ISO 9001:2026 vs 2015: what has changed, clause by clause
A summary of the changes in the new edition of the standard, with a table of clauses and a hint on what to do in your system. No scaremongering about new documents the standard does not require.
ISO 9001:2026 was published on 16 September 2026 and replaces the 2015 edition together with the 2024 climate amendment. The good news for companies with a working system: this is an evolution, not a revolution. The clause structure stays, most requirements read much the same, and there are no new mandatory documents. What does change is a handful of emphases that the auditor will check in conversations with people, not in a binder.
Below I have collected the changes confirmed by several independent sources, above all certification bodies that have discussed the published text. The Polish translation of the standard (PN-EN ISO 9001:2026) is not yet available, so during implementation always work from the original text rather than from summaries.
The essentials in brief
- The layout of clauses 4 to 10 stays unchanged, in line with the harmonised structure for management system standards.
- The new emphases are quality culture and ethical behaviour, for which top management is responsible.
- Risks and opportunities now sit in separate clauses. A formal method or a risk register is still not required.
- Planning of changes has more factors to consider, and management review has a mandatory set of topics.
- Clauses 10.1 and 10.3 have been merged, and the explanatory annex is considerably longer.
- The transition period lasts three years. Certificates to the 2015 edition expire after 30 September 2029.
Table of changes
| Clause | What changes | What to do in practice |
|---|---|---|
| 4.1 and 4.2 | The requirement to consider climate change, introduced by the 2024 amendment, is now part of the text of the standard. | Check whether your context analysis states explicitly whether climate change is relevant to the company and why. |
| 5.1 | Top management is to promote a quality culture and ethical behaviour. | Prepare concrete examples: how management responds to reported problems, how it talks about mistakes, what it does when quality clashes with a deadline. |
| 5.2 | The quality policy is to be more strongly linked to the company's context and strategic direction. | Read the quality policy alongside the strategy. If it could fit any company, rewrite it. |
| 6.1.2 and 6.1.3 | Risks and opportunities are in separate clauses. Annex A explains that no formal or documented method is required. | Separate risks from opportunities in your overview and define actions for opportunities too. Do not build an elaborate register just for the audit. |
| 6.3 | When planning changes, more factors must be considered, including communication, monitoring of effectiveness and review of the change. | For your next major process change, write down how you will communicate it and how you will know it has worked. |
| 7.1.4 | The environment for the operation of processes includes quality culture and ethical behaviour. | Link this clause to 5.1: what in the working conditions supports honest work and what gets in its way. |
| 7.3 | Employees are to be aware of quality culture and ethical behaviour. | Add this topic to the onboarding of new people and to team discussions. The auditor will ask people about it at their workstations. |
| 7.5 | The distinction between information that must be maintained and records retained as evidence has been clarified. | No new documents are needed. Just check that you know which documents are updated and which are records. |
| 9.3 | The list of management review topics is mandatory, changes in the needs of interested parties have been added, and risks and opportunities are discussed separately. | Update your management review template so that every required topic has its own place and conclusion. |
| 10.1 | The former clauses 10.1 and 10.3 have been merged into a single clause on continual improvement. Clause 10.3 is gone. | Correct the references in your procedures and compliance matrix if they cite 10.3. |
| 10.2 | The reference to complaints has been moved to a note. | No change in practice. Keep handling complaints as a source of nonconformities. |
| Annexes | Annex A with explanations is considerably longer and is informative in nature. The former Annex B has been removed. | Read Annex A before your gap analysis. It explains how to understand the requirements and dispels some of the myths. |
What does not change at all
The requirements for the realisation of products and services in clause 8 have changed only slightly, and most of the changes are editorial. The process approach, risk-based thinking and the plan, do, check, act cycle still apply. If your system works in practice and not just on paper, the transition will be more a matter of tidying up than of building from scratch.
Myths worth setting aside
- New requirements on AI, digitalisation or cybersecurity. They are not in the published text. They appeared in speculation and in early working drafts.
- A mandatory formal risk register. The standard does not require one. What matters is that risks and opportunities are identified and translate into actions.
- The transition period is set by the IAF. Since 2026 the transition rules have been set by Global ACI, the organisation that has taken over the role of the IAF. Always confirm the specific audit schedule with your certification body.
- All documentation has to be rewritten. A few targeted changes are usually enough: the context analysis, the overview of risks and opportunities, the management review template, clause references.
Transition period
There are three years from publication to make the transition. Certificates to ISO 9001:2015 expire after 30 September 2029. Certification bodies are already accepting requests for audits to the new edition, either as part of a surveillance audit, a recertification audit or as a separate visit. Do not leave it until the final year: that is when auditor dates will be hardest to get.
I have described the order of the first steps in the article ISO 9001:2026 transition: where to start.
Where to start this week
- Ask your certification body about its transition plan and possible dates.
- Buy the standard and read Annex A.
- Do a quick gap analysis against the clauses in the table above.
For the third step you can use our free ISO 9001:2026 gap analysis: 24 questions in 5 areas, an instant result and a PDF report. If you would rather go through the change with someone from outside, we describe that on the ISO Systems page.
Frequently asked questions
By when do we have to move to ISO 9001:2026?
The transition period is three years from publication. ISO 9001:2015 certificates expire after 30 September 2029, and you agree the date of your audit to the new edition with your certification body.
Does ISO 9001:2026 require new documents?
No. The new edition adds no mandatory documents and no formal risk register. What changes is the emphasis: quality culture, separate handling of risks and opportunities, planning of changes and management review.
Are there requirements on AI and cybersecurity in ISO 9001:2026?
No. The published text contains no requirements on artificial intelligence, digitalisation or cybersecurity. Such claims come from speculation and early drafts.
Sources: discussions of the published text by certification bodies and industry experts (including DNV, DQS, LRQA and CQI). This summary is for information only and is no substitute for reading the standard.
Let us talk about your process.
The first call takes about 30 minutes. Tell us what gets in the way most in your process and we will say whether and how we can help.
Talk to us