Glocal Insight

Maintained reference

What changed in ISO 9001:2026, ranked by how well it is sourced.

The standard is published, and copyrighted — so nobody can lawfully reproduce it, and almost nobody writing about it has read it, including us. What exists is ISO’s own short summary and a large volume of published commentary, some of it precise and some of it apparently invented. This page separates the three.

Transition support → Publication tracker

Last verified October 3, 2026

Start here: we have not read the standard

ISO published the sixth edition on September 16, 2026. We have not bought a copy, and we are not going to pretend otherwise. Even if we had, we could not republish it — the text is copyrighted, which is why no page anywhere can legitimately hand you a full clause-by-clause comparison.

That constraint did not go away at publication, it changed shape. Before September 16 the honest position was that the text was not final and not public. After it, the honest position is that the text is public but not free to reproduce. Either way, a page promising a definitive clause-by-clause comparison of ISO 9001:2015 against ISO 9001:2026 is doing one of two things: working from a copy it is not permitted to reproduce, or filling in the gaps. Several of the pages currently ranking for that query are visibly doing the second.

What we can do honestly is assess the claims. When three certification bodies independently cite the same subclause number for the same change, that is meaningful evidence. When one publisher asserts that the revision adds artificial intelligence requirements, and cites no clause and no source, and no other publisher mentions it, and ISO's own page does not mention it — that is meaningfully different. The entire value of this page is the distinction.

The primary source, which nobody links

The September 16, 2026, date is repeated across dozens of commercial pages. In our review, not one of them linked to where it comes from.

It came from ISO/TC 176/SC 2 — the subcommittee that actually writes ISO 9001 — in a news item dated August 7, 2026, which stated that the FDIS “has been approved with overwhelming international support” and that the sixth edition “is scheduled for publication on 16 September 2026.” The schedule held exactly.

What ISO said on publication day, verbatim. The edition “places greater emphasis on leadership, a culture of quality and ethical behaviour.” It gives “greater clarity on the consideration of risks and opportunities to support better strategic decision-making.” “A new section also helps users better understand the intent of the requirements and apply them consistently.” And it “adopts the latest Harmonized Structure for ISO management system standards, making it easier to integrate ISO 9001 with other management system standards.” ISO added that ISO 9001 would be part of its first offering of digitally enhanced content from October 1, 2026, and its page for the standard now lists that format alongside PDF, ePub, redline and paper. ISO describes it as a more interactive way to navigate the standard; it is a format, not a change to the requirements.

Those four sentences are the whole of what ISO itself has said about the content of this edition. Note what is not in them: no clause numbers, and no mention of artificial intelligence, digital systems, supply-chain resilience, or ESG beyond climate. Everything below this point is somebody’s reading of the text, sorted by how many somebodies.

Read it yourself. It takes thirty seconds, and it is worth doing with any claim on any page, including this one.

The caveat we carried here until publication — that ISO’s project record showed only “2026-09” with no day, and that this standard had slipped once already, its first committee draft referred back as not mature enough — is resolved. It published on the scheduled day.

Tier 1 — corroborated. Plan around these.

Cited with the same subclause number by three or more organizations publishing independently. Where ISO's own material uses similar language, we have said so.

ClauseClaimed changeWho says so
5.1.1 Quality culture and ethical behavior become explicit expectations on top managementThe most-corroborated change in the whole revision, and the only one ISO's own page names in similar language. Also the hardest to evidence, because culture is demonstrated by a track record rather than a document. DNV, DQS, TÜV SÜD, BSI, SGS — and thematically by ISO itself
6.1.2 / 6.1.3 Risks and opportunities separated into distinct subclausesPractically the most disruptive change for a working system. Most organizations run a single combined risk-and-opportunity register; that needs restructuring into distinct treatments. DNV, DQS, TÜV SÜD — with the same numbering, independently
7.3 Awareness requirements extended to quality culture and ethical conductTouches onboarding and training records, which is cheap to fix and easy for an auditor to sample. DQS, TÜV SÜD, BSI, ANSI's blog
Clause 3 QMS terms carried in the standard itself, reducing reliance on ISO 9000Mostly a usability change. Worth knowing if your documented information cites ISO 9000 definitions by reference. DNV, BSI, SGS, ANSI's blog
Annex A Annex A expanded; Annex B removed and its references folded inAnnex A is informative, not auditable — but it is the context an auditor uses to interpret intent, so it is worth reading first rather than last. ISO's own page, ANSI's blog, TÜV NORD
4.1 / 4.2 Climate change considerations embedded rather than appendedSee the correction below. This is integration of text that has already been in force since the 2024 amendment — not a new requirement arriving in 2026. DNV, DQS, BSI, SGS, and ISO's guidance brochure

Tier 2 — thinly sourced. Watch, do not budget.

Claimed by one or two organizations, or corroborated only loosely. Plausible, not established.

