# The ISO 9001:2026 transition

Source: https://goitf.com/en/resources/iso-9001-2026-transition

What changed in the sixth edition, what your existing certificate is worth, and how to work out when your transition audit lands.

ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015. The clause structure is unchanged. A 2015 certificate stays valid until it expires or the transition ends, whichever comes first, and the three-year transition is expected to run to September 2029.

## What was published on 16 September 2026

ISO published the sixth edition of ISO 9001 on 16 September 2026, replacing ISO 9001:2015. The clause numbering is identical. Requirements are refined across clauses 4 to 10, and ISO characterises the revision as primarily editorial with shifts in emphasis.

That phrase is doing a lot of work, so it is worth unpacking. Primarily editorial means the architecture you already built against is intact: same ten clauses, same Harmonized Structure, same documented information model, same audit logic. A quality management system that conformed on 15 September did not stop conforming on 16 September.

Shifts in emphasis means something different. A handful of requirements that were implied in 2015 are now written down, and a requirement that is written down is a requirement an auditor samples against. Quality culture is the clearest example. Plenty of organisations already had one. Very few had evidence of one, because nothing asked them for it.

The revision also absorbs the 2024 climate-action amendment, so if you already took that amendment into clauses 4.1 and 4.2, that part of the work is behind you.

## Your certificate did not stop working

Nothing happened to your certificate on 16 September. A certificate issued against ISO 9001:2015 stays valid until it expires or the transition ends, whichever comes first. You move to the 2026 edition inside the transition window, normally at a scheduled surveillance or recertification visit.

Transitions do not run as a separate audit in most cases. Your certification body adds transition time to a visit that was going to happen anyway, checks the changed requirements against your evidence, and reissues the certificate against the new edition once any findings are closed. The certificate expiry date usually does not move.

A three-year transition period is expected, ending in September 2029. The precise mechanics are the part nobody should be publishing yet: the last date on which a certification body may run an initial audit to the 2015 edition, the last date for transition audits, and the date on which 2015 certificates are withdrawn are set by an IAF resolution and then by each accreditation body's own instruction. Ask your certification body for their dates in writing. If they cannot give you one, that is itself useful information.

- Your certificate expiry date is the first thing to read, before any gap work
- A 2015 certificate stays valid until it expires or the transition ends, whichever comes first
- Transition is normally bolted onto a planned surveillance or recertification visit
- Your certification body sets your slot, so ask them for their published schedule

## Six changes, and everything else is wording

Six changes carry the revision: risks and opportunities split into 6.1.2 and 6.1.3, quality culture and ethical behaviour in 5.1.1 and 7.3, a new 5.2.1(e) linking policy to strategic direction, climate in 4.1 and 4.2, and Annex A rewritten.

Read the table below against what you already hold rather than against a blank page. On a mature system most rows come back already met, and the transition becomes a documentation exercise plus one or two genuine gaps. Finding out which is which is the whole job.

| Clause | What moved, and what it asks of your documents |
| --- | --- |
| 6.1.2 and 6.1.3 | The single risks and opportunities clause is split in two: risks in 6.1.2, opportunities in 6.1.3. Either split your register, or be able to show where opportunities are managed with an owner and an outcome rather than sitting as an appendix to the risk table. |
| 5.1.1 | Leadership is now explicitly required to promote quality culture and ethical behaviour. This is evidenced through what leaders do and record, not through a new policy document. Management review minutes, briefings and how a bad-news report is handled are the evidence. |
| 5.2.1(e) | A new requirement that the quality policy connects to the organisation's context and strategic direction. Most policies currently do not, because they were written to be framed on a wall. Re-issue the policy with that link written into it. |
| 7.3 | Awareness extends to quality culture and ethical principles. Your induction and refresher content changes, and so does the attendance record that proves it was delivered. |
| 4.1 and 4.2 | Climate change is carried in from the 2024 Harmonized Structure amendment rather than being new here. If you took that amendment when it landed, this row is already closed. |
| Annex A | Rewritten as applied guidance rather than a concept note. This is reading for the quality manager, not a documentation change. |

## Working out when your transition audit lands

Your slot is set by your certificate, not by the publication date. Count the surveillance visits left before expiry, pick the one with enough room to close findings before the transition window ends, and finish the delta work before that visit.

A certificate expiring in 2027 transitions at recertification next year, which means the work starts now. A certificate expiring in 2029 has a surveillance visit or two to use first, and the sensible move is the last surveillance that still leaves a full audit cycle inside the window. Leaving it to the final months is the expensive option: audit capacity in the last quarter of a transition is scarce in every scheme, every time.

