Everything that changed in ISO 9001:2026, clause by clause

Twenty core terms are now defined in the standard itself: organization, interested party, top management, management system and quality management system, policy and quality policy, objective and quality objective, risk, process, competence, documented information, performance, continual improvement, effectiveness, requirement, conformity, nonconformity, corrective action, audit, measurement, monitoring. ISO 9000 stays the normative reference for everything else.

Affects: Manual glossary; any procedure that defines its own terms

The climate-change sentence from the 2024 amendment is now base text: decide whether climate change is relevant to you. The notes widen the example issues: political and environmental issues outside, strategic direction and resources inside.

Affects: Context register

Decide which interested-party requirements the quality system will address, not only which parties and requirements are relevant. The climate note from the 2024 amendment stays.

Affects: Interested-party register: add an "addressed by the QMS" column

Same three inputs, restructured: name the product and service types covered, justify each requirement you treat as not applicable, and keep the scope available as documented information.

Affects: Scope statement

The process list is renumbered a) to i) and now starts with determining the processes and where they apply. 4.4.2 is restated in the new documented-information wording: information to run the processes, and evidence they ran as planned.

Affects: Process map; procedure cross-references

Top management promotes quality culture and ethical behavior. A new note says both show up in what people value, how they behave and what they actually do.

Affects: Quality policy; leadership evidence; management review agenda. What the requirement is and what counts as evidence.

The list is reordered to a) to l). Opportunity-based thinking is promoted alongside risk-based thinking (a new phrase), "continual" is added to promoting improvement, and accountability for the system moves to the last item.

Affects: Leadership evidence; cross-reference tables

The policy is "established" here; implementing and maintaining it move to 5.2.2. Context and strategic direction become their own item e), and the commitment is to "meet" applicable requirements.

Affects: Quality policy

The policy must be put into practice, understood and followed inside the organization, not only communicated.

Affects: Awareness records; policy deployment evidence

Reporting improvement opportunities to top management is now its own assigned duty, split from performance reporting. Keeping the system whole is required "including" when changes are planned and implemented. Processes must deliver intended results, not outputs.

Affects: Role descriptions; management review agenda; change control

Determination of risks and opportunities keeps its shape; the purposes are reordered and continual improvement is named as one of them.

Affects: Risk and opportunity register

Risks get their own sub-clause. They are determined, analyzed and evaluated, actions planned and integrated, and the actions checked for effectiveness. Actions must be proportionate to the potential impact on the intended results of the system. A note says risks include keeping supply going during and after a disruption.

Affects: Risk register; continuity arrangements. Why 6.1 was split, and how to rebuild the register.

Opportunities get their own sub-clause with the same steps: determine, analyze, evaluate, plan, integrate, evaluate effectiveness. Actions must fit your context and help reach the results you want.

Affects: Opportunity register: a new tab or a column that keeps them apart from risks. What an auditor asks for under 6.1.3.

The objectives list runs a) to h); keeping objectives as documented information is now an item in the list rather than a separate sentence.

Affects: Objectives record

Planning of changes now states its purpose, that changes are implemented effectively and reach their intended results, and adds three considerations: how the change is communicated, how you will monitor and judge whether it worked, and how you will review the results afterwards. Availability of information joins availability of resources.

Affects: Change control procedure and form

The note now says infrastructure applies to all types of work: on site, remote or a mix.

Affects: Infrastructure list

The social, psychological and physical factors are the same. The note adds that quality culture and ethical behavior can shape some of them.

Affects: Work environment assessment

7.1.5.2 is retitled "traceability of measurement results". Equipment is labeled so its calibration or verification state can be told, and the unfit-equipment sentence is restructured: when equipment is found unfit, decide whether earlier results were affected.

Affects: Calibration procedure

Knowledge must be retained, applied and shared, and it is tied to the intended results of the system, not only to product conformity. The note lists the forms it takes, including digital systems.

Affects: Knowledge register; handover and training records

Competence is what affects the performance of the system. Evidence in the new documented-information wording.

Affects: Competence matrix

Relevant quality objectives move to d). New e): awareness of the quality culture and ethical behavior the organization expects.

Affects: Induction; awareness training; toolbox talks. The three answers a machinist gives.

Evidence of conformity is "available" rather than "retained". The controls themselves are unchanged.

