ISO 9001:2026 clause 10: what changed in Improvement, and what an auditor now asks for

The new shape of clause 10

In the 2015 edition, clause 10 had a general improvement requirement at 10.1, nonconformity and corrective action at 10.2, and continual improvement at 10.3. In the 2026 edition there are two parts.

Watch it and read the clause guide

Twelve minutes on every 2026 change, from the floor. For what an auditor accepts under 10.2 and what gets reopened, read the clause 10.2 corrective action guide.

10.1 Continual improvement: what changed

The 2026 clause opens with the duty that used to sit at 10.3: keep improving how suitable, adequate and effective the quality management system is. Then it adds three things the 2015 text did not say.

1. Improvement now has a named source

You are required to look at what your monitoring, measurement, analysis and evaluation produced, and at what management review concluded, and to pull improvement opportunities out of those results. Then you are required to act on those opportunities inside your continual improvement work. In 2015 the standard said to determine and select opportunities; it did not say from where. Now it does, and an auditor can trace the line from a data review or a management review conclusion to an improvement action and ask where the gap is.

2. The action list was rebuilt

Three kinds of action are required. Improving processes, products and services (processes are new to that item). Addressing future needs and expectations, which was tucked inside the products-and-services item in 2015 and is now a line of its own. And correcting, preventing or reducing unwanted effects, which is unchanged. The 2015 item about improving how the system performs and how effective it is has gone as a list entry, because it is now the opening sentence of the clause.

3. The note changed its examples

The 2015 note listed correction, corrective action, continual improvement, breakthrough change, innovation and re-organization as examples of improvement. The 2026 note names step-by-step and breakthrough change, innovation, and reorganization as the routes. Correction and corrective action are no longer offered as examples of improvement; they live in 10.2 as the response to nonconformity. That is a small change with an audit consequence: a corrective action register alone is no longer the obvious evidence of continual improvement.

Annex A, which is informative, adds context that is worth reading once: improvement can arise from changes in context, from risks and opportunities, and from adopting technology, and improvement activity can mean adapting processes, knowledge and resources to internal and external change. None of that is a requirement. All of it is the frame an auditor now carries into the clause.

10.2 Nonconformity and corrective action: what changed

The sequence is the one you already run. React to the nonconformity, control and correct it, deal with the consequences. Decide whether the cause needs eliminating by reviewing the nonconformity, finding the causes, and checking whether similar ones exist or could occur. Act. Review whether the action worked. Update the risks and opportunities you planned against if needed. Change the system if needed. Keep records of what the nonconformity was, what you did, and what the corrective action achieved.

Four wording changes, none of which change the steps:

• Complaints moved. The 2015 opening sentence named complaints as a source of nonconformities. In 2026 that sits in a note, which says only that complaints are one place nonconformities can come from. Same meaning, weaker grammatical position. Do not read it as permission to keep complaints out of the corrective action process; read it as the standard no longer singling them out.
• "Reviewing and analysing" became "reviewing." The review step of cause evaluation dropped the word analysing. In practice the causes step still requires the analysis.
• "Could" became "can." Similar nonconformities that exist or can potentially occur. A tense change; auditors will not raise it, but a find-and-replace will find it.
• Records are "available as evidence." The retain-documented-information sentence is replaced by the 2026 phrasing used throughout the standard. The two records required are the same: what the nonconformity was and what was done about it, and what the corrective action achieved.

Annex A says the organization decides how far to investigate and which methods to use, based on its context, and that it weighs the risk of recurrence, the actual or potential impact, and customer and interested-party requirements when deciding whether corrective action is applied at all. Again informative, but it is the clearest statement yet that a proportionate response is expected and that "we raise a CAPA for everything" is not the standard's idea of rigor. It points to ISO 10002 for complaints handling.

10.3, which is gone

There is no 10.3 in the 2026 edition. The requirement moved to 10.1 and grew. The number is what breaks: continual improvement procedures, audit checklists, management review agendas, training slides and objectives dashboards that cite 10.3 now point at nothing. That is a finding an auditor can raise in the first hour by picking a document and opening the standard.

The full treatment of what the missing clause does to a working system, and the seven places it usually hides, is on its own page: ISO 9001:2026 clause 10.3: why it is gone and what replaced it.

Where clause 10 reaches the rest of the system

Clause 10 is short because it is downstream of everything else. Four connections matter in the 2026 edition.

• 9.1.3 Analysis and evaluation. The results here are now a named input to 10.1. The 2026 list evaluates the effectiveness of actions on risks and on opportunities as separate items. Improvement opportunities are supposed to fall out of that evaluation.
• 9.3.2 and 9.3.3 Management review. Review inputs now include opportunities for improvement earlier in the list and the effectiveness of risk actions and opportunity actions separately; review results (retitled from outputs) include improvement opportunities. 10.1 says management review results are where improvement comes from. If your minutes do not show improvement opportunities identified and assigned, 10.1 has no evidence trail.
• 6.1.2 and 6.1.3 Risks and opportunities. Corrective action step e) still requires updating the risks and opportunities determined in planning. With 6.1 split into risks and opportunities as separate sub-clauses, the update has two registers to touch, or two sections of one.
• 6.3 Planning of changes. Corrective action step f) is changes to the system. 6.3 now has seven considerations for a planned change, including how it is communicated and how its effectiveness will be checked. A corrective action that changes the system is a planned change.

What an auditor looks for under clause 10 in 2026

1. A trail from data to action. Show a monitoring result or a management review conclusion, the improvement opportunity it produced, who owns it, and what happened. Objectives that moved, a process that changed for a reason, a product or service that got better. A list of intentions is not evidence.
2. All three action types. Something improved in a process, product or service. Something addressed a future need or expectation, which ties back to your 4.2 review of interested parties. Something corrected, prevented or reduced an unwanted effect, which ties to 10.2 and to your risk actions.
3. Corrective actions that closed the loop. For a sample of nonconformities: the reaction, the cause, the check for similar cases, the action, and the effectiveness review with data. "We did it" is not the evidence. "It worked, and here is the measure" is.
4. The register updated. Corrective actions that changed a risk or an opportunity, and the risk and opportunity records showing the change.
5. Complaints inside the process. Complaints handled as one source of nonconformities, not in a separate customer-service loop that never reaches the corrective action register.
6. Proportion. Evidence that you decide how deep to investigate based on recurrence risk and impact, not that every nonconformity gets the same form.

The clause 10 document sweep

Run these searches through your document system before an auditor does. The full eleven-string list for the whole standard is on the document control checklist.

Questions