ISO 9001:2026 is here: what actually changes, and what to do about it
Marius van Aswegen
ISO 9001, the world's most widely adopted management system standard, has received its first full revision since 2015. ISO published the sixth edition on 16 September 2026, and the British Standard, BS EN ISO 9001:2026, is dated 30 September 2026.
If you hold ISO 9001, the clock on your transition has started. And if you hold ISO 27001, ISO 27701 or ISO 42001, the changes tell you where all of them are heading, because every ISO management system standard shares the same harmonised structure.
What stays the same
The core is untouched: the process approach, risk-based thinking and the Plan-Do-Check-Act cycle, and the clause structure you already know. If your QMS works today, it did not stop working on publication day. This is a sharpening, not a rebuild.
What actually changes
The standard itself lists its main changes, and they are more focused than some of the commentary suggests.
Quality culture and ethical behaviour are now written into the requirements, particularly in leadership, awareness and the environment in which processes operate. Leaders are expected to promote them, not assume they exist.
Risks and opportunities are separated. Rather than being treated as one idea, each is now identified, analysed and evaluated in its own right, with its own planned actions.
Management of change is strengthened. Changes to the quality management system are planned so they achieve their intended results, and their effectiveness is then monitored and reviewed.
Definitions and guidance move into the standard. Clause 3 now contains the core management system terms, while ISO 9000 remains the reference for quality vocabulary. Annex A has been rewritten to explain the intent of each clause, without adding requirements, and the old Annex B has gone.
One further point is often reported as new, but is not: the requirement to consider whether climate change is a relevant issue arrived with the 2024 amendment, which the 2026 edition now incorporates.
The transition window
Certified organisations have a three-year transition period, running to around September 2029. Certification bodies are publishing their arrangements over the coming months.
Our advice, from both sides of the audit table
Do not rush a transition audit in year one, but do run a gap review early. The culture and ethics elements need real evidence, and evidence takes time to accumulate. A fixed-scope gap review now gives you a prioritised plan and two full years to build the record your auditor will want to see.
There is a wider opportunity here too. ISO 9001 shares its harmonised structure with ISO 27001 (information security), ISO 27701 (privacy) and ISO 42001 (AI governance). Organisations that treat the 2026 transition as the moment to integrate their management systems, with one set of evidence and one audit programme, come out the other side with lower compliance costs, not higher ones.
Cybercontrols implements and audits ISO 9001 alongside ISO 27001, ISO 27701 and ISO 42001, and we hold ISO 27001 and ISO 42001 certification ourselves. If you would like a transition gap review, or simply a candid conversation about what the 2026 edition means for your organisation, get in touch.
