Falcon Quality ISO 9001, step by step

ISO 9001, and what the 2026 edition actually changes.

The sixth edition publishes on 16 September 2026. It refines the standard rather than replacing it, and certified companies have three years to transition. If you're certifying for the first time, this is a good moment to start, not a reason to wait.

See where your system stands

A free 59-question assessment, covering the 2026 requirements.

What ISO 9001 asks of you

Stripped of the language, the standard asks you to decide how your work should be done, do it that way consistently, keep evidence that you did, and fix things properly when they go wrong. Seven clause sections cover that ground.

Decide and document

Your context, your scope, your processes, and who owns what. Clauses 4 and 5 establish that leadership is accountable for the system rather than delegating it to whoever has the word "quality" in their title.

Plan and resource it

Objectives you can measure, risks you've thought about, people who are competent, equipment that's calibrated, and documents under control. Clauses 6 and 7.

Run it and prove it works

Controlled production, verified suppliers, traceable product, and nonconforming material handled properly. Then internal audits, management review, and corrective action that actually finds root cause. Clauses 8, 9 and 10.

The four changes in the sixth edition

The revision has been described by the people writing it as evolutionary rather than revolutionary, and that's accurate. The clause structure stays. The process approach, risk-based thinking and PDCA all stay. Four areas change.

4.1 & 4.2

Climate change becomes explicit in your context

This one is already in force. An amendment published in February 2024 added a requirement to determine whether climate change is a relevant issue for your organisation, and a note that interested parties may have climate-related requirements. The 2026 edition folds it into the clause text.

What auditors want: a documented assessment. Not a policy, not a programme — a record showing you considered it. A written conclusion that it isn't relevant to your scope, with the reasoning, satisfies the requirement. A blank space in your context analysis does not.

5.1.1

Quality culture and ethical behaviour

Top management now has to promote and demonstrate a quality culture and ethical behaviour. A note in the standard clarifies that this can show up as shared values, attitudes, and observed behaviour rather than as a formal programme.

What auditors want: an evidence trail, not a culture initiative. Quality mentioned in leadership communications, an ethics statement somewhere in your documented system, and management review minutes that discuss more than the numbers. For a shop of thirty people this is a modest amount of work.

6.1

Risks and opportunities separated

Clause 6.1 splits into subclauses so that risk and opportunity are handled distinctly. Risks need identification, assessment and mitigation as before. Opportunities now need their own identification, evaluation and plans to pursue them — opportunity-based thinking alongside risk-based thinking.

What auditors want: if your risk register currently mixes both in one table, separate them. This is largely a documentation change. Your underlying approach to managing risk doesn't need rework. What most small shops are genuinely missing is any record of opportunities at all.

7.3

Ethics awareness across the workforce

The awareness clause extends beyond the quality policy and personal contribution. All personnel now need to be aware of quality culture and ethical behaviour too.

What auditors want: for most companies this is an addition to induction material and a line in the training records. The auditor will still do what auditors do — walk the floor and ask someone what happens to the customer if they get it wrong.

Annex A

A guidance annex, for the first time

The 2026 edition includes roughly fifteen pages of supplementary guidance covering clauses 4 through 10. This is new territory for ISO 9001.

Why it matters: Annex A is informative, not normative. A certification body cannot raise a nonconformity against it. But it will be used heavily in auditor training, so expect audit conversations to reflect its framing and language. When the standard is released, read Annex A first — it's the fastest way to understand how your registrar will approach the new version.

What is not in the 2026 edition

There has been a lot of speculation, and a fair amount of marketing built on it. None of the following made it into the standard.

  • Artificial intelligence. No requirements for AI governance, AI-assisted inspection, or algorithmic decision making. The standard remains deliberately technology neutral.
  • Broader ESG or sustainability. Climate change is in your context analysis. That is the extent of it. There are no carbon reporting or sustainability disclosure requirements.
  • Supply chain resilience. Considered and not included as a distinct requirement. Supplier risk is still handled under clauses 6.1 and 8.4 as before.
  • Digital documentation mandates. No requirement to adopt a QMS platform, electronic signatures, or any particular system.
  • Remote audit protocols. Not addressed.
  • Clause 8. Operations gets minor terminology adjustments only.

