(925) 557-8570 Free gap analysis

ISO 9001, and what the 2026 edition actually changes.

The sixth edition published on 16 September 2026. It refines the standard rather than replacing it, and certified companies get a transition period to move across. If you're certifying for the first time, this is a good moment to start, not a reason to wait.

See where your system stands

A free 67-question assessment covering the 2026 requirements, scored by section. Set aside 30 to 45 minutes.

What ISO 9001 asks of you

Stripped of the language, the standard asks you to decide how your work should be done, do it that way consistently, keep evidence that you did, and fix things properly when they go wrong. Seven clause sections cover that ground.

Decide and document

Your context, your scope, your processes, and who owns what. Clauses 4 and 5 establish that leadership is accountable for the system rather than delegating it to whoever has the word "quality" in their title.

Plan and resource it

Objectives you can measure, risks you've thought about, people who are competent, equipment that's calibrated, and documents under control. Clauses 6 and 7.

Run it and prove it works

Controlled production, verified suppliers, traceable product, and nonconforming material handled properly. Then internal audits, management review, and corrective action that actually finds root cause. Clauses 8, 9 and 10.

What changes in the sixth edition

The people writing it described the revision as evolutionary rather than revolutionary, and that's accurate. The clause structure stays. The process approach, risk-based thinking and PDCA all stay. Here is what moves, and what an auditor will expect to see about each.

4.1 & 4.2 Climate change becomes explicit in your context: This one is already in force. An amendment published in February 2024 added a requirement to determine whether climate change is a relevant issue for your organization, and a note that interested parties may have climate-related requirements. The 2026 edition folds it into the clause text. What auditors want: a documented assessment. Not a policy, not a program — a record showing you considered it. A written conclusion that it isn't relevant to your scope, with the reasoning, satisfies the requirement. A blank space in your context analysis does not.
5.1.1 Quality culture and ethical behavior: Top management now has to promote and demonstrate a quality culture and ethical behavior. A note in the standard clarifies that this can show up as shared values, attitudes and observed behavior rather than as a formal program. What auditors want: an evidence trail, not a culture initiative. Quality mentioned in leadership communications, an ethics statement somewhere in your documented system, and management review minutes that discuss more than the numbers. For a shop of thirty people this is a modest amount of work.
6.1 Risks and opportunities separated: Clause 6.1 splits into subclauses so risk and opportunity are handled distinctly. Risks need identification, assessment and mitigation as before. Opportunities now need their own identification, evaluation and plans to pursue them — opportunity-based thinking alongside risk-based thinking. What auditors want: if your risk register currently mixes both in one table, separate them. This is largely a documentation change and your underlying approach doesn't need rework. What most small shops are genuinely missing is any record of opportunities at all.
6.3 Planning of changes gets stronger: Planning a change to the quality system now reaches further than authorizing it: the change has to be communicated to the people affected, and its result monitored and evaluated afterward. What auditors want: they'll pick a recent change and ask who was told, when, and what evidence shows it achieved what it was meant to. A signed change form with nothing after it is no longer the whole requirement.
7.1.4 & 7.1.6 Work environment and organizational knowledge: The work environment clause makes the social and psychological side explicit alongside the physical conditions, and organizational knowledge is tied more directly to achieving the results your system is supposed to deliver. What auditors want: for the environment, evidence you considered whether things like sustained overtime or a blame culture are affecting your error rates — not a wellness program. For knowledge, the answer to what happens to your capability the day a veteran machinist retires.
7.3 Ethics awareness across the workforce: The awareness clause extends beyond the quality policy and personal contribution. All personnel now need to be aware of quality culture and ethical behavior too. What auditors want: for most companies this is an addition to induction material and a line in the training records. The auditor will still do what auditors do — walk the floor and ask someone what happens to the customer if they get it wrong.
Annex A A guidance annex, for the first time: The 2026 edition includes roughly fifteen pages of supplementary guidance covering clauses 4 through 10. This is new territory for ISO 9001. Why it matters: Annex A is informative, not normative, so a certification body cannot raise a nonconformity against it. But it will be used heavily in auditor training, so expect audit conversations to reflect its framing and language. Read Annex A first — it's the fastest way to understand how your registrar will approach the new version.

What is not in the 2026 edition

There has been a lot of speculation, and a fair amount of marketing built on it. None of the following made it into the standard.

Artificial intelligence. No requirements for AI governance, AI-assisted inspection, or algorithmic decision making. The standard remains deliberately technology neutral.
Broader ESG or sustainability. Climate change is in your context analysis. That is the extent of it. There are no carbon reporting or sustainability disclosure requirements.
Supply chain resilience. Considered and not included as a distinct requirement. Supplier risk is still handled under clauses 6.1 and 8.4 as before.
Digital documentation mandates. No requirement to adopt a QMS platform, electronic signatures, or any particular system.
Remote audit protocols. Not addressed.
A restructured clause 8. Operations keeps its shape. The changes there are narrow rather than structural.

This matters commercially. Some consultants are using the revision as a reason to sell a full QMS rebuild. The changes do not warrant one, and anyone telling you otherwise is selling rather than advising.

The timeline, and what it means for you

When	What happens
Feb 2024	Climate change amendment published. Already mandatory.
Aug 2025	Draft International Standard published for ballot.
May 2026	Final Draft published. Approved with broad international support.
16 Sep 2026	Sixth edition of ISO 9001 published.
2027	First certificates to the new edition become available, once registrars complete their own accreditation.
2029	Expected transition deadline. ISO 9001:2015 retired.

If you're already certified

Nothing expires when the standard publishes. Your certificate stays valid through the transition window. Add climate to your context analysis if you haven't, put quality culture and ethics on the management review agenda, and split your risk and opportunity records. Then schedule your transition audit at least a year before the deadline, because registrar capacity will tighten as it approaches.

If you're certifying for the first time

Don't wait. Registrars will be certifying to the 2015 edition well into 2027, and everything you build now carries across. Building against the 2026 requirements from the start simply means you won't have a transition project later. The changes are small enough to design in rather than retrofit.

Can a small shop do this alone?

Yes, and plenty do. The standard isn't beyond anyone who runs a manufacturing business. What catches people out is rarely the concepts.

The writing takes longer than you think

Understanding what clause 8.4 wants takes an afternoon. Producing a supