ISO 9001:2026: What’s Changing and How to Plan Your Transition

If your organisation is already certified to ISO 9001, the clock on your transition has started. I have watched a few of these cycles up close, and the pattern rarely changes: the organisations that engage early stay calm, and the ones that wait until their certification body sends the reminder end up doing the work twice. Once badly, in a hurry, and again properly after the audit finding.

The official launch is worth half an hour. ISO streamed the launch of ISO 9001:2026 free on 16 September 2026, with Sergio Mujica, ISO Secretary-General, Sam Somerville, who chairs ISO’s expert group on quality systems and convened the work on this edition, and Isabela Santos, Compliance Manager at Cundall. It covered what is new, how the revision supports resilience and organisational performance, and what to expect during transition. ISO’s YouTube channel and LinkedIn page are the places to look for the recording. Half an hour with the person who convened the revision is the cheapest briefing you will get on it.

The timeline, and what it means for you

• 16 September 2026: ISO 9001:2026 published, superseding ISO 9001:2015. The ISO catalogue now shows the 2015 edition, and its 2024 amendment, as withdrawn. AS/NZS ISO 9001:2026 followed on 18 September.
• 31 March 2027: accreditation bodies are to be ready to assess against the 2026 edition. 30 June 2027: certification bodies submit their transition declaration. 30 September 2027: accreditation decisions complete.
• 31 March 2028: no new or initial accredited certification may be issued to ISO 9001:2015. If you are certifying for the first time, this is your date, not 2029.
• 30 September 2029: the three-year transition ends. Existing certificates to the 2015 edition do not survive past it, and the move can happen at a scheduled surveillance audit, a recertification audit, or a separate transition audit.

Three years sounds generous. It is not, and here is the trap I watch organisations fall into every transition cycle: you do not get three years, you get however many surveillance audits fall inside three years. Your transition realistically has to be done in time for a scheduled audit, with evidence that has been running long enough to demonstrate the system works. Work back from your recertification date and the runway shortens considerably.

The other trap is a quiet one. Certification bodies get busy at the end of a transition window. If everyone leaves it late, availability tightens exactly when you need it.

What’s changing

The structure will feel familiar. This is not a ground-up rewrite and the clause numbering is almost unchanged. The standard names six main changes in its own foreword, and four of them will change what an auditor asks you to show.

Quality culture and ethical behaviour

This is the headline change, and it lands in three places. Clause 5.1.1 adds promoting quality culture and ethical behaviour to what top management must demonstrate. Clause 7.3 adds it to what your people must be aware of, alongside the policy and the objectives. And the note to clause 7.1.4 now acknowledges that the working environment can be shaped by that culture. Ethical behaviour is new language in this standard and it appears throughout.

As an auditor, the tell on a leadership clause has never been the signed policy on the wall. It is whether quality showed up in the decisions people actually made: a supplier kept or dropped, a shipment held, a deadline missed on purpose because the product was not right. That is the hardest thing in the entire standard to retrofit the week before an audit. If the revision leans harder here, and it does, then start collecting that evidence now, because you cannot manufacture a year of decisions retrospectively.

Risks and opportunities are now separate requirements

In the 2015 edition, risks and opportunities were determined together and addressed together. The 2026 edition splits them. Clause 6.1.1 still has you determine both. But 6.1.2 Actions to address risks and 6.1.3 Actions to address opportunities are now separate requirements, each asking you to determine, analyse and evaluate, then plan actions and evaluate their effectiveness. Risk actions must be proportionate to the potential impact. Opportunity actions must be appropriate to your context.

For most certified systems this is the change with the most quiet rework in it. If you run a single combined risk and opportunity register, which most do, you now need to show that opportunities were determined, analysed and evaluated in their own right rather than listed as the upside column of a risk. The proportionality test is the other new hook, and it is easy for an auditor to sample: show me a high-impact risk, then show me the action was proportionate to it.

Planning of changes has more in it

Clause 6.3 goes from four considerations to seven. Purpose and consequences, impact on the integrity of the system, and availability of resources all survive, and allocation of responsibilities and authorities stays. What is added is the communication of the change, how the effectiveness of the change will be monitored and evaluated, and how the results will be reviewed. In practice that turns change planning from a before activity into something with an after, which is where most change records currently stop.