There is one case that is not optional timing. If you are certifying for the first time, ask your certification body which edition they will audit you against before you sign. Being audited to a superseded edition and then transitioning within a year is paying twice.

## A sequence that works

Run it in this order: read your certificate, do the clause delta, fix the genuine gaps, re-issue documents, brief your people, internal audit against the 2026 edition, then management review. The audit comes last because it has to have something to audit.

The order matters more than the speed. Teams that re-issue documents first end up re-issuing them twice, because the delta review finds a register that has to split and a policy that has to be rewritten anyway.

- Read the expiry date on your certificate and confirm your transition slot with your certification body
- Run a clause-by-clause delta, marking every changed requirement as already met, met but unevidenced, or open
- Close the open rows first. There are usually two or three, and they are usually 6.1.3 and 5.2.1(e)
- Re-issue every document, form and register that cites ISO 9001:2015, working from a controlled list
- Brief your people on what changed and keep the material and the attendance record
- Run one internal audit against the 2026 edition across the whole scope
- Take the results to management review, then go into the transition visit

## What the auditor will ask to see

Expect four requests: the re-issued policy showing the link to strategic direction, opportunities managed separately from risks, awareness records covering quality culture, and an internal audit conducted against the 2026 edition rather than the old checklist.

The fourth one is the easiest to miss. An internal audit programme runs on a checklist, the checklist was built in 2016, and nobody rebuilt it. The audit then produces no findings against the changed requirements, which tells the external auditor that the internal programme has not looked at the new edition at all.

Rebuild the checklist as part of the documentation, within a week of the gap analysis. It helps you find your own gaps before somebody else does.

## The find-and-replace trap

The common failure is a document set where every mention of 2015 became 2026 and nothing else changed. It passes a document review and fails the moment the auditor asks for evidence behind a requirement that was added, not renumbered.

It happens because the revision genuinely is small, and small revisions invite a clerical response. The version number changes on the master list, the forms get a new footer, the manual gets a new date, and the system underneath is still the 2015 system.

Then the auditor asks where opportunities are tracked, or what the organisation does about ethical behaviour, or how the policy relates to the strategic direction the board actually set. Those are answerable questions for most businesses. They are not answerable from a find and replace, and the finding that gets written is against clause 5 or clause 6, which is not a comfortable place to collect one.

The opposite mistake costs more. Nobody needs a new manual, a new process map or a fresh build against the 2026 edition. Any proposal that reads like a first certification project for an organisation that is already certified is selling the same system twice.

## Questions we are being asked this week

### Is our ISO 9001:2015 certificate still valid?

Yes, until it expires or the transition ends, whichever comes first. Publication of a new edition does not invalidate certificates issued against the previous one. You transition within the window, normally at a planned surveillance or recertification visit.

### What is the exact deadline?

A three-year transition is expected, ending in September 2029. The day-level dates, including the last date for transition audits and the date 2015 certificates are withdrawn, come from the IAF resolution and then from each accreditation body. Get your certification body's dates in writing rather than a figure from a blog.

### Do we need a new quality manual?

No. A manual has not been a requirement since the 2015 edition, and the clause structure did not change in 2026. If you keep one because it is useful, update the clause references and the policy section and leave the rest alone.

### How much work is this, honestly?

For a working system, it is a delta review, a re-issue of affected documents and evidence for the changed requirements. Documentation: within a week of the gap analysis. Your team then runs the system; the internal audit and management review need records of it in use. You and your certification body set the pace.

### We are certifying for the first time. Which edition applies?

Ask your certification body before you sign. During a transition window a body may still be able to audit to the outgoing edition for a period, and accepting that means transitioning again within a year or two. Certifying directly to ISO 9001:2026 avoids paying twice.

### Does this affect our ISO 14001 or ISO 45001 certificates?

ISO 14001:2026 was published on 15 April 2026 and carries its own transition. ISO 45001 remains the 2018 edition and ISO 22000 remains the 2018 edition plus its 2024 amendment. If you run an integrated system, plan the 9001 and 14001 transitions as one piece of work and audit them together.

### Will our certification body tell us what to do?

They will tell you when your transition audit is and what they will sample. They cannot design your system for you or tell you how to close a gap, because that is consultancy and it would compromise their impartiality. The gap between those two things is where the work sits.

Contact: [ops@goitf.com](mailto:ops@goitf.com) · [+966 55 682 4636](tel:+966556824636) · [WhatsApp](https://wa.me/966556824636)