ISO 9001:2026 transition: where to start

ISO 9001:2026 was published on 16 September 2026. For companies that hold a certificate, this marks the start of the transition period. For companies that are only planning implementation, this is the moment to build the system for the new edition from the outset. In both cases the first few weeks decide whether the transition will be an orderly project or firefighting just before the audit.

Below I describe the sequence of actions I follow when preparing an organisation for changes to its quality management system. I have collected the detailed changes to the requirements in a separate article, ISO 9001:2026 vs 2015: what has changed, clause by clause. The rules of the transition period are set by Global ACI (the organisation that took over the role of the IAF in 2026) and by the certification bodies, so the dates for your company must be confirmed directly with the body that issued your certificate.

1. Establish who and what the transition concerns

Start with a simple list: what the scope of the certificate is, which sites and processes it covers, who owns the system and who conducts the internal audits. In many companies this information is scattered between the quality manager, senior management and documentation from several years ago. It is a good idea to gather it in one place before anyone starts comparing requirements.

It is also worth asking your certification body about its transition plan: when it intends to audit to the new edition, whether the transition can be combined with a recertification or surveillance audit, and which documents it wants to see in advance. The answers affect the schedule of the whole project.

2. Get the standard and read it before any training

Everyone who will be responsible for implementation should have a copy of the standard, not just the quality management representative. Reading the text yourself and marking the passages relevant to your own company gives a better starting point than the summaries circulating online. Summaries can be useful as a supplement, but they do not replace the source, and in the first months after publication they tend to contain inaccuracies.

If you use external training, check that the trainer is working from the published text of the standard and not from a pre-publication draft.

3. Do a gap analysis on your own system

A gap analysis compares your current system with the requirements of the new edition. It is done on real material: the quality policy, the process map, procedures, audit records, management reviews and nonconformity data. The result should be a simple table: requirement, current state, action, person responsible, deadline.

A good gap analysis answers three questions:

• What in the system already meets the requirement and only needs to be documented or described differently?
• What requires a change in the way people work, not just in a document?
• What is new for the organisation and needs an owner, resources and time?

The second question is the most important. Documents are corrected quickly, whereas changing a team's habits takes weeks and only shows at the audit, when the auditor talks to people at their workstations.

4. Review the context of the organisation and the risks

The analysis of context and risks is an area where the system often exists on paper while nobody returns to it day to day. The transition to the new edition is a good pretext to check whether the analysis reflects the company's current situation: new markets, changes in the supply chain, new technologies, customer requirements, staff turnover.

If the last update dates from several years ago, hold a short workshop with the people responsible for sales, purchasing, production or service delivery and customer contact. Two hours of conversation usually yield more than a week of working on the document alone.

5. Verify the process map and performance measurement

Check that the process map matches reality. For each process the following should be defined: the owner, inputs and outputs, indicators and the way the results feed into decisions. It often turns out that indicators are collected but nobody analyses them, or that some processes exist in the organisation but are missing from the map.

This is a good moment to reduce the number of indicators to those that actually serve management. A system with a dozen or so understandable measures is easier to maintain than one with several dozen that nobody reads.

6. Plan internal audits and the management review

An internal audit to the new edition is the best test of readiness before the certification body's audit. Plan it well in advance, so that there is time for corrective actions after the results. Internal auditors should know the changes the transition involves, so plan a short training session or workshop for them.

A management review held after the gap analysis gives management the full picture: what is changing, what resources are needed and what decisions have to be made. The records of such a review also become one of the pieces of evidence of top management commitment that auditors ask about.

7. Train people and update documentation, in that order

First management and process owners, then internal auditors, and finally the rest of the team. General training for everyone only makes sense once it is known what changes in daily work. Done earlier, it usually leads to questions nobody can answer yet.

Update the documentation only after the decisions on processes have been made. The reverse order ends with correcting the same procedures a second time. If the system is extensive, take the opportunity to consider which documents can be simplified or merged. Fewer documents mean fewer places where a nonconformity can appear.

Sample timeline

• First month: gathering information about the certificate scope, contacting the certification body, buying the standard, appointing the project team.
• Months 2 to 3: gap analysis, workshops on context and risks, review of the process map.
• Months 4 to 6: changes to processes, updating documentation, training, internal audit.
• Final stage: management review, corrective actions, agreeing the audit date with the certification body.

The duration depends on the size of the company, the state of the current system and the dates set by the certification body, so treat this breakdown as a starting point for your own plan.

What to watch out for

The most common mistake is to treat the transition as a job for one person, usually the quality management representative. The new edition of the standard concerns how the company is managed, so without the involvement of management and process owners the project will get stuck at the document stage. The second common problem is putting the work off until the certification body announces its own dates. The gap analysis and the process review can be started now, because their results will be useful whatever the final schedule.

I have attached a checklist in PDF format to this article, which organises the steps described here into five sections. You can print it out and go through it with your team.

Download the PDF checklist (in Polish)