Terms, the annexes, and one thing that is not new

Clause 3 now carries a short set of core management system terms, though ISO 9000 remains the normative reference for quality vocabulary. Annex A has been expanded to explain the structure and intent of the requirements, and it is informative rather than a source of new obligations. Annex B has been removed.

A free transition checklist you can run yourself

We have turned the changes above into a checklist you can work through yourself. It covers only what changed, so it assumes you are already certified and already conform to the clauses that did not move. That makes it a transition checklist rather than a gap analysis, and considerably shorter than one. Twenty-eight criteria across six themes, each written as a question with the evidence an auditor would accept, and each marked new, strengthened or already required so you can see at a glance where the real work sits.

• Quality culture and ethical behaviour (5.1.1, 7.3, 7.1.4). Six criteria. Includes whether your subcontractors and labour hire are covered by the awareness requirement, which on most Australian sites is the majority of the people doing the work.
• Risks and opportunities, now separate (6.1.1 to 6.1.3). Six criteria. If you run a single combined register, and most certified systems here do, this is the theme with the most rework in it.
• Planning of changes (6.3). Four criteria covering the three considerations added to the clause, with a prompt to test them against a real change you made this year.
• Terms, annexes and documentation (clause 3, Annex A, Annex B). Three criteria, including the edition references sitting in your tender library, which is where they get missed.
• Climate change (4.1, 4.2). Three criteria, marked already required rather than new, because this arrived with Amendment 1 in February 2024. Covers the supplier climate questions that AASB S2 reporters are pushing down their supply chains.
• Transition housekeeping. Six criteria covering your certification body’s accreditation status, the transition plan they need from you before they can schedule anything, and getting the changed clauses into your internal audit programme and management review.

What it means if you’re already certified

The good news: this is not a rebuild. Organisations with a mature QMS, real leadership engagement, digital recordkeeping, meaningful risk management and some consideration of sustainability will find the transition mostly a matter of refining language, strengthening evidence and tightening a few processes. If your process maps have grown into one unreadable flowchart, our guide to clause 4.4 and the process approach shows how to redraw them in three levels.

The bad news, and I will be blunt because it is kinder than the alternative: a transition is a very unforgiving x-ray of a system that was never really implemented. If your QMS has been a folder that gets dusted off before surveillance audits, the revision will not be the problem. It will simply be the moment the underlying problem becomes visible. If that is you, the transition is an opportunity, not a threat. It is a legitimate reason to fix the thing properly, with a deadline attached.

ISO’s own transition cheatsheet, and what it leaves out

In August 2026 ISO published a one-page ISO 9001:2026 transition and readiness cheatsheet. It is worth reading, and the shape of it is sound: learn the changes early, work out who needs to know, look honestly at your current system, integrate where you run more than one standard, keep it proportionate if you are small, follow your certification body on timing, and write a transition plan.

What it does not do is attach a date to anything, or say what a good answer looks like. Those two omissions are the difference between a calm transition and a scramble. Here is the same list with the missing half filled in.

• “Familiarise yourself with the key changes.” Put a date on it. The standard was published on 16 September 2026 and the transition runs three years from there. Work backwards from the audits your certification body has already scheduled, not forwards from today.
• “Determine who needs awareness.” Naming the groups is the easy part. Clause 7.3 asks you to demonstrate awareness, so record what each group was told and when. A list of names with dates is evidence. An intention is not.
• “Reflect on your current QMS.” The questions are the right questions, but reflection is not an output. Turn each one into a decision recorded where an auditor can find it: context reviewed on this date, these issues added, these interested parties changed, these objectives revised.
• “Integrate if you run several standards.” Worth saying plainly: ISO 14001 has been revised too. If you hold both, transition them together. Running the same gap analysis, management review and internal audit twice is the most common avoidable cost of a transition year.
• “If you are a small business, keep it proportionate.” Agreed, and here is the test. If a change to your system does not alter a decision someone makes or a record someone keeps, it is documentation for its own sake. Leave it out.
• “Follow guidance from your certification body.” They need something from you first. Bodies get busy at the end of a transition window, and they cannot fit you in against a plan they have never seen.
• “Develop a high-level transition plan.” This is the item that carries all the others, and it is the one the cheatsheet says least about. The plan should name who owns each change, when the gap analysis, internal audit and management review happen, and which audit is the transition audit. Then send it to your certification body, so they can schedule that audit around it rather than you hoping a slot exists.

