Key takeaways
- ISO 9001 is the international standard that sets out the requirements for a quality management system: it is voluntary, applies to any organisation and can be certified.
- The current edition is ISO 9001:2026, the sixth, published on 16 September 2026; it replaces ISO 9001:2015 and incorporates Amendment 1:2024.
- Under the Global ACI transition requirements, new accredited certifications are issued only against the 2026 edition from 31 March 2028, and 2015 certificates need to transition by 30 September 2029.
- The requirements sit in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) and rest on seven principles, the process approach, the PDCA cycle and risk- and opportunity-based thinking.
- ISO 9001 shares the harmonised structure of ISO/IEC 27001 and ISO 22301, so several management systems can be run and audited together.
- Certification is issued by an accredited certification body after a Stage 1 and Stage 2 audit, runs on a three-year cycle with surveillance audits and attests how you work, not a single product.
ISO 9001 is the international standard that sets out the requirements for a quality management system: the processes, responsibilities and controls an organisation uses to deliver products and services that consistently meet customer requirements and applicable legal requirements, and to keep improving. It is voluntary, it applies to any organisation of any size or sector, and it can be certified. The current edition is ISO 9001:2026.
People who look up ISO 9001 usually have a practical question behind it: a customer or a tender asks for the certificate, the board wants to know whether it is worth the effort, or a certificate is already on the wall and the new edition raises questions. This guide covers the basics: what the standard says, how it is built, which edition applies, how certification works and when you actually need it.
What ISO 9001 says, in a few lines
The purpose of the standard sits in clause 1 (scope). ISO 9001:2026 specifies requirements for a quality management system when an organisation:
- needs to demonstrate its ability to consistently provide products and services that meet customer requirements and applicable statutory and regulatory requirements;
- aims to enhance customer satisfaction through the effective application of the system, including the processes for improving it.
The same clause states that all requirements are generic and apply to any organisation, regardless of its type, size or the products and services it provides. A metal fabricator, a software company and an engineering firm work from the same text.
Two clarifications avoid the most common misunderstandings:
- Quality does not mean premium. The standard looks at your ability to deliver what you promised, consistently, not at how upmarket the product is.
- ISO 9001 does not tell you how to make your product. The introduction (clause 0.1) says the quality management system requirements are complementary to the requirements for products and services. Your technical specifications stay those of your sector; the standard asks you to manage the processes that meet them.
Who writes it, and what EN ISO 9001 means
ISO 9001 is not a law. It is a technical standard, prepared by technical committee ISO/TC 176, subcommittee SC 2, in collaboration with the European Committee for Standardization (CEN) under the Vienna Agreement on technical cooperation between ISO and CEN, as the ISO foreword explains.
In Europe the same text becomes a European standard. According to the CEN foreword, EN ISO 9001:2026 replaces EN ISO 9001:2015 and its 2024 amendment, and national standards bodies give it the status of a national standard, by publishing an identical text or by endorsement, by March 2027 at the latest, withdrawing any conflicting national standards by the same date. That is why you will see different prefixes in front of the same number depending on the country: the content is the same, the publisher changes.
Editions: from ISO 9001:2015 to ISO 9001:2026
ISO 9001:2026 is the sixth edition. Its foreword states that it cancels and replaces the fifth edition, ISO 9001:2015, which has been technically revised, and that it incorporates Amendment 1:2024. Global Accreditation Cooperation Incorporated (Global ACI), the international body of accreditation bodies, confirms that ISO 9001:2026 was published on 16 September 2026.
The main changes listed in the foreword are targeted:
- clause 3 now includes a limited set of core terms and definitions, while ISO 9000 remains the reference for quality vocabulary;
- quality culture and ethical behaviour are now addressed within the requirements, in particular those on leadership, awareness and the environment for the operation of processes;
- risks and opportunities are more clearly separated, with distinct actions to address each;
- requirements on changes to the quality management system are reinforced;
- Annex A is revised as informative text with no additional requirements, and Annex B is removed.
In its transition document, Global ACI judges the overall changes minimal.
