ISO 9001 explained | DSQA Consultants

What ISO 9001 is

ISO 9001 sets out what a quality management system needs so that an organisation can deliver products and services that meet customer and legal requirements consistently, and keep getting better at it. It works for any size of organisation in any sector.

What changed in ISO 9001:2026

Quality culture and ethical behaviour are now part of the requirements, especially for leadership (clause 5.1) and staff awareness (clause 7.3).
The quality policy is tied more explicitly to the organisation's context and strategic direction (clause 5.2).
Risks and opportunities are now treated separately, with their own actions, instead of as one combined topic (clause 6.1).
Requirements for planning and managing changes to the quality management system have been strengthened.
Clause 3 now includes a small set of core management system terms. ISO 9000 remains the main vocabulary.
Annex A has been rewritten to explain the structure, terms and intent of the requirements. It adds no new requirements.
Annex B, which listed other quality standards, has been removed.
The climate change consideration added by the 2024 amendment is carried forward, and the standard uses the latest Harmonized Structure, so it lines up with ISO 14001, ISO 45001 and other management system standards.

The clause structure, the process approach, customer focus, risk-based thinking and continual improvement all stay. If you already run an ISO 9001:2015 system, you are updating it, not starting again.

Transition timeline for certified organisations

From 31 March 2028, new and initial certificates can only be issued to ISO 9001:2026.
Organisations certified to ISO 9001:2015 have until 30 September 2029 to move to the 2026 edition, at a surveillance or recertification audit or a separate transition audit.
Your certification body will confirm how and when it will assess your transition.

Free ISO 9001:2026 transition checklist

A clause-by-clause list of what to review when you move from the 2015 edition.

Get the checklist

Clause-by-clause summary

Like other ISO management system standards, ISO 9001 follows the Harmonized Structure. Clauses 1 to 3 cover scope, references and terms. The requirements are in clauses 4 to 10, summarised below in our own words.

4 Context of the organization

Understand the internal and external issues that affect your quality results, including climate change where relevant, work out who your interested parties are and what they need from you, set the scope of the system and define the processes it covers.

5 Leadership

Top management owns the system. It sets a quality policy that fits the business strategy, builds a culture where quality and ethical behaviour matter, keeps the focus on customers and makes sure roles and responsibilities are clear.

6 Planning

Decide which risks to address and which opportunities to pursue, and plan actions for each. Set measurable quality objectives with plans to achieve them, and plan any changes to the system in a controlled way.

7 Support

Provide the people, infrastructure, work environment, measuring equipment and knowledge the system needs. Make sure people are competent and aware of the policy, objectives and quality culture, communicate clearly and control your documents and records.

8 Operation

Plan and control the work that delivers your products and services: agreeing customer requirements, design and development where it applies, controlling external providers, delivery, release and dealing with anything that doesn't conform.

9 Performance evaluation

Decide what to monitor and measure, including customer satisfaction, analyse the results, run a planned internal audit programme and hold management reviews that lead to decisions.

10 Improvement

Deal with nonconformities, fix their causes so they don't come back, and keep improving how well the system works.

Documented information you'll usually need

The standard expects you to keep certain information documented (maintained) or as records (retained). This is our summary of what's commonly expected. Use it as a starting point and add anything else your organisation needs to run the system well.

Scope of the quality management system
Quality policy
Quality objectives
Information needed to support the operation of processes, and evidence they ran as planned
Evidence that monitoring and measuring resources are fit for purpose, and the basis for calibration
Evidence of competence
Results of reviewing customer requirements for products and services
Design and development records, where design applies
Records of evaluating, selecting and monitoring external providers
Traceability records, where traceability is required
Records about customer or external provider property that is lost or damaged
Results of reviewing changes in production or service provision
Evidence that products and services were released, and who released them
Records of nonconforming outputs and the action taken
Results of monitoring, measurement, analysis and evaluation
Internal audit programme and audit results
Results of management reviews
Nonconformities, corrective actions and their results

How certification works

Certification is optional. If you want it, an independent certification body audits your management system and decides whether to issue a certificate. In the UK, check that the certification body holds UKAS accreditation for ISO 9001.

DSQA Consultants isn't a certification body and doesn't issue certificates. Our toolkits and virtual support help you prepare for certification.