None of that is difficult. It is the difference between a document that describes a transition and a plan that produces one.

What I would do now

1. Find your recertification date and work backwards. That, not the end of the transition window, is your real deadline.
2. Run a gap analysis against the new requirements. The text is settled, so the answer will not move under you.
3. Start the leadership evidence trail immediately. It is the one thing you cannot create retrospectively, and it is where the revision bites hardest.
4. Split your risk register. Opportunities now need to be determined, analysed and evaluated in their own right, not carried as a column against a risk.
5. Ask your certification body two questions: when they can audit you against the 2026 edition, and which of your scheduled audits they expect to be the transition audit.

Frequently asked questions

Can we still get certified to ISO 9001:2015?

Technically yes, for now. Under the Global ACI transition requirements, an accredited certification body can still issue a new certificate to ISO 9001:2015 until 31 March 2028. But that certificate would itself need transitioning before 30 September 2029, and the 2015 edition is already withdrawn. If you are starting a system now, build it to the 2026 requirements and ask your certification body when it can certify you against them. There is no sense constructing something you would have to revisit within a year or two.

Is three years really enough time?

Comfortably, if you start. The organisations that struggle are not the ones with complex systems; they are the ones that treated three years as permission to do nothing for two and a half.

Do we need a consultant to transition?

Not necessarily. If you have a capable quality manager, ISO mentoring is usually the better value: your team does the work and keeps the knowledge, and we make sure it will pass. A transition is a particularly good fit for mentoring, because the system already exists. It needs judgement applied to it, not rebuilding.

What about ISO 14001 and ISO 45001?

ISO 14001 has also been revised. If you run an integrated system, plan the transitions together rather than sequentially. Doing them as one piece of work is materially cheaper than doing them twice.

Running a council? ISO 18091, the guidance standard written for local government, is built on ISO 9001:2015 and is not being revised alongside the 2026 edition. See local government quality management systems and the 2026 revision for what that means in practice.

Where to buy it. AS/NZS ISO 9001:2026 is available from the Standards Australia store, and it is the edition to buy: it is the current Australian designation and the one your certificate will name once you transition. Buying a copy is not a requirement of certification, but it settles arguments about what a clause says. Our ISO 9001 certification cost guide has the current price and the licence terms, which are worth reading first because a purchase covers one person and does not include future editions.

Talk to us about ISO 9001:2026

Whether you want us to run the transition, mentor your team through it, or simply give you an honest gap analysis so you know where you stand, you will deal directly with an experienced ISO auditor who has been through these cycles before.

Email hello@streamline.business, use our contact form, or call Brisbane 07 3667 8280, Sydney 02 8315 7780, or Melbourne 03 9034 3990.

Status as at 10 October 2026: ISO 9001:2026 is published, at stage 60.60, edition 6, with ISO 9001:2015 and its 2024 amendment shown as withdrawn. The companion vocabulary standard, ISO 9000:2026, was published in May 2026. AS/NZS ISO 9001:2026 was published on 18 September 2026 as an identical adoption, prepared by Joint Technical Committee QR-008 and approved by Standards Australia’s Standards Development and Accreditation Committee on 11 September 2026 and by the New Zealand Standards Approval Board on 2 September 2026. It supersedes AS/NZS ISO 9001:2016. Global ACI published the mandatory transition requirements on 16 September 2026 (Global ACI-TECH-3-TR 2029-09-30 (M)): transition ends 30 September 2029, and no new or initial accredited certifications to ISO 9001:2015 from 31 March 2028. A certification body needs its accreditation extended to the new edition before it can issue accredited certificates against it.