How long a 2015 certificate stays valid
The dates come from the Global ACI-TECH-3-TR transition requirements of 4 September 2026, which are mandatory for every accreditation body that has signed the Global ACI Multilateral Recognition Arrangement (MRA) and for the certification bodies they accredit. The transition period is three years:
- by 30 September 2027 accreditation bodies complete their transition decisions on certification bodies, and a certification body can issue accredited 2026 certificates only after its own accreditation has transitioned;
- from 31 March 2028 new and initial accredited certifications are issued only against ISO 9001:2026;
- by 30 September 2029 certified organisations complete the transition, certificate issued, through a surveillance or recertification audit or a special transition audit.
The clause-by-clause changes and what to do if you already hold a certificate are covered in ISO 9001:2015 vs ISO 9001:2026.
How the standard is built: clauses 0 to 10
ISO 9001 has an introductory part and seven clauses of requirements. Clauses 0 to 3 frame the standard (introduction, scope, normative references, terms and definitions). The requirements sit in clauses 4 to 10:
- 4, Context of the organisation: internal and external issues, interested parties and their requirements, scope of the system, processes.
- 5, Leadership: top management commitment, customer focus, quality policy, roles and responsibilities.
- 6, Planning: risks and opportunities, quality objectives, planning of changes.
- 7, Support: resources, people, infrastructure, competence, awareness, communication, documented information.
- 8, Operation: requirements for products and services, design, external providers, production and service provision, release, nonconforming outputs.
- 9, Performance evaluation: monitoring and measurement, customer satisfaction, internal audit, management review.
- 10, Improvement: nonconformity, corrective action, continual improvement.
This sequence is not unique to ISO 9001. Clause 0.4 explains that the standard applies the harmonised approach for ISO management system standards, designed to help an organisation align or integrate several systems into one. A joint ISO/IAF communiqué of February 2024 lists ISO/IEC 27001:2022 and ISO 22301:2019 among the standards built on the same harmonised structure, so the clause titles you learn for quality reappear in information security and business continuity.
The seven quality management principles
Clause 0.2 says the standard is based on the quality management principles described in ISO 9000. There are seven:
- customer focus;
- leadership;
- engagement of people;
- process approach;
- improvement;
- evidence-based decision making;
- relationship management.
They are not requirements an auditor checks one by one. They are the lens for reading a requirement when the text leaves room for interpretation.
The method: processes, PDCA, risks and opportunities
Three ideas run through the whole standard, and the introduction presents them together.
Process approach
Clause 0.3.1 promotes a process approach: determining and managing processes and their interactions as a system, to achieve the intended results. The specific requirements considered essential to apply it are in clause 4.4. In practice: knowing which activities take an order to delivery, who owns each one and how you measure whether it works.
Plan-Do-Check-Act
Processes and the system as a whole are managed with the PDCA cycle described in clause 0.3.2: plan objectives, processes and resources, addressing risks and opportunities; do what was planned; check through monitoring and measurement; act to improve performance. Figure 2 of the standard groups clauses 4 to 10 around these four phases.
Risks and opportunities
Alongside PDCA, the introduction pairs risk-based thinking, aimed at preventing undesired results, with opportunity-based thinking, aimed at pursuing desired ones. In the 2026 edition the two have separate sub-clauses and actions (6.1.1, 6.1.2 and 6.1.3). A risk register where the opportunities column stays empty no longer fits the text.
What the standard does not ask for
Part of the resistance to ISO 9001 comes from a wrong assumption: that the company has to be rewritten to look like the standard. Clause 0.1 says the opposite. The standard does not imply the need for:
- uniformity in the structure of different quality management systems;
- alignment of documentation to the clause structure of the standard;
- use of the standard's specific terminology within the organisation.
Your documents follow your processes, not the table of contents of the standard. A quality manual numbered 4 to 10 is a choice, not a requirement.
ISO 9001 and the ISO 9000 family
Clause 0.4 refers to three other standards in the same family. ISO 9001 is the one with the requirements you certify against; the others help you read it and go further:
- ISO 9000: fundamentals and vocabulary. It is the only document listed in the normative references of ISO 9001 (clause 2);
- ISO 9002: guidance on applying the requirements of ISO 9001;
- ISO 9004: guidance on enhancing the quality of an organisation and its ability to achieve sustained success.
