ISO 9001: what it is, who needs it, and how certification works

What is ISO 9001?

ISO 9001:2026 is the international standard for a quality management system at an organisation of any size, in any industry. It sets out what the system has to cover, from leadership and planning to operation, measurement and improvement, and leaves the how to you. An accredited certification body audits the system and issues the certificate.

The 2026 edition is the sixth, published on 16 September 2026, and replaces ISO 9001:2015 and its 2024 amendment. It keeps clauses 4 to 10 on the harmonised structure (Annex SL) that ISO's management system standards written since 2012 share, which the 2015 edition introduced along with risk-based thinking in place of preventive action. Certificates to the 2015 edition stay valid through the transition, which ends on 30 September 2029.

Who needs ISO 9001?

Suppliers and contract organisations to device and pharma companies, whose customers ask for the certificate in supplier qualification before the first order

Software vendors, labs and service companies selling into regulated customers, where the certificate is the first question on the vendor questionnaire and ISO 27001 or ISO 42001 is built on the same clauses

The standard becomes urgent when a customer's supplier qualification asks for the certificate, when the registrar's surveillance date lands and the last management review was a year ago, or when a tender asks for the certificate and there is not one yet.

What ISO 9001 asks for, clause by clause

Clauses 1 to 3 are scope, references and terms. The requirements the registrar audits are clauses 4 to 10, on the harmonised structure ISO's management system standards share, and risk-based thinking runs through all of them.

Clause 4, context of the organisation

The internal and external issues that affect the system, the interested parties and what they require, the scope of the system, and the processes it runs on

Clause 5, leadership

Top management's commitment, a quality policy, customer focus, and roles, responsibilities and authorities assigned and communicated

Clause 6, planning

Actions to address risks and opportunities, quality objectives with plans to achieve them, and planning of changes to the system

Clause 7, support

Resources, competence and training with records of both, awareness, communication, and documented information under control (7.5)

Clause 8, operation

Operational planning and control, customer requirements, design and development (8.3), control of externally provided processes, products and services (8.4), production and service provision, release, and control of nonconforming outputs (8.7)

Clause 9, performance evaluation

Monitoring and measurement including customer satisfaction, analysis and evaluation, internal audit (9.2), and management review (9.3)

Clause 10, improvement

Nonconformity and corrective action (10.2), and continual improvement

How ISO 9001 certification works

1. Gap assessment

Read your procedures and records against every clause and list what is missing, unwritten or not followed.

2. Set the scope and the processes

Write and approve the procedures the gaps call for, and train the people who will run them.

3. Run the system and keep the records

4. Stage 1 and Stage 2 audits

The registrar reviews the documentation and confirms you are ready, then audits the running system on site and issues the certificate or a list of nonconformities to close first.

5. Surveillance and recertification

A surveillance audit each year and a full recertification audit every three years, with every change in between kept in the records the registrar will read.

ISO 9001 IN QUALIO

Qualio maps every procedure and record to ISO 9001 and to the standards you hold beside it, so you answer each requirement once

Qualio breaks ISO 9001 down clause by clause and maps your procedures, training records, supplier files and corrective actions to each one, beside ISO 13485, cGMP or ISO 27001, so one record answers a shared requirement. It reassesses when a record changes and recommends a fix on each gap. Copilot drafts the update and your team approves it. Before the surveillance audit, you export the audit pack by clause.

Documented information for clause 7.5, with training assigned on the effective date of every revised procedure for 7.2

Nonconformity and corrective action for clause 10.2, each traceable to the nonconformance or complaint that raised it

Supplier evaluation for clause 8.4, with each supplier's approval, audits and corrective action requests held against it

Management review run as an event for clause 9.3, reading the internal audits, which run as events too, customer feedback and open corrective actions as they stand

Standards that apply alongside ISO 9001

Medical devicesISO 13485: Built on ISO 9001 and written for medical devices, on the older eight-clause structure, so a device company holding both has most of the shared records already
Pharma manufacturingICH Q10: The pharmaceutical quality system guideline, built on ISO 9001's concepts and applied across the product lifecycle, which a pharma company holds beside GMP
Management systemsISO 27001: The information security management system standard, on the same Annex SL structure, and the certificate a regulated customer asks a software vendor for next
Management systemsISO 42001: The AI management system standard, on the same structure, for companies whose product or operations run on AI
LaboratoriesISO/IEC 17025: The competence standard for testing and calibration laboratories, which carries ISO 9001's management requirements and adds technical ones

RMS

ISO 9001 certified in 7 months, with zero non-conformances. RMS built its first-ever quality system from scratch and passed ISO 9001 with zero non-conformances.

Read the RMS story

“We selected Qualio based on functionality and ease of transition. We now leverage Qualio across our entire organization.”

Holly RundleDirector of Compliance, StayinFront

Guides and checklists for ISO 9001

Toolkit

ISO 9001 toolkit

Checklist

ISO 9001 compliance checklist

Guide

How to prepare for ISO 9001 certification

Questions about ISO 9001

What is ISO 9001?

ISO 9001:2026 is the international standard for a quality management system, written for organisations of any size in any industry. It sets out what the system has to cover and leaves the how to each organisation. An accredited certification body audits the system and issues the certificate, which customers in life sciences ask their suppliers and vendors for.

Is ISO 9001 mandatory?

No law requires it. In life sciences a customer asks for it, in supplier qualification, a vendor questionnaire or a tender. Regulators do not inspect against it, and the certificate does not stand in for ISO 13485, the QMSR or GMP. Some customers accept it in place of their own supplier audit.

What is the difference between ISO 9001 and ISO 13485?

ISO 13485 is built on ISO 9001 and written for medical devices. It keeps the older eight-clause structure, adds risk management through every process, design and development controls, traceability and complaint reporting to regulators, and leaves out ISO 9001's customer satisfaction and continual improvement requirements. A device company can hold both, and most of the records serve both.

What is Annex SL, and does ISO 9001 follow it?

Annex SL is the harmonised structure ISO gives its management system standards: context, leadership, planning, support, operation, performance evaluation and improvement as clauses 4 to 10. ISO 9001 has followed it since the 2015 edition, as ISO 27001 and ISO 42001 do, so a company holding more than one certificate writes the shared clauses once and adds each standard's own requirements. ISO 13485 is the exception, on its older structure.

How long does ISO 9001 certification take?

It depends on the starting point. A company with no written procedures needs time to write, approve and train them, then months of records, an internal audit and a management review before the Stage 2 audit. A company already running a system that fits the standard can be certified inside a year.

What is the current version of ISO 9001?

ISO 9001:2026, published on 16 September 2026. It replaces ISO 9001:2015 and its Amendment 1:2024, both now withdrawn. A certificate to the 2015 edition stays valid during the transition, which ends on 30 September 2029, and has to move to the 2026 edition by then.

Is Qualio ISO 9001 certified?

Yes. The certificate is available for your supplier qualification file on request, so the vendor questionnaire has its answer before the quality review starts.

Can we add ISO 9001 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every clause, so the procedures, training records and supplier files that answer ISO 13485, cGMP or ISO 27001 count towards ISO 9001 without being re-filed. The first assessment lists what is covered and what is new.

When is the surveillance audit?

Bring the date and your procedures. We will show you ISO 9001 assessed against them clause by clause, beside the standards you hold, with the gaps listed and the audit pack exported.

Book a demo Get the ISO 9001 toolkit

Less time on audit prep. More time on quality.