ISO 9001:2026 is published. Your transition to it is a planned change — and almost nobody will manage it as one.

By Vaibhav Rane, Founder, Cresolv One

On 16 September 2026, ISO published the sixth edition of ISO 9001, developed by ISO/TC 176/SC 2. If you hold a certificate, you now have a transition in front of you.

The clause summaries are everywhere already, so this is the short version, followed by the part I think matters more: not what changed, but how you are about to make the change.

What changed, briefly

Evolution rather than revolution. Requirements clarified, supplemented and put in context rather than rewritten. The structure retains the Harmonized Structure, so it still sits cleanly alongside 14001, 45001 and the rest.

• Clause 5.1.1 — quality culture and ethical behaviour. Top management is now explicitly expected to promote both, and the leadership commitments list grows accordingly. Opportunity-based thinking now sits alongside risk-based thinking here too.
• Clause 5.2 — the quality policy and strategy. The 2015 edition already asked the policy to support the organisation’s strategic direction. The 2026 edition presses harder: alignment to context and strategy is meant to be explicit rather than implied.
• Clause 6.1 — risks and opportunities pulled apart. New subclauses separate actions to address risks from actions to address opportunities. Threats and potential, treated as different disciplines.
• Clause 6.3 — planning of changes, expanded. More to consider than in 2015: communicating changes, monitoring and evaluating them, and how they will be reviewed.
• Clause 7.3 — awareness. People now have to be aware of the organisation’s quality culture and ethical behaviour, not only the policy and their contribution.
• Clause 4 — context. Minor edits, but the climate-change consideration introduced by the 2024 amendment is carried forward, and there is a sharper expectation that you decide which interested-party requirements you will actually address through the QMS.
• Clause 3 and Annex A. More QMS terms defined inside the standard rather than by reference to ISO 9000; Annex A substantially expanded into clause-by-clause guidance. It is informative — it explains how requirements are meant to be read, it does not add obligations.
• Clauses 8, 9 and 10 — light. Terminology and layout mostly. Worth noting: Clause 8.1 broadens “outsourced processes” to externally provided processes, products and services, and Clause 10 consolidates from three subclauses to two.

There is no AI-specific requirement in the 2026 edition. How AI shows up in your organisation is a context and strategy question, not a compliance checkbox.

And one pervasive edit that is not on anyone’s headline list: the “maintain / retain documented information” phrasing has been reworked across a dozen or so clauses. Individually trivial. Collectively, it means a lot of your manual is about to be edited.

The part that matters more

Hold that last point, and look again at Clause 6.3.

Planning of changes is not new — it was in the 2015 edition, and it asked you to consider the purpose of a change, its consequences, the integrity of the system, and resources. What the 2026 revision does is widen that list: now also communication, monitoring, evaluation, and review.

Now name the largest planned change your quality management system will make over the next three years.

It is the transition to ISO 9001:2026.

I do not think that is a clever debating point. It is a straightforward observation that almost every organisation is about to make a substantial, system-wide change to a live certified management system — and to run that change outside the very process their own standard gives them for exactly this situation.

Clause 6.3 has been sitting there since 2015. Very few transitions in 2016 and 2017 went through it. I would expect the same again.

How this usually goes

The default transition is a document exercise. Someone buys the standard, opens the manual, and works through it: renumber the clause references, insert a paragraph on quality culture, split the risk register into two, update the policy wording, sweep through the documented-information phrasing. A few weeks of careful editing. Version 6.0 issued. Distribution list notified.

Every one of those edits is correct. The problem is that collectively they are an unmanaged change to a certified system, and there is usually no record of:

• why each change was made, and which clause drove it
• who approved it, and against what
• what else it touched — the procedures, forms, training material and audit checklists downstream of the document that just changed
• whether anyone was genuinely told, beyond a file appearing on a shared drive
• whether it worked — whether the change achieved what it was meant to

Then the transition audit arrives. The auditor has an Annex A that now explains, clause by clause, how the requirements are meant to be interpreted, and a Clause 6.3 that asks more questions than it used to. And the first thing in front of them is a management system that was substantially rewritten without a change record.

You can pass that audit. Plenty of organisations will. You will just spend the visit reconstructing intent from memory, which is the most expensive way there is to spend an audit.

Run the transition as a management of change

The fix is not more effort from already-stretched people. It is treating the transition as what it structurally already is: a change, managed.

In practice:

1. Raise the transition as a single change request — scope, owner, target date. Not a task list. A change record.
2. Attach the gap assessment to it. Each gap becomes a child action linked to the clause that drove it. When an auditor asks why section 4.2 was rewritten, the answer is a record rather than a recollection.
3. Assess impact before editing anything. A change to the quality policy reaches awareness training, induction packs, notice boards and the management review agenda. Map that first — you will find items nobody would have remembered.
4. Route approval to the people who own the affected processes, not only the MR who drafted the edit.
5. Communicate deliberately, and log that you did. Clause 7.3 now expects awareness of quality culture and ethical behaviour. Awareness is auditable. “It is on the shared drive” is not evidence of it.
6. Verify effectiveness, then close. Put the new clauses into your internal audit plan and test whether the change actually landed — before your certification body does it for you.

That is a closed loop. It is also, almost exactly, what your CAPA process already does for a nonconformity. There is no good reason the largest planned change your system will make this decade gets a weaker process than a minor NCR.

The two changes you cannot edit your way through

Most of the 2026 deltas close with careful writing. Two do not.

Quality culture and ethical behaviour (5.1.1 and 7.3) is not a document. An auditor testing it will not read your policy. They will ask someone on the floor what happens when they raise a quality concern, and whether anyone has ever been discouraged from stopping the line. There is no version of that you can write your way to in the six weeks before a surveillance visit.

Risks and opportunities as separate disciplines (6.1) will be uncomfortable for any organisation whose risk register has only ever contained threats. Splitting the register takes an afternoon. Having a populated, owned, reviewed opportunities process takes a year of practice.

Both are cultural. Both are slow. Both are why a transition begun as an administrative exercise late in the window goes badly.

On the deadline

Three years. ISO’s own guidance is unambiguous: organisations certified to ISO 9001:2015 have three years to move to the 2026 edition, which puts the line in September 2029.

Two things are worth knowing anyway.

First, a naming point that matters if you are reading transition guidance: the binding accreditation rules no longer come from the IAF. The IAF and ILAC merged on 1 January 2026 into Global Accreditation Cooperation Incorporated. Certificates issued under the former arrangements stay recognised, but material still citing “the IAF resolution” for the 2026 transition is working from an out-of-date name — worth checking the date on anything you are relying on.

Second, certification bodies have to be trained and accredited against the new edition before they can audit you to it. Realistically that runs well into 2027, and most transitions will be folded into a routine surveillance or recertification visit rather than a separate audit. So the three years is real, but the number of audit slots inside it that are actually yours is smaller than it looks.

Plan to the date. Do not plan to the last month of it.

The thing to do this week

Open your change control process — MOC, change request, whatever you call it locally — and ask one question:

If we ran the ISO 9001:2026 transition through this, would it survive?

If the honest answer is that the transition is going to happen in a document instead, you have found your first gap. And it is not in Clause 5.

Cresolv One’s ISO Audits & Compliance platform connects audit findings, NCRs, CAPA, MOC, risk and management review in a single system — so a change request carries its impact assessment, approvals, communication record and effectiveness check with it, instead of being assembled afterwards.

So the question worth sitting with: when your organisation moved from ISO 9001:2008 to 9001:2015, was there a change record for it — or just a new revision of the manual?

Run your transition under change control: explore ISO Audits & Compliance — or see where you stand with the readiness assessment.