“Understand the changes. Close the genuine gaps. Keep what works.”
Entecom eBook · November 2026
Changes, Actions and Audit Timelines
A practical guide to the 2026 revision of ISO 9001 — the genuine changes, what to do about each one, and the transition timeline for certified organisations.
This eBook sets out what the 2026 revision of ISO 9001 changes, how organisations can address each change in a proportionate way, and when certified organisations will be audited against the new edition. Quality managers, process owners and top management can use it to plan a gap assessment and a transition that adds value rather than paperwork.
It supports — but does not replace — the published text of ISO 9001:2026 and the transition arrangements of your certification body.
This guide is based on the webinar presented by Lyndri Fourie, Food Safety Consultant and EO Builder at Entecom, on 27 October 2026. Whenever a standard is revised, the first questions are the same: what exactly has changed, and how much work will it mean? Do we rewrite procedures, add forms, change how we manage risk, or rethink the whole system?
The answer is reassuring. ISO 9001:2026 does not mean starting from scratch. An established ISO 9001:2015 system remains your foundation. The revision introduces some important changes, but not new principles. The mistake to avoid is overreacting — spending months rewriting good procedures simply because there is a new edition. Equally, nobody should assume that everything they do today automatically meets the revised requirements.
Figure 1 — The transition approach: three steps, not a rebuild.
This guide applies to organisations certified to ISO 9001:2015, organisations implementing ISO 9001 for the first time, and those working with other management systems who want to understand the revision. It is written for Quality Managers, process owners and top management, and for the consultants, auditors and trainers who support them. ISO 9001 applies to organisations of all types and sizes, so the guidance is not limited to food manufacturing.
This guide does not reproduce the text of ISO 9001:2026, is not an audit checklist and does not prescribe any particular software, form or register.
ISO 9001:2026 is the sixth edition of the standard. It was published on 16 September 2026, cancels and replaces ISO 9001:2015, and incorporates the 2024 climate change amendment. The familiar structure stays in place: the revision is about clarity, emphasis and a few genuinely strengthened requirements, not a new architecture.
| Change | Clauses | Type | In practice |
|---|---|---|---|
| Quality culture and ethics | 5.1.1 · 7.3 · 7.1.4 | New | Now within the requirements: top management promotes them and people must be aware of them. |
| Risks and opportunities | 6.1.1 · 6.1.2 · 6.1.3 | Strengthened | Determined together, then actions planned separately for risks and for opportunities. |
| Management of change | 6.3 | Strengthened | Reinforced and expanded: communication, monitoring effectiveness and reviewing results. |
| Core terms | Clause 3 | Structural | Key management-system terms now sit in clause 3 rather than by reference only. |
| Climate change | 4.1 · 4.2 | Structural | The 2024 amendment is built in: decide whether climate change is a relevant issue. |
| Annexes | Annex A · B | Informative | Annex A expanded with guidance on intent and terms; Annex B removed, references moved to Annex A. |
Two further changes run through the standard: organisational knowledge (7.1.6) is strengthened, and management review now explicitly considers changes in the needs and expectations of relevant interested parties and the effectiveness of actions on risks and opportunities. Both are covered in Section 5.
Comparing two editions turns up many differences. Some are significant; many are changes in terminology, structure or explanation. Treating every change in wording as a new requirement turns a manageable transition into a large project. For each difference, ask whether it is new, strengthened, clarified, or simply structural or editorial.
Practical tip · Sort every difference first
In your gap assessment, add one column that classifies each difference as new, strengthened, clarified or editorial. Filter on the first two and you can see your real workload at a glance — the rest usually needs no more than a reference update.
| ISO 9001:2015 | ISO 9001:2026 | Nature |
|---|---|---|
| “Maintain” and “retain” documented information | Documented information “available” (as evidence of) | Editorial |
| 6.1 risks and opportunities, together | Three subclauses, 6.1.1–6.1.3 | Strengthened |
| 6.3 planning of changes: four points to consider | 6.3: seven points to consider | Strengthened |
| 10.3 Continual improvement | 10.1 Continual improvement | Structural |
| 9.3.3 Management review outputs | 9.3.3 Management review results | Editorial |
| Terms by reference to ISO 9000 | Core terms in clause 3 | Structural |
| Annex B: other ISO/TC 176 standards | Removed; references in Annex A | Structural |
Each change below is set out using the same four questions, so you can see quickly where action is needed and where your existing system may already be enough.