Affects: Document control procedure. The document control checklist lists the eleven references to search for.

The planning list is restructured: acceptance criteria for products and services and criteria for the processes are separate items, and documented information becomes two standalone sentences. "Outsourced processes" becomes externally provided processes, products or services relevant to the system, which must be controlled.

Affects: Quality plans; operational procedures

Contingency information now includes what happens if supply is interrupted. A new note lists the routes customer communication can take, from meetings to social media.

Affects: Customer communication procedure

The review happens before committing to supply; requirements "defined" by the customer replace "specified"; when the customer gives no written statement, confirm the requirements before acceptance. Evidence covers the review and any new or changed requirements.

Affects: Contract review record

When requirements change, the related documents are brought up to date and the people and parties concerned are told.

Affects: Change notification

New notes: design can be iterative, and inputs are not always fully known at the start. Inputs must be complete, unambiguous and adequate.

Affects: Design and development procedure; design input records

Customers and other parties that matter are involved in design planning (was: users). Outputs must include the accompanying information a user needs, including whatever makes provision safe and correct.

Affects: Design outputs; labels; instructions

Documented-information wording throughout; changes are "determined" rather than "identified"; outsourced processes now "are" inside the control of the system; 8.7.1 restructured to cover problems found after delivery or during a service. No new requirements.

Affects: Cross-reference sweep

Requirements to external providers now cover how the provider deals with your own customers and other parties that matter, how you control and watch provider performance, and verification at the provider's premises or another location.

Affects: Purchasing requirements

Work documents must be used, not just available. Identification and traceability is rewritten as a list a) to d) with the same requirements.

Affects: Work instructions; traceability procedure

The note names premises, intellectual property and personal data as kinds of customer or provider property.

Affects: Customer property register; data protection controls

The change record must show who authorized the change and any follow-up actions, as well as the review results.

Affects: Production change record

Methods "as applicable"; evidence in the new wording.

Affects: Monitoring and measurement plan

Monitor customer satisfaction and decide how the information is gathered, watched and reviewed. The note lists sources, adding feedback after delivery, customer meetings, dealer reports and social media.

Affects: Customer satisfaction method; data pack

The effectiveness of actions on risks and the effectiveness of actions on opportunities are separate evaluation items; the effectiveness of planning implementation is its own item.

Affects: Analysis report; management review data pack

The audit programme is its own sub-clause. Audit objectives are defined for each audit alongside criteria and scope, and results go to the relevant managers.

Affects: Audit plan template; Internal Audit Program Kit tab 2

Management review input: changes in the needs and expectations of interested parties relevant to the system.

Affects: Management Review Pack agenda item 2 and data pack

Opportunities for improvement move up the input list, and the effectiveness of risk actions and of opportunity actions are two separate inputs. The performance sub-list is reordered with nonconformities first.

Affects: Management Review Pack agenda item 10; data pack order. The two effectiveness inputs explained.

Outputs are now "results", stated in one sentence. The three decision areas are unchanged.

Affects: Minutes template

Continual improvement moves here from 10.3 and absorbs the old general clause. It must be fed: what the monitoring data, the analysis and the management review show is used to find opportunities, and the opportunities are acted on. Actions must include improving processes, products and services; addressing future needs and expectations; fixing, heading off or reducing unwanted effects.

Affects: Improvement procedure; management review results. The full clause 10 read: what changed and what an auditor asks for.

Complaints move from the opening sentence to a note as one source of nonconformities. "Reviewing and analyzing" becomes reviewing. Evidence in the new wording.

Affects: Nonconformity and corrective action procedure

Merged into 10.1. Every procedure, checklist and audit report that cites 10.3 now points at nothing. Why 10.3 is gone, and what to put in its place.

Affects: Cross-references in the manual and procedures

The list of other ISO/TC 176 standards is gone; the pointers move into Annex A notes and the bibliography.

Affects: Manual references

"Retain" and "maintain" documented information are replaced by wording about documented information being available, or available as evidence. Annex A explains which is which. Records are still records.

Affects: Document control procedure wording

Rewritten clause by clause, A.1 to A.10, and it now defines the words that cause arguments: appropriate versus applicable, consider versus take into account, continual versus continuous, ensure, strategic direction. It adds no requirements, but it is where interpretation arguments get settled.

Affects: Interpretation