ISO 9001:2026 is here. What actually changed?

After eleven years, ISO 9001 has a new edition. If you manage a quality management system, your first question is probably the practical one: how much of my QMS has to change?

The honest answer is less than you might fear, but the parts that did change are the parts auditors will go looking for first.

The sixth edition keeps everything structural that you already work with. The process approach is intact. Plan-Do-Check-Act is intact. Risk-based thinking is intact. The Clause 4 to 10 structure is unchanged, there are no new mandatory procedures, and the quality manual has not made a comeback. If your QMS conforms to ISO 9001:2015 today, it is a solid foundation rather than something to rebuild.

What changed is the emphasis. ISO has pushed the standard toward how an organisation actually behaves, not just what it documents.

The short version

The three that need real work

Quality culture and ethical behaviour is the headline change, and it is genuinely new. It appears in three places at once, which tells you ISO meant it. Top management must promote it. Every person doing work under your control must be aware of it. And it now explicitly shapes the environment in which your processes operate.

The obvious objection is that culture cannot be audited. ISO anticipated that. The standard says culture and ethical behaviour are reflected in an organisation’s shared values, attitudes, practices and actions, and those four words are effectively your evidence categories. Leadership communications, stated behavioural expectations, speak-up routes, recognition, and culture indicators reported into management review will all count. A poster in the break room will not.

Opportunities finally get their own clause. Most organisations built a risk register in 2015 and quietly ignored the opportunity half of the requirement. That is no longer possible. Clause 6.1 now splits cleanly, and both halves require you to determine, analyse and evaluate, then plan actions and check whether they worked. An empty opportunity register will be a finding.

Change management got teeth. Clause 6.3 grew from four considerations to seven. The new three are all about the back end of a change: how you communicate it, how you monitor and evaluate whether it worked, and how you review the results. Most change control processes are strong on approval and weak on post-implementation review. That gap is now explicit.

Two things being widely misreported

There is no AI requirement. A lot of commentary claimed the new edition brings in artificial intelligence, cloud and IoT requirements around data verification. It does not. ISO 9001 remains deliberately technology-neutral. Technology appears only in explanatory notes, never as a “shall”. If you need an AI management system, that is ISO 42001. Building an AI control set to satisfy ISO 9001:2026 is wasted effort.

Quality objectives must still be measurable. Some pre-publication coverage suggested this had been softened to “measurable where practicable”. It was not. The requirement is unchanged. Do not drop measurability from an objective on that basis.

The quiet one that will cost you an afternoon

Clause 10.3 no longer exists. Old 10.1 and 10.3 have merged into a single 10.1 Continual improvement. It is a small change to the standard and a tedious one for you, because every cross-reference to 10.1 or 10.3 in your procedures, compliance matrices, audit checklists and customer-facing mappings now needs remapping. It is mechanical, it is easy to forget, and it is very visible to an auditor.

Worth doing at the same time: the standard has dropped the old “maintain” versus “retain” distinction for documented information in favour of a single phrasing. The practical obligation has not changed at all, but if your SOPs quote the old wording, they now quote a version of the standard that no longer exists.

What to do now

You have time, but less than it looks. Certification bodies are working to a three-year transition, and the first certificates against the new edition are expected from around mid-2027. Confirm the exact deadline with your certification body, and book your transition audit early. Audit capacity always tightens sharply in the final year, and organisations that leave it late find themselves negotiating for slots rather than choosing them.

A sensible sequence:

1. Get the standard and read Annex A first. Twelve pages of ISO explaining what it meant by “appropriate” versus “applicable”, “consider” versus “take into account”, and “ensure”. It settles arguments you have been having with auditors for a decade.
2. Brief your leadership team on the culture requirement before you do anything else, because it needs them, not you.
3. Run a clause-by-clause gap assessment. Qualio’s compliance frameworks can help.
4. Do the mechanical sweeps like clause 10 references and documented information wording while the gap assessment is being reviewed.
5. Then work the content: opportunity register, change control, management review agenda, awareness training.

The bigger point

Read as a whole, ISO 9001:2026 is asking a slightly different question than its predecessor. The 2015 edition asked whether you had a system. This one asks whether the system reflects how your organisation actually operates and where it is going on: whether the quality policy connects to strategy, whether leadership behaviour matches the documentation, and whether you pursue opportunities as seriously as you mitigate risks.

For teams already running quality as a live function rather than an audit exercise, that is a welcome shift and a short transition. For teams whose QMS exists mainly to survive the annual audit, it is a harder one.

Notice what the three high-effort changes have in common. Culture is evidenced through values, attitudes, practices and actions, reported over time. Opportunities have to be determined, analysed and evaluated, then checked. Change has to be monitored after go-live and reviewed. None of that produces evidence in a pre-audit sprint. It produces evidence continuously, or not at all.