ISO 9001 clause 8: control the work from customer promise to release
ISO 9001:2026 clause 8 controls the work customers rely on: understanding the requirement, designing where applicable, managing external provision, delivering under controlled conditions, authorising release and handling outputs that do not meet requirements. The clauses apply to services as well as physical products. Their value is the connection between the promise made and the evidence that it was fulfilled.
What clause 8 requires in practice
Clause 8 covers the operation of the organisation: the work that turns a customer's need into a delivered product or service. It opens with planning and control of the processes in 8.1. It then deals with the requirements for products and services in 8.2, which covers customer communication, determining requirements, reviewing them before commitment and handling changes. Design and development follows in 8.3, then control of anything supplied from outside, whether processes, products or services, in 8.4, production and service provision in 8.5, release in 8.6 and control of nonconforming outputs in 8.7.
The clause works as a chain. Each part expects the organisation to know what is required, to decide what controls make delivery reliable, to keep suitable documented information as evidence, and to manage change. The detail depends on what the organisation does: not every business designs products, and not every service uses external providers, so applicability follows the scope of the system. The clause does not prescribe a particular workflow, software or set of forms. Its outputs are outcomes: promises that are clear and achievable, controlled work, and a release decision that is traceable to the person who made it.
8.1: plan the controls before the work begins
Operational planning translates requirements and clause 6 actions into processes, acceptance criteria, resources and control. The organisation needs enough documented information to support confidence that planned work occurred and that outputs conform. It also controls planned changes and reviews unintended changes for adverse effects.
A useful starting point is a representative order. Identify where requirements become work instructions, where checks occur and who can decide an exception. The control should suit the consequence and complexity. A repeated standard service and a bespoke engineering project may need different arrangements while addressing the same underlying questions.
8.2: understand and review the customer commitment
Customer communication in 8.2.1 includes information about the offer, enquiries and orders, changes, feedback, customer property and relevant contingency arrangements. Clause 8.2.2 concerns determining requirements, including applicable obligations and the organisation's own necessary conditions, and being able to meet the claims made about the offer.
Before commitment, 8.2.3 requires a review of the ability to meet the relevant requirements. This includes stated customer needs, known intended-use needs, delivery and post-delivery matters, applicable statutory or regulatory requirements and differences from previous arrangements. Where the customer's requirements are not documented, they still need confirmation before acceptance.
For illustration, a facilities service business receives an urgent request to maintain an unfamiliar installation. A responsive sales team should still establish what is required and whether the business has the necessary capability. The review is not an obstacle to service; it protects the customer from an unverified promise. Under 8.2.4, later requirement changes must reach the relevant information and people.
8.3: control design and development where it applies
Design can concern a product, software or the way a new service meets defined needs. Clause 8.3.1 establishes an appropriate design process; 8.3.2 addresses planning, including stages, responsibilities, interfaces, resources and the necessary review, verification and validation. An iterative approach can be suitable, provided the controls remain effective.
Inputs under 8.3.3 need to be adequate and unambiguous for the design work, with conflicts resolved. They can include performance needs, applicable obligations, relevant prior learning and consequences of failure. Inputs can evolve, but that does not justify silently changing the basis of the design after a test fails.
The controls in 8.3.4 have distinct purposes. A review examines progress and suitability; verification checks outputs against inputs; validation examines whether the resulting product or service meets the specified application or intended use. Combining activities may be sensible, but calling every check a review can hide a missing validation question.
Outputs under 8.3.5 must support subsequent provision, including relevant acceptance and monitoring information. Changes under 8.3.6 need review, control and evidence of authorisation and action to avoid adverse effects. For a hypothetical remote support service, a pilot with representative users may reveal needs that a document review alone missed. The lesson is to choose evidence that fits the design question.
8.4: retain control when another organisation contributes
Clause 8.4.1 covers externally provided inputs, services supplied directly to customers on the organisation's behalf, and outsourced processes. The organisation establishes criteria for selecting, evaluating, monitoring and re-evaluating providers. Keeping a supplier on an approved list is not enough if nobody reviews whether the delivered work still meets requirements.