This matters commercially. Some consultants are using the revision as a reason to sell a full QMS rebuild. The changes do not warrant one, and anyone telling you otherwise is selling rather than advising.

The timeline, and what it means for you

WhenWhat happens
Feb 2024Climate change amendment published. Already mandatory.
Aug 2025Draft International Standard published for ballot.
Jul 2026Final Draft ballot closes. Approved with broad international support.
16 Sep 2026Sixth edition of ISO 9001 published.
~Q3 2027First certificates to the new edition become available, once registrars complete their own accreditation.
Sep 2029Transition deadline. ISO 9001:2015 retired.

If you're already certified

Nothing expires when the standard publishes. Your certificate stays valid and you have until September 2029. Add climate to your context analysis if you haven't, put quality culture and ethics on the management review agenda, and split your risk and opportunity records. Then schedule your transition audit at least a year before the deadline, because registrar capacity will tighten as 2029 approaches.

If you're certifying for the first time

Don't wait. Registrars will be certifying to the 2015 edition well into 2027, and everything you build now carries across. Building against the 2026 requirements from the start simply means you won't have a transition project later. The four changes are small enough to design in rather than retrofit.

Can a small shop do this alone?

Yes, and plenty do. The standard isn't beyond anyone who runs a manufacturing business. What catches people out is rarely the concepts.

The writing takes longer than you think

Understanding what clause 8.4 wants takes an afternoon. Producing a supplier evaluation procedure, the approved vendor criteria, a scorecard and the records to go with it takes considerably longer if you're starting from a blank page.

Internal audits are where it stalls

A registrar wants to see a complete audit cycle, auditors independent of the areas they audit, and evidence you acted on your own findings. This is the most common reason a first certification attempt slips by months.

You can't see your own blind spots

Every system looks complete to the person who built it. An auditor spends twenty minutes finding the three things you never thought to document, and by then it's a finding rather than a fix.

Where help makes it faster

Start free, and add help only where it earns its place.

Free

Gap analysis

Fifty-nine questions across every clause, including the 2026 changes. Scored by section, with a written finding for each gap. Fifteen minutes, and you'll know the size of the job.

Start the assessment
$997

The course

The procedures and forms already written, a completed example of each, and the order to build them in. Most ISO training tells you what the clause requires. This tells you how to produce it.

See what's covered
From $175

Consulting calls

One-to-one time for the places where your shop doesn't look like the example. Single calls, or blocks of five and ten at a lower rate.

How the calls work

Common questions

Do I need to buy the standard?
Yes, eventually. You can't build a compliant system from summaries alone, and you'll want the real text when an auditor quotes a clause at you. It's sold by ISO and by national standards bodies. Budget a couple of hundred dollars.
Can I get certified to the 2026 edition right away?
Not immediately. Registrars need to complete their own accreditation for the new version first, which typically takes nine to twelve months. Certification to the 2026 edition realistically becomes available around the second half of 2027. Certifying to the 2015 edition in the meantime is entirely normal and your certificate will be valid until September 2029.
How much does certification cost?
The registrar's fee is separate from anything you spend on preparation, and for a small shop it typically runs several thousand dollars across the Stage 1 and Stage 2 audits, plus annual surveillance after that. Get quotes from two or three accredited registrars early. Their pricing varies more than most people expect.
How long does it take?
Four to six months is typical for a shop with reasonable processes already running. The floor is set by the standard itself, not by how fast you work: a registrar wants to see a complete internal audit cycle and at least one management review before certifying, and that takes the time it takes.
Does ISO 9001 apply if we only machine to customer prints?
Yes, but not all of it. Clause 8.3, design and development, is a legitimate exclusion if you don't design product. Parts of clause 8.4 may not apply if material arrives on consignment and you purchase nothing — though outside processing like heat treat, plating or calibration does count as purchasing, and most shops send something out.
Is AS9100 or ISO 13485 different?
Both build on ISO 9001 and add sector requirements — configuration management, counterfeit parts and first article inspection for aerospace; design controls, sterilisation and regulatory reporting for medical devices. Both are being revised on their own timelines to align with the 2026 edition.

Start by finding out where you actually stand.

Fifty-nine questions across clauses 4 through 10, including the 2026 requirements. Scored by section, with a written finding for every gap. Free, and about fifteen minutes.