ClauseClaimed changeWho says so
6.3 Change management reinforcedPlausible — ISO 14001:2026 added a change management clause at 6.3 — but the parallel is suggestive rather than evidence. DNV, with a looser echo from SGS and ANSI's blog
5.2.1 e) Quality policy must reflect organizational context and strategic directionSmall if true. A one-paragraph policy revision rather than a project. DQS and SGS
10.1 Continual improvement consolidated from the old 10.1 and 10.3Single-sourced. We are listing it because DNV is among the most accurate publishers on this revision, not because it is confirmed. DNV only, at this level of specificity

Tier 3 — circulating widely, supported by nothing

Each of the following is asserted on at least one published page, sometimes by a large and reputable organization. None of them carries a clause number anywhere we could find. None appears in any of the clause-level accounts. None appears on ISO's own ISO 9001:2026 page or in its guidance brochure.

  • New requirements on artificial intelligence, digital transformation or “digital systems”
  • Cybersecurity or data-integrity requirements, including in internal audit scope
  • Supply chain resilience or supply chain oversight requirements
  • ESG or sustainability requirements beyond the existing climate amendment
  • Organizational resilience as a new requirement
  • Expanded stakeholder engagement requirements

We think we know where these came from. ISO 9001 went through its committee draft stage in 2023 and 2024, when a great deal of speculative commentary was written about what the revision might contain. Much of that commentary was never revisited after the draft matured. It is still ranking.

The practical risk is not that you will be surprised at your audit. It is that you will spend money now on requirements that do not exist. A cybersecurity workstream added to your quality management system because a blog said ISO 9001:2026 would require one is a real cost incurred against an imaginary obligation.

Two specific errors worth knowing about

Both of these appear on the page of a major certification body. We are naming the claims rather than making a general complaint, because a claim you can check is more useful than a warning you cannot.

Claim: the 2026 edition gives ISO 9001 an annex of supplementary guidance for the first time.

Checkable, and incorrect. ISO 9001:2015 already contains an Annex A, clarifying the new structure, terminology and concepts, and an Annex B listing other ISO standards on quality management. What is reported for 2026 is that Annex A is expanded and Annex B is removed, with its references folded into Annex A and onto the TC 176 website. That is a real change. It is not a first annex.

Claim: climate change and sustainability are now explicitly part of ISO 9001, as of the 2026 edition.

Misleading on timing. Climate change considerations entered ISO 9001 through the 2024 amendment, which added text at clauses 4.1 and 4.2 and has been in force since February 2024. If your management system is current, you have already dealt with this. What the 2026 edition reportedly does is embed that text rather than carry it as an amendment. Presenting it as a new 2026 requirement invites organizations to redo work they finished two years ago.

To be fair to the bodies concerned: both publish a great deal of accurate material, and both are doing something genuinely difficult — writing about a standard before it exists. We have made and published our own corrections on this site, including retracting a change list we had wrongly attributed to ISO. The point is not that anyone is careless. It is that on this topic, right now, you should check.

The deadline claim, before and after the document

Before September 16, 2026, most of the certification body pages we reviewed stated or implied a three-year transition ending around September 2029. The wording varied — “expected,” “anticipated,” “likely,” “typically” — and in several cases no source was offered at all. One body, DNV, was explicit that its source was a draft Global ACI document and that no final official source existed yet. That was the honest version, and it was rare.

Here is what was published at the time. Global ACI, which replaced IAF and ILAC on January 1, 2026, and is the body that sets transition periods for accredited certification, lists in its own General Assembly resolutions the inherited documents it will continue to develop. One entry reads:

IAF MD XX Transition Requirements for ISO 9001

That was true when written, and is no longer. The document was issued as Global ACI-TECH-3-TR and announced on Global ACI's news page on September 16, 2026. We checked the resolutions and the news feed on the 16th, 17th and 18th and missed it each time, because we searched rather than read the source. The quote above is kept as the evidence trail, not as a live conclusion.

We declined to print three years as a date until a document said so. The document now does, and the expectation was right: September 30, 2029, set by Global ACI-TECH-3-TR. Our transition tracker carries all five dates and the full evidence chain.

What to do with this now

If the question behind your reading is whether to certify to the 2015 edition now or wait for the 2026 one, that is a different decision with a different deadline — March 31, 2028, not 2029. We set it out in can you still certify to ISO 9001:2015?

The fuller version of this, phased across publication and the transition window, is our ISO 9001:2026 transition checklist.

Two things, and neither of them depends on the final text saying what anyone expects.

Start the slow work. The two most-corroborated changes — leadership and quality culture evidence, and separating risks from opportunities — are also the two that cannot be done quickly. Culture is demonstrated by a record of decisions over time: what got recorded when quality and schedule conflicted, how a concern raised on the floor was closed out, what leadership actually did rather than what the policy says. You cannot generate twelve months of that in the month before an audit. Splitting a combined risk-and-opportunity register is a smaller job, but it is far easier done calmly than in a queue behind everyone else.

Ignore Tier 3 until something supports it. If a proposal on your desk adds an artificial intelligence or cybersecurity workstream to your quality management system on the strength of the ISO 9001 revision, ask which clause. If nobody can name one, the answer is not yet.

That is the whole of our advice, and you will notice it does not require hiring anyone. If you do want help with the transition itself, that is a separate page — deliberately, so this one can stay a reference.