Under 5.1.1, top management must demonstrate leadership by promoting quality culture and ethical behaviour, which show up in shared values, attitudes, practices and actions. Under 7.3, people must be aware of the organisation’s quality culture and ethical behaviour, and a note in 7.1.4 links social and psychological factors in the working environment to both. Annex A points to ISO 10010 for further guidance.
Quality culture is not the poster in reception. It is what people believe is really expected when there is pressure — and it is set by what leaders do when a deadline and a quality requirement collide.
Figure 3 — How culture forms: everyday leadership decisions become the norm.
What’s new
Explicit requirements for leaders to promote quality culture and ethics (5.1.1) and for people to be aware of them (7.3). Many organisations already do this — it is now written into the standard.
What an auditor looks for
Whether people’s account matches the policy under pressure — for example, “What would you do if told to skip an inspection because production was late?” — compared with incidents and nonconformities.
What to change
Define expected behaviours, who has authority over product release, and how to escalate when deadlines clash with quality requirements. Make sure leaders demonstrate them, and include culture and ethics in induction and awareness.
What can stay
Your quality policy, communication channels, induction and awareness training — update the content, keep the vehicle.
The revised 6.1 separates three activities. 6.1.1 covers determining the risks and opportunities that need attention; 6.1.2 covers planning actions to address risks; and 6.1.3 covers planning actions to address opportunities. Actions must suit what the organisation is trying to achieve, and their effectiveness must be evaluated. Many organisations produce long lists of what could go wrong and treat opportunities as an afterthought — or confuse risks with the actions taken to address them.
Risks · 6.1.2
What could stop us?
Opportunities · 6.1.3
What could make us better?
Actions
Plan and evaluate
Figure 4 — Three different things: an opportunity is not just a risk with a positive score.
What’s new
6.1 split into determining risks and opportunities, acting on risks and acting on opportunities. Leadership promotes risk-based and opportunity-based thinking, and both are evaluated in analysis and management review.
What an auditor looks for
“Give me an example of an opportunity you identified. What did you decide, and how do you know the action achieved what you intended?” A score on a register is not evidence of effective action.
What to change
Add an opportunity prompt wherever important decisions are made — equipment, objectives, projects and management review — with an owner and a way to tell whether it worked.
What can stay
Your existing risk method. ISO 9001 does not require a formal risk management methodology, a risk register or a separate opportunities register.
Practical tip · No separate register needed
Add an “opportunity?” prompt to the risk assessment you already use, and a standing management review item: “Opportunities pursued — and did they deliver?” That one change often covers most of the new 6.1.3 expectation.
Managing change is not new, but 6.3 now has seven points to consider instead of four. Alongside the purpose and consequences of a change, QMS integrity, resources (which now include information) and responsibilities, organisations must consider how the change is communicated, how its effectiveness is monitored and evaluated, and how the results are reviewed. A change that looks simple — such as a cheaper supplier of an apparently identical packaging component — can affect specifications, compatibility, production settings and verification.
Approving an idea for investigation is not the same as approving it for use: a controlled trial may come first, with the final decision based on its results. Step 5 is the one most often missed, because implementing a change does not prove it worked. Keep the level of control proportionate — a minor administrative change needs little, while a new supplier, new equipment or a modified critical process may need formal assessment, several approvals and a controlled plan. Software such as EO can manage this workflow, but a paper process or spreadsheet can be equally suitable.
Figure 5 — A planned change in five steps. A form is one option; the requirement is a planned, controlled change.
What’s new
6.3 expanded from four to seven points, adding communication, monitoring and evaluating effectiveness, and reviewing results. Resources now include information.
What an auditor looks for
One recent significant change followed end to end: why it was made, who assessed the consequences, who approved it, how people were told, and how you established that it achieved what you intended.
What to change
Define which changes trigger assessment and approval, with a route that scales from minor to significant — including supplier changes — and add an effectiveness review before closing.
