What Changed from ISO 9001:2015

ISO 9001:2026 keeps the structure and the philosophy of the 2015 edition and changes the requirements text in a focused set of places. This page walks through what is new and what has moved, and — more usefully — what an auditor is likely to ask you to show for each one.

Before the detail, the reassurance: if your quality system genuinely works, most of these changes are evidence problems rather than system problems. You probably already brief people when a process changes. The new requirement is that you can show you planned that communication and checked whether it landed.

At a glance

Clause	Change	Effort to close
4.1 / 4.2	Climate change consideration carried forward from the 2024 amendment	Low
4.2	Decide which interested party requirements the QMS will address	Low to medium
5.1.1	Top management must promote quality culture and ethical behavior	Medium
5.2.1(e)	Explicit alignment of quality policy with strategic direction	Low
6.1.2 / 6.1.3	Risks and opportunities split into separate requirements	Medium
6.3	Change planning expanded: communicate, monitor, review results	Medium
7.1.6	Organizational knowledge: capture and transfer, not just identify	Medium
7.3	Awareness extended to quality culture and ethical behavior	Low to medium
8.2 / 8.3 / 8.5.1	Sharper operational communication and design output requirements	Low to medium
9.2.2	Internal audits require stated objectives	Low
9.3.2	Management review considers changes in interested party needs	Low
Annex A	Substantially rewritten guidance	None — informative

Clause 4.2 — deciding what you will actually address

The 2015 edition asked you to determine interested parties and their relevant requirements. In practice this produced long lists in which customers, regulators, suppliers, employees and the local community all appeared, with no indication of which of their requirements the quality system was actually doing anything about.

The 2026 edition closes that gap: you decide which of those requirements your QMS will address. Clause 9.3.2 then requires management review to consider changes in interested party needs.

What an auditor will look for: a customer requirement, traced to a process that delivers it and a measure that shows whether it is being delivered. If a large customer requires a monthly delivery performance report, an auditor will want to see who owns that, where the data comes from, and where its effectiveness is discussed.

Clause 5.1.1 — quality culture and ethical behavior

This is the headline change and the one that makes experienced quality managers nervous, because culture sounds unauditable. It is not. An auditor cannot measure your culture, but they can ask questions whose answers reveal it.

What an auditor will look for: whether an inspector can record a failed result without pressure to change it. Whether a supervisor can stop a shipment that may not conform, and what happened the last time someone did. Whether quality objectives survive contact with a busy month. Evidence tends to be found in nonconformity records, in how management review minutes discuss bad news, and in what your people say when asked.

This requirement is significant enough that we have given it its own page on quality culture and ethical behavior.

Clauses 6.1.2 and 6.1.3 — risks and opportunities, separated

The single most common weak spot in ISO 9001:2015 systems was the risk register whose "opportunities" column contained nothing but inverted risks. "Risk: supplier fails. Opportunity: supplier does not fail." Auditors saw it constantly and could do little about it, because the 2015 text treated the two together.

The 2026 edition splits them: clause 6.1.2 covers actions to address risks, clause 6.1.3 covers actions to address opportunities, and management review distinguishes the effectiveness of each.

What an auditor will look for: genuine opportunities that are about improvement rather than avoidance. A distributor might approve a second supplier to reduce a supply risk (6.1.2) and separately redesign its ordering method to shorten lead times (6.1.3). Two different actions, two different measures of success, reviewed separately.

How to close it: do not simply add a second tab to your existing register. Ask each process owner one question — "what could we do here that would make this measurably better?" — and record the answers as opportunities with owners and target outcomes.

Clause 6.3 — planning of changes, expanded

The 2015 requirement was brief: changes shall be carried out in a planned manner. The 2026 edition adds substance. You give people the information they need, you communicate the change, you monitor how it works and you review the results against criteria you set beforehand.

What an auditor will look for: take a change you made in the last year — a new ERP module, a revised inspection method, a line relocation — and expect to be walked through it. Who needed to know. What they were told. What you watched afterwards to see whether it worked. What the review concluded.

How to close it: a one-page change plan template with five fields (what is changing, who must be informed, what could go wrong, what we will monitor, when we will review) will satisfy this clause for most organizations.

Clause 7.1.6 — organizational knowledge that actually transfers

Most 2015-era knowledge registers are inventories: a list of things the company knows. The 2026 edition is more interested in retention and sharing — handovers, mentoring, lessons learned — so that the know-how needed to run the quality system survives people leaving.

What an auditor will look for: what happened when your most experienced person last left or retired. Was there a structured handover? Was the receiving person's understanding verified, or was it a conversation and a folder of files?

How to close it: build a short handover protocol into your leaver process and run it the next time someone in a key role moves on. A single well-documented handover is worth more than a fifty-line knowledge register.

Clause 7.3 — awareness extends to culture and ethics

Awareness in 2015 covered the quality policy, relevant objectives, each person's contribution, and the implications of not conforming. The 2026 edition adds quality culture and ethical behavior to that list.

What an auditor will look for: they will ask a machine operator or an office administrator what happens if they spot something wrong. The useful answer describes a route and an expectation, not a slogan.

Clauses 8.2, 8.3 and 8.5.1 — operational tightening

Several operational clauses gain precision rather than new concepts. Contingency actions must be explained to customers where relevant (8.2.1). Evidence of reviewed requirement changes must be retained (8.2.3.2) and changes communicated to the relevant parties (8.2.4). Design outputs must carry what production actually needs — dimensions, material specifications, acceptance criteria (8.3.5) — and customers and production staff should be involved in design inputs (8.3.2). Updated specifications must reach the people performing the work, not just the document control system (8.5.1).

What an auditor will look for: the drawing at the workstation matching the current revision, and the operator knowing how they would find out if it changed.

Clause 9.2.2 — internal audits with a stated objective

Audit programs have always required scope and criteria. The 2026 edition adds objectives: what is this particular audit trying to find out?

What an auditor will look for: an audit plan whose objective is specific — "determine whether the revised order entry process has reduced specification errors without affecting customer requirements" — and an audit report that answers that question directly, rather than a checklist with ticks in it.

How to close it: this is a fifteen-minute change to your internal audit template and one of the cheapest conformity wins in the whole transition.

Annex A

Annex A has been substantially rewritten and now explains the relationships between requirements far more usefully than its 2015 predecessor. It remains informative, so it creates no requirements of its own, but it is the best single explanation of intent you will get and it is worth reading before you start rewriting procedures.

What did not change

The Harmonized Structure, the process approach, PDCA, risk-based thinking, customer focus and continual improvement are all retained. The clause numbering of the main structure is stable, which means an integrated ISO 9001 / ISO 14001 / ISO 45001 system does not need re-mapping. And there is still no requirement for a documented quality manual, whatever habit says.

Next: how long you have, or work through the gap checklist.

Frequently Asked Questions