ISO 9001:2026 Is Officially Published

ISO 9001:2026 was officially published today, the first revision of the quality management standard since 2015. ISO 9001 remains the most widely adopted management system standard in the world, used by well over a million organisations to run and certify their quality management systems. A revision of this scale affects a very large base of certified companies, not just a niche.

What actually changed

The headline changes sit in three areas that ISO signalled well before publication.

Risk-based thinking becomes a design principle, not a checkbox. Earlier editions asked organisations to identify risks and opportunities as an input to planning. The 2026 text tightens the link between that risk assessment and the actual decisions an organisation makes about its processes. A risk register that nobody revisits after the certification audit is a much harder position to defend.

Leadership accountability gets more explicit. Top management involvement was already required, but the updated clauses push for a more direct, demonstrable connection between quality objectives and business strategy, rather than a sign-off that happens once a year during management review.

Organisational knowledge is treated as an asset to manage, not an afterthought. The revision sharpens expectations around how a company captures, protects, and reuses operational know-how, so that expertise doesn't quietly walk out the door when an experienced employee leaves. Expect more scrutiny on how documented information actually gets used day to day, not just whether it exists.

What stayed the same

The 2026 edition keeps the Annex SL high-level structure. Clause numbering, core terminology, and the overall shape of the standard still line up with ISO 27001, ISO 14001, and the rest of the management system family. Organisations running more than one certification don't need to rebuild anything from scratch. The fundamentals, including the process approach, the PDCA cycle, documented information, internal audits, and management review, are unchanged in substance. This is an evolution of emphasis, not a rewrite.

The transition period

As with the 2015 revision, certified organisations don't lose their current certificate the day the new edition lands. A transition period applies, giving certified companies time to migrate their management systems to the updated clauses through their normal audit cycle rather than on an emergency timeline. Exact transition deadlines are set by accreditation bodies and certification schemes, so check with your certification body for the date that applies to your certificate.

What to do now

For companies already tracking ISO 9001, the practical next step isn't a full system rewrite. It's a gap assessment: map your existing controls and documentation against the updated clauses, and prioritise the handful that actually shifted (risk-based decision-making, leadership-to-strategy traceability, knowledge management) over the ones that didn't. Doing that mapping now, while the transition window is still wide open, is a lot cheaper than doing it in the weeks before your next surveillance audit. See how Norma manages ISO 9001 alongside every other framework your organisation runs.