What can stay
Supplier evaluation and approval (8.4) and control of changes in production (8.5.6), largely unchanged — connect them to wider change planning. Annex A points to ISO/TS 10020.
Organisational knowledge was already in ISO 9001:2015. The 2026 wording strengthens it: knowledge is to be retained, applied and shared to the extent necessary, to achieve the intended results of the QMS as well as product and service conformity. Knowledge can be documented, held in digital systems, or exist in people’s experience — and the last is the hardest to protect when an experienced person leaves.
Above the waterline · Documented
Below the waterline · Experience
Figure 6 — What would walk out of the door if your most experienced person resigned tomorrow?
What’s new
Knowledge retained, applied and shared to support the intended results of the QMS — not only product conformity. Knowledge is also distinct from competence: a competent new employee may still not know why a setting was introduced.
What an auditor looks for
“A key person has resigned. How will you avoid losing critical knowledge?” A handover plan, mentoring or demonstrations — not necessarily a knowledge register.
What to change
Identify where you rely too heavily on one person. Map critical know-how and single points of failure, and plan handovers through mentoring, job shadowing and lessons learned — not another long procedure.
What can stay
Competence and training arrangements (7.2). Technology helps, but a knowledge base doesn’t mean knowledge is being transferred or used.
Practical tip · Two handover questions
Ask your most experienced people: “What do you know that isn’t written down?” and “What do you check that nobody asked you to?” Their answers show where your single points of failure are.
The revision places more weight on showing that actions actually work. Actions on risks and on opportunities are evaluated separately in analysis and management review, and changes in the needs and expectations of relevant interested parties are now an explicit management review input. Clause 10 is restructured, with continual improvement at 10.1 and nonconformity and corrective action at 10.2. A recurring problem with the same corrective action recorded every month — “operators retrained” — is a sign the real cause has not been found.
| # | Clause | What the standard expects |
|---|---|---|
| 1 | 9.1.3 | Analyse the data — when did the problem start, which products, lines, shifts or batches, and what changed? |
| 2 | 10.2.1 b | Find the real root cause. “Human error” is where the questions should begin, not end. |
| 3 | 10.2.1 c | Act on the cause, not the symptom. |
| 4 | 10.2.1 d | Check that the action worked, with evidence that the cause has been addressed. |
| 5 | 9.3 | Management review decides on further action, resources or change. |
What’s new
Separate evaluation of actions on risks and opportunities; changes in interested-party needs as a review input; “review outputs” now “review results”; Clause 10 renumbered.
What an auditor looks for
Trends and recurring nonconformities, and corrective actions shown to be effective — not just closed.
What to change
Update the management review agenda, challenge investigations that routinely end in “human error” or “staff retrained”, and update clause references in procedures and training.
What can stay
KPIs, internal audits (9.2, largely familiar) and corrective action arrangements — provided the information they generate drives decisions.
The requirements on organisational context and interested parties have changed little. The climate change wording introduced by the 2024 amendment is now built in: organisations must determine whether climate change is a relevant issue, and recognise that interested parties may have climate-related requirements. This does not automatically mean a climate policy or a separate climate risk assessment. The practical point is that context is not an annual exercise — a customer changing requirements, a supplier disruption or new legislation should reach the people making decisions.
What’s new
Climate change relevance (from the 2024 amendment) now in the edition itself.
What an auditor looks for
“Tell me about a recent change affecting your customers, suppliers or environment. How did you pick it up, and what did you do?”
What to change
Link context reviews to real triggers and to management review. In a small organisation, a standing item in management meetings may be enough.
What can stay
Your SWOT, PESTLE or context register, if it is current and genuinely used. If you addressed the 2024 amendment, little more may be needed.
Core management-system terms now sit in clause 3, Annex A is expanded with guidance on the intent of requirements and on terminology, and Annex B has been removed. Wording such as “documented information shall be available” replaces the familiar “maintain” and “retain”; Annex A explains how to read it. These changes are worth understanding, but they do not create new obligations. ISO 9001 also does not require your documentation to follow its clause structure, so there is no need to renumber your quality manual.
What’s new
Terms in clause 3, expanded Annex A, Annex B removed, new documented-information wording.
