the common gaps and how to present it on audit day, plus a clause-indexed pack structure — archived early, retrievable in 30 seconds, nothing hunted for live.
01Evidence-prep checklist for transition-audit day
- Gap-analysis report — must contain: clause-by-clause 2015→2026 gap descriptions, ownership matrix, closure plan and a management sign-off page. Common gaps: no status refresh after issuance, or a sign-off page without top-management signature. On audit day: first layer of the pack — auditors judge your maturity from it first, so know your refresh cadence too; for open items, be able to turn straight to the remediation plan page.
- Revision history of revised controlled documents — must contain: revision pages, approval records, issue/withdrawal logs, void stamps and an old/new clause mapping. Common gaps: old copies never withdrawn, missing void stamps, or superseded forms still circulating on the floor. On audit day: binder ordered by document number — any document sampled closes its history chain on the spot, with withdrawal logs showing names and dates.
- Culture-indicator dashboard export — must contain: trend charts for first-pass yield, rework / cost of quality and awareness surveys, management commentary, plus indicator definitions and owning departments. Common gaps: undefined indicators, or data never discussed in any meeting. On audit day: show the commentary pages from the last two reviews to prove leadership actually reads and uses it, with a one-page definitions note at hand so you never improvise an indicator meaning — and a one-line explanation for any anomaly in the trend.
- Opportunity-to-improvement case file — must contain: the full chain from a register entry to project initiation, verification and closure, with effectiveness data and baseline comparison. Common gaps: entries stuck “open” with no closure, empty effectiveness cells. On audit day: walk one closed case end to end, then show the full register to prove it is not a one-off — and be ready to say where the baseline numbers came from.
- Training & awareness evidence — must contain: Annex A training materials, sign-in sheets, quiz papers, communication artifacts and per-department coverage statistics. Common gaps: coverage below 100%, or sign-ins without quizzes — attendance is not understanding. On audit day: archive by department so any named employee’s full record can be pulled on request; keep a catch-up plan for new hires and transfers too.
- Policy-launch evidence — must contain: the new policy, briefing records, sign-off sheets and minutes excerpts showing strategic alignment. Common gaps: no all-staff briefing after the rewrite, or no policy→strategy passage findable in the minutes. On audit day: present policy text, sign-off sheets and minutes excerpts on one spread, mapped to 5.2 point by point; keep sign-off coverage consistent with the training-file numbers — never two conflicting figures.
- Change-management case — must contain: at least one real change with all five steps documented (trigger → impact → approval → verification → closure), plus the seven-factor checklist and the post-evaluation form. Common gaps: a missing post-evaluation — changes archived once done, the most widespread legacy hole. On audit day: narrate the timeline page by page, letting evidence follow the story; if the post-evaluation changed the process or forms, show the before/after too.
- Audit & review outputs — must contain: internal-audit reports against the new clauses (per-audit objectives stated), closed nonconformities, and management-review decisions covering the three new items with an action-tracking log. Common gaps: reports not structured around the objective, or decisions without a tracking column. On audit day: lay out the report cover and review decisions together, with decision numbers matching the tracker one to one — and quote the closure rate of the previous meeting’s decisions on the spot.
A clause-indexed structure for the evidence pack: top level split by clauses 4-10 and Annex A (4 context / 5 leadership / 6 planning / 7 support / 8 operation / 9 performance / 10 improvement / A Annex-A training); second level by evidence type (reports / records / training / minutes / dashboard exports); every file named with a clause prefix and date (e.g. 6.3-post-change-review-2028Q2). A one-page index lists “clause → evidence file number → location → owner”, so any clause number quoted by the auditor lands on the right page within 30 seconds. Maintain paper and electronic packs in parallel with the same structure — for a remote transition audit, screen-sharing the electronic pack switches over at zero cost. Keep the binder order identical to the gap-analysis clause order, so an auditor jumping from the gap report to the evidence never re-learns the layout.
A LabKitPro transition working document, compiled from public ISO/BSI guidance (references, titles and paraphrases only — no verbatim standard text), for planning and internal-audit use. Formal requirements are governed by the purchased standard text and your certification body’s interpretation.
Frequently asked questions
When was ISO 9001:2026 published?
ISO 9001:2026 was published on 16 September 2026 — the first full revision since ISO 9001:2015.
What is the ISO 9001:2026 transition deadline?
Certificates to the 2015 edition can be issued until 31 March 2028; after that only the 2026 edition is issued. Every certified organization must complete the transition by 30 September 2029.
What changed in ISO 9001:2026 vs 2015?
Key changes sit in organizational context (new climate-change consideration), leadership and governance, and supply-chain resilience; the clause structure remains Annex SL. The detailed clause-by-clause diff is in the pack on this page.
Do I need to recertify from scratch?
No. Transition happens within your existing certification cycle — typically at your next surveillance or recertification audit, as a transition audit. You do not start over.
How long does the ISO 9001:2026 transition take?
Most organizations need 3–9 months: gap analysis, updating the manual and procedures, training, an internal audit, a management review, then the transition audit. Starting early avoids the 2028–2029 rush.
Lock all your cutoffs with the free compliance calendar
Drop the 9001 / 14001 / 45001 transition cutoffs, surveillance and recertification nodes into one calendar with automatic reminders.
Open compliance calendar