Common questions

Have you read ISO 9001:2026?

No, and neither has almost anyone publishing about it. ISO published the sixth edition on September 16, 2026, so the text now exists — but it is copyrighted and cannot be republished, which is why no page anywhere can legitimately hand you a full clause-by-clause comparison. We have not bought a copy, and we would rather say so than imply otherwise. So this page does not tell you what the standard says. It tells you what ISO has said about it in ISO's own words, what the organizations publishing about it claim, and how well each claim is supported. When we have worked through the published text we will say so here, and date it.

Why does the tiering matter? Aren't certification bodies reliable?

The good ones are, and DNV, DQS and TÜV SÜD have published carefully here — real subclause numbers, correct attribution, honest hedging. But across the wider set of published pages there is a second group of claims with no clause number attached and no corroboration anywhere: artificial intelligence requirements, cybersecurity in internal audit scope, supply chain resilience, ESG. None of that appears in any clause-level account, and none of it appears on ISO's own page. It reads like commentary written at the committee-draft stage in 2023 and never revisited. If you build a transition plan around it you will spend money on requirements that may not exist.

So what should we actually plan around?

The Tier 1 list. Quality culture and ethical behavior as leadership expectations, the separation of risks from opportunities, extended awareness requirements, and the climate text being embedded rather than appended. Those are cited by three or more bodies independently, with matching clause numbers, and the two that matter most — leadership evidence and the risk register split — are also the two that take longest to do properly. Neither can be produced in the month before an audit.

When is the transition deadline?

September 30, 2029, for organizations already certified, set by Global ACI-TECH-3-TR on September 16, 2026. The certification bodies quoting September 2029 turned out to be right about the end date, though almost none of them cited a source that existed at the time. What most of them still do not mention is March 31, 2028, after which new and initial accredited certifications may only be issued to ISO 9001:2026 — the date that matters if you are not yet certified. We track all five dates, and the eleven days we wrongly reported that no deadline existed, on our transition tracker.

How long after publication will the deadline appear?

The best available evidence is the sister standard. ISO 14001:2026 published on April 15, 2026. Six weeks later, in a technical bulletin dated May 22, 2026, UKAS was still referring to the “anticipated” publication of the Global ACI mandatory document for that transition — while setting its own deadline for certification bodies. So even for a standard already on the shelf, the accreditation-level document had not appeared after six weeks. The same pattern is holding for ISO 9001: it published on September 16, 2026, with no numbered Global ACI document on the day.

The standard is published. Should we start now?

It depends what you would be starting. If you are not yet certified, certify to ISO 9001:2015 now and transition later, because certification bodies cannot issue accredited certificates to a new edition until their own accreditation is extended. For ISO 14001:2026 that took about four months: it published April 15, 2026, and DQS announced ANAB accreditation to certify against it on August 24, 2026. If you already hold a certificate, the work worth doing now is the work that is slow regardless of the detail: building demonstrable leadership and quality culture evidence, and separating your risk and opportunity treatments. Both are in the corroborated tier, ISO's own launch announcement names both, and both need a track record rather than a document. What is not worth doing yet is paying anyone for a clause-by-clause gap analysis.

Will you keep updating this page?

Yes, and the changelog at the bottom records what changed and when. ISO published on September 16, 2026, and we updated the same day. As the published text gets worked through we will move claims between tiers based on what it actually says, including — quite possibly — recording that something we listed as corroborated turned out to be wrong. We have published corrections on this site before and dated them.

Changelog

  • 2026-10-03 ISO’s page for ISO 9001:2026 now lists the digitally enhanced format alongside PDF, ePub, redline and paper, as its launch release said it would from October 1. Updated the sentence accordingly and noted that it is a format of the standard, not a change to its requirements.
  • 2026-09-29 The section on the September 2029 deadline claim still said, in the present tense, that three years was not a published date and that we would not print it. It has been published since September 16 in Global ACI-TECH-3-TR, and our own tracker says so. Rewrote the section as the record of what certification bodies claimed before the document, and what the document then set.
  • 2026-09-16 ISO published the sixth edition on September 16, 2026, and issued a launch announcement — the first time ISO itself has described the content of this edition. Quoted its four sentences verbatim and made them the primary source, replacing the pre-publication framing throughout. Rewrote the opening: we still have not read the standard, but the reason changed from “not published” to “published and copyrighted,” and we say so. Resolved the schedule caveat — it published on the day. Noted what ISO did not say: no clause numbers, and no AI, digital systems, supply-chain resilience or ESG beyond climate, which keeps Tier 3 where it is.
  • 2026-08-27 Page published. Based on a review of the public ISO 9001:2026 pages of nine certification bodies, ISO's own iso.org/9001-2026 page and guidance brochure, ISO/TC 176/SC 2 news, Global ACI resolutions, and ANAB and UKAS bulletins, all read on August 27, 2026. ISO 9001 confirmed still at stage 60.00 — not published.

We maintain this page. When ISO 9001:2026 publishes we will move claims between tiers based on what the text actually says — including recording anything we got wrong. If you spot an error before we do, tell us and we will correct it and date it.

Sources