What an auditor looks for
That your interpretation is consistent with the new terms, and references in key documents are current.
What to change
Correct any in-house definitions that conflict with clause 3, and update clause references and training material where needed.
What can stay
Effective procedures, records and document control. No need to mirror the clause structure.
Transition periods are set by the accreditation system, not by ISO. Global Accreditation Cooperation (Global ACI), which took over the work of the International Accreditation Forum, published mandatory transition requirements on the day the standard was published (Global ACI-TECH-3-TR 2029-09-30 (M)), establishing a three-year transition period. These requirements apply to accreditation bodies that are signatories to the Global ACI arrangement and to the certification bodies they accredit.
Figure 7 — Key transition dates under Global ACI-TECH-3-TR 2029-09-30 (M).
| Date | Milestone | What it means for you |
|---|---|---|
| 16 Sep 2026 | ISO 9001:2026 published; three-year transition begins | Obtain the standard and start your comparison and gap assessment. |
| By 31 Mar 2027 | Accreditation bodies ready to assess and support ISO 9001:2026 | Certification bodies start preparing to offer 2026 audits. |
| 30 Jun 2027 | Certification bodies submit transition declarations to their accreditation body | Ask your certification body when it expects to be able to audit to 2026. |
| 30 Sep 2027 | Accreditation body transition decisions completed | Most certification bodies should be accredited to audit to 2026 by now. |
| From 31 Mar 2028 | New and initial accredited certifications issued to ISO 9001:2026 only | Organisations certifying for the first time must certify to the 2026 edition. |
| 30 Sep 2029 | End of the transition period | Your transition must be complete. ISO 9001:2015 certificates remain valid until then. |
The transition can take place during a scheduled surveillance audit, during a recertification audit, or through a separate transition audit. Your ISO 9001:2015 certificate remains valid while you transition. Expect the certification body to look for evidence that you have:
A transition audit may need additional audit time compared with a routine surveillance visit. Arrangements, timing and duration can differ between certification bodies, so confirm them in writing with yours rather than assuming.
Most organisations will transition at a visit that is already in their three-year certification cycle. Use your next audit dates to work backwards:
| If your next audits are… | A practical approach |
|---|---|
| Recertification due in 2027 or 2028 | Plan to transition at recertification, once your certification body is accredited for 2026. Complete the gap assessment and changes well beforehand. |
| Only surveillance audits before September 2029 | Transition at a surveillance audit or book a separate transition audit — your recertification would fall after the deadline. |
| Not yet certified | Implement to ISO 9001:2026 now. From 31 March 2028 initial certification is only to the 2026 edition. |
| Any situation | Avoid the 2029 rush. Certification body capacity tightens near the deadline, and the audit should find changes already working. |
Practical tip · Ask your certification body in writing
Is your certification body accredited to audit ISO 9001:2026 yet? At which audit does it propose your transition? Will extra audit time — and cost — apply? What evidence does it expect to see? Written answers make your transition plan far easier to schedule.
The focus map below is a suggested starting point for prioritising your gap assessment. It is not a list of automatic nonconformities: your own assessment may show you are already strong in a “major” area, or reveal a weakness in one marked “little”.
| Area | Clause | Attention | Evidence that shows it works |
|---|---|---|---|
| Leadership, quality culture and ethics | 5.1.1 | Major | Leaders’ actions match the policy; people can describe how to escalate when deadlines and quality clash |
| Awareness of culture and ethics | 7.3 | Major | Induction and awareness content updated, and reflected in what people say and do |
| Risks and opportunities, separately | 6.1 | Major | Opportunities identified and acted on; actions on both evaluated for effectiveness |
| Planning of changes | 6.3 | Major | A recent change traced end to end, including communication and an effectiveness review |
| Organisational knowledge | 7.1.6 | Some | Critical know-how and single points of failure identified, with handovers planned |
| Evaluation and management review | 9.1.3 · 9.3 | Some | Updated review inputs; trends analysed; corrective actions proven effective |
| Context and climate change | 4.1 · 4.2 | Little | Climate relevance decided; context reviews linked to real triggers |
| Terms, annexes and wording | 3 · Annex A | Little | Clause references and training material updated where needed |
Six steps to transition
