ISO 9001:2026: what changes, and how to transition without disrupting your system

Who has to act on ISO 9001:2026, and by when

Holders of an accredited ISO 9001:2015 certificate need a transition audit and a certification body decision before 30 September 2029; until then the current certificate stays valid. Organisations part-way through a first implementation to the 2015 edition should switch now: no new 2015 certificates can be issued after 31 March 2028, and any issued earlier lapse with the rest. New starters build to 2026 from the first workshop.

The dates come from Global ACI-TECH-3-TR 2029-09-30 (M), mandatory transition requirements issued on 4 September 2026 by Global ACI, successor to the IAF and ILAC. ISO adds that certified organisations transition within the timeframe of their certification cycle: your existing audit dates set your real deadline.

What ISO 9001:2026 changes, source by source

ISO calls the revision "targeted updates": clearer wording, more weight on quality culture and leadership, risks separated from opportunities, and closer alignment with other management system standards. The standard's foreword lists the same themes, extends quality culture and ethical behaviour to the environment for the operation of processes, and confirms that the 2024 climate change amendment is incorporated.

Global ACI's transition requirements, binding on accredited certification bodies, name the changed requirements by clause, and the transition audit must review them. The seven clause titles are unchanged, and the revised Annex A is informative, so it adds no requirements.

A transition plan in five steps

Run the transition as a planned change, the very requirement the 2026 edition strengthens: give it an owner, a timetable and resources, and ask your certification body early which audit will carry it.

Step 1: gap analysis against the 2026 text

With a licensed copy of the standard, compare your system with it requirement by requirement, changed requirements first. Sort each result as met and evidenced, met but not evidenced, or not met; the middle group is where practice exists without records. Refresh your analysis of context and interested parties too, because the transition audit looks at changes to your context.

Step 2: update only the documents the changes affect

Usually that means the quality policy, the risk and opportunity method, the change procedure, awareness material and the management review agenda. The standard's introduction does not ask for documentation that mirrors its numbering, so procedures that work keep their structure, as ISO 9001 documentation: what you need and what you do not explains.

Step 3: train the people the changes touch

Top management needs to understand its duty to promote quality culture and ethical behaviour; internal auditors, the changed requirements and how to audit culture through decisions, records and interviews; everyone else, updated awareness content, with a record that they received it.

Step 4: internal audit and management review against 2026

Once the updated processes have left records, audit the whole system against the new edition, using auditors who did not write the updates, then hold a management review with the 2026 inputs and minute its decisions. The companion guide ISO 9001 internal audit: planning, conduct and reporting covers the audit itself.

Step 5: agree the transition audit

Confirm the route, the audit time and whether any part will be remote. Accredited certification bodies must tell their certified clients about the process, expected actions and timelines; if yours has not, ask. Book early enough to answer any findings well before 30 September 2029.

The transition audit, and whether it takes longer

Global ACI sets the minimum: the certification body reviews the requirements that changed, any changes in your context, and whether your system needs other changes. It may look further, never less.

Audit time is not fixed. The certification body must consider whether extra time is needed and justify it under ISO/IEC 17021-1 and IAF MD 5 (Global ACI TECH-3-004); a full system audit may need none, so the route matters:

• At recertification. The whole system is audited anyway, so extra time is least likely; it suits recertifications due well before September 2029.
• At a surveillance audit. Surveillance samples the system, so the certification body is more likely to add time, but it allows an early transition.
• At a special audit. A separate visit with its own audit time, for when neither scheduled audit fits.

Remote transition audits are permitted under IAF MD 4 (Global ACI TECH-3-003) where the certification body can show the audit objectives are met; the choice is the certification body's.

The risks of leaving the transition late

Three years is one certification cycle, about three scheduled audits, and the first may come before you or your certification body are ready for the new edition.

• The date is fixed. After 30 September 2029, a 2015 certificate no longer satisfies any contract or tender that requires accredited certification.
• Capacity is shared. Every certified organisation works to the same date. Leave it to your last audit and you need a slot, an auditor and a clean result at once.
• Findings take time. Nonconformities must be answered before the certification body decides on the transition.
• Paper changes show. A culture sentence added to the policy a month before the audit fails when the people interviewed cannot say what it changed.

ISO 9001:2026 transition: questions buyers ask