Under 8.4.2, the type and extent of control reflect potential impact and the provider's own controls. The organisation considers both the provider and the resulting output. Clause 8.4.3 then addresses communicating adequate requirements, including relevant approval, competence, interaction, monitoring and verification arrangements.
A fictional manufacturer outsourcing a finishing process might need more than a purchase order stating the price. The provider needs the relevant specification and acceptance conditions; the manufacturer needs an appropriate way to verify the result. A supplier certificate can inform confidence, but it does not automatically answer whether a particular batch or service met the agreed requirement.
8.5: maintain controlled production and service conditions
Clause 8.5.1 brings together working information, suitable resources, capable people, checks at appropriate stages and action to prevent human error. Where an output cannot be adequately verified afterwards, the ability of the process to achieve its intended result needs validation and periodic revalidation. A final inspection cannot compensate for a characteristic it cannot actually verify.
Identification and traceability in 8.5.2 help establish what an output is and its status. Unique identification and supporting evidence are needed where traceability is a requirement. For a service, this can concern the relevant customer case or work item rather than a physical batch number. Use a method that supports the actual requirement.
Customer or external-provider property under 8.5.3 can include equipment, information and intellectual property. Identify and protect it appropriately, and address loss, damage or unsuitability with the required communication and evidence. Preservation under 8.5.4 protects conformity during handling, storage, transfer or other relevant stages. Both topics can matter after the main technical work appears complete.
Post-delivery responsibilities in 8.5.5 depend on applicable requirements, the nature and consequences of the output, customer needs and feedback. They may include a contractual support obligation. Clause 8.5.6 controls production or service changes, with evidence of review, authorisation and necessary action. An improvised substitution should not bypass the decisions the original process required.
8.6 and 8.7: make release and exceptions accountable
Release follows the planned arrangements for verifying requirements. The evidence includes conformity with acceptance criteria and traceability to the release authority. An exception requires the appropriate approval, including the customer's where applicable. A deadline does not by itself provide that authority.
Nonconforming outputs must be identified and controlled to prevent unintended use or delivery, including when problems are found after delivery. Responses can differ with the situation: correction, containment, stopping provision, customer communication or authorised concession may be relevant. Corrected outputs need verification, and the information about the problem, action, concession and decision authority must be preserved as required.
Keep clause 8.7 distinct from clause 10.2. Holding or correcting an affected output addresses the immediate situation. Investigating recurrence and the need for corrective action concerns the wider system. The two activities should connect without pretending that repairing one item has necessarily removed the cause.
Why operational control matters to the business
Operations is where the business meets the customer, and where most cost of poor quality arises. A vague promise, an unchecked supplier or a rushed release can result in complaints, rework, penalties and lost repeat business. Controls placed at the right points prevent these losses and make results more predictable as volumes and teams grow. They also give leaders reliable information about how work is performing, so decisions rest on facts. For auditors, clause 8 is usually the largest part of the audit because it shows whether the system affects daily work. A well-run operation leaves a clear trail from the customer's request to the product or service delivered, which builds confidence on both sides.
How to implement clause 8
Treat the clause as one connected flow rather than separate topics. One way Sterling's teams approach it is to trace a single representative order from first contact to release and map the controls along the route.
- Map the main service or product flow, showing where requirements enter, where work is done and where outputs are released.
- Plan each stage under 8.1, setting acceptance criteria, process criteria, resources and the change rules.
- Define how requirements are communicated, determined, reviewed and updated, and who can accept a commitment.
- Decide whether design and development applies to your offering, and set suitable controls if it does.
- Identify external providers and processes, and set evaluation, control and information requirements for them.
- Define controlled conditions for production or service delivery, and who authorises release or handles problem outputs.
- Check that evidence is created at each stage and that the trail can be followed from the promise to the result.
What an auditor may follow
An auditor can trace a selected job through requirements review, design where applicable, provider controls, delivery and release. Records should make that journey understandable, including changes and exceptions. The required information varies by activity; there is no universal bundle that proves every operational process works.
Common gaps include unclear acceptance criteria, supplier requirements that differ from customer commitments, design applicability dismissed too quickly and release records with no clear authority. Review the interfaces as well as the individual forms. A locally complete record can still depend on an incorrect input from another process.