Sector schemes are also built on ISO 9001. The Global ACI transition document names several: AS/EN/JISQ/IA 91XX for aviation, space and defence, TL 9000 for telecommunications, IATF 16949 for automotive, ISO 22163 for railway and ISO 29001 for petroleum, petrochemical and natural gas-related products and services.
ISO 9001 certification: who issues it and how it works
Adopting the standard and getting certified are two separate steps. You can build your quality system on ISO 9001 without a certificate. Certification is an independent third-party audit, carried out by a certification body, that confirms the system meets the requirements.
Who issues the certificate
The certificate is issued by a certification body. For it to carry recognised value, the body should be accredited. In the European Union, Regulation (EC) No 765/2008 requires each Member State to appoint a single national accreditation body (Article 4(1)). Internationally, accreditation bodies work together through Global ACI, and its transition document reports more than one million accredited ISO 9001 certificates. How to check accreditation and compare bodies is explained in our guide to choosing a certification body: it is written for ISO 27001, but the checks are the same for ISO 9001, as long as the accreditation scope covers quality management systems.
What a certificate covers, and what it does not
An ISO 9001 certificate attests that your quality management system, within the declared scope, meets the requirements of the standard. It is a statement about how you work, not a product certification: as clause 0.1 says, the system requirements sit alongside the requirements for your products and services, they do not replace them. Read the scope on a supplier's certificate before relying on it: it names the sites and activities covered.
Audits and cycle
The initial audit takes place in two stages, Stage 1 and Stage 2, and opens a three-year certification cycle with surveillance audits in between and a recertification audit at the end. The certification body calculates audit time using Global ACI TECH-3-004 (formerly IAF MD 5:2023): during the initial cycle, the time spent each year on surveillance is about one third of the time spent on the initial certification audit, and a surveillance audit is unlikely to last less than one audit day.
Is ISO 9001 mandatory?
No. It is a voluntary standard, and the ISO foreword refers readers to an explanation of the voluntary nature of standards. It becomes necessary when another rule or a contract calls for it. The most frequent cases:
- Public procurement in the EU. Article 62 of Directive 2014/24/EU says that when contracting authorities require certificates attesting compliance with quality assurance standards, they refer to quality assurance systems based on the relevant European standards series, certified by accredited bodies. They also recognise equivalent certificates from bodies established in other Member States. Whether a specific tender asks for it depends on the tender.
- Customers and supply chains. Many customers write ISO 9001 into supplier qualification or into the contract. It is not a legal obligation, but without the certificate you do not get on the approved supplier list.
What it is for, beyond the certificate
Clause 0.1 calls the adoption of a quality management system a strategic decision. It lists four potential benefits:
- the ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements;
- opportunities to enhance customer satisfaction;
- addressing risks and opportunities associated with the organisation's context and objectives;
- the ability to demonstrate conformity to the quality management system requirements.
In the mid-market, projects often start from the fourth point, because a customer or a tender asks for the certificate. The value that lasts sits in the first three: fewer complaints, less rework, decisions taken on data rather than memory. A system built only for the audit produces documents; one built on real processes produces data that management actually uses.
For digital and technology companies there is a further advantage. Because ISO 27001 and ISO 22301 share the same harmonised structure, context, leadership, internal audit, management review and document control can be set up once for several systems, and audited together.
In summary
ISO 9001 is the voluntary international standard that sets out the requirements for a quality management system, valid for any organisation. The current edition is ISO 9001:2026, published on 16 September 2026; certificates to the 2015 edition need to transition by 30 September 2029. It asks for defined processes, clear responsibilities, managed risks and opportunities, measured results and continual improvement. Accredited certification runs on a three-year cycle with surveillance audits and attests how you work, not a single product.
If you are weighing a first certification, or the move to the 2026 edition, our ISO 9001 page shows how we run these projects, and you can get in touch to start from where you are today.