Explore each numbered part
8.1 · plan the controls before delivery begins
Operational planning turns quality intentions into the conditions for real delivery. This guide explains clause 8.1 through software and BPO examples, connecting requirements, acceptance criteria, process controls, resources and evidence. It also addresses planned and unintended changes, showing how teams can preserve control when the work differs from the original plan.
8.2 · make customer commitments clear and achievable
A reliable delivery promise begins before work starts. This guide connects customer communication, requirement definition, review and changes under clause 8.2. Construction and software examples show how to resolve ambiguity, assess capability and keep agreed information current, while distinguishing a customer's request from a commitment the organisation has actually reviewed and accepted.
8.3 · Control Product and Service Design
Design control helps translate customer needs into products and services that can be delivered and used successfully. This guide explains planning, inputs, reviews, verification, validation, outputs and changes under ISO 9001 clause 8.3. Illustrative software and service examples show how evidence can support iterative development without confusing a completed specification with a suitable result.
8.4 · Control External Providers
External providers can affect quality even when their work happens outside your premises. Explore how ISO 9001 clause 8.4 connects supplier selection, proportionate control and clear purchasing information. The guide explains accountability for outsourced work, practical evaluation evidence and the difference between checking a provider's capability and checking the product or service supplied.
8.5 · maintain control throughout production and service
Quality control continues throughout provision and beyond the immediate handover. This guide connects the six parts of clause 8.5 through manufacturing and IT service examples. It explains how working conditions, status, property, preservation, post-delivery commitments and changes interact, helping teams maintain conformity while the product or service moves through different hands.
8.6 · release products and services with evidence
Release is a decision supported by evidence that the planned acceptance arrangements have been completed. This guide explains verification at suitable stages, the limits of exceptional approval, and records linking conformity to the person authorising release. Manufacturing and service examples show how to prevent deadlines or completed checklists from replacing a justified decision.
8.7 · control nonconforming outputs
When an output fails a requirement, the first task is to control what happens to it. Clause 8.7 connects identification and proportionate action with evidence of the nonconformity and its disposition. Learn how this applies to physical products and service outputs, including problems discovered after delivery, and how it differs from corrective action.
Common nonconformities with clause 8
Operational findings tend to follow the chain of the order.
- Customer requirements were not fully reviewed before acceptance, and the delivered result differs from what was expected.
- Planned controls exist on paper but were not applied in the work sampled.
- External providers are used without evaluation or without clear requirements being passed to them.
- Release took place without evidence that acceptance criteria were met or that an authorised person approved it.
- Changes to requirements or processes were not communicated to the people carrying out the work.
Illustrative example: a freight order from promise to release
A hypothetical logistics company in the Netherlands agrees to move temperature-sensitive goods for a new customer. The sales team promises a delivery window during a call and enters a note in the order system. The operations team, unaware of an agreed temperature range, uses the standard vehicle and a carrier it has not worked with before. The goods arrive on time but outside the range the customer expected. In review, the company finds that no one examined the requirement before accepting it, no criteria were set for the carrier, and the release check covered only the delivery time. It adjusts the flow: the order review now confirms the temperature need and the capability to meet it, the carrier is evaluated and given the requirement in writing, and release confirms the agreed condition. The example illustrates connected controls, not a procedure that suits every business.
Frequently asked questions
Can services have nonconforming outputs?
Yes. An incomplete report, an incorrect response or a service delivered outside its agreed conditions can fail a requirement. The response must reflect the nature and consequences of that failure.
Does outsourcing remove an operational clause?
No automatic exemption follows. Examine the organisation's responsibility and the controls needed over the external contribution within its QMS scope.
Can a customer deadline justify release without planned checks?
A deadline does not itself authorise an exception. Follow the applicable release arrangements and obtain appropriate approval, including the customer's where required.
Make operational control easier to demonstrate
Sterling can help review operational interfaces across sites and suppliers, with documentation support and agreed Effivity ISO & GRC automation software scope. The work supports preparation; an independent body decides certification. Enrol in Nonconformity Management or Documented Information Management for related skills. ISO 9001 QMS courses are coming soon; send a learning enquiry.
Review clause 7 support, return to the requirements overview, or continue to clause 9 performance evaluation.
For a closer implementation discussion, read design and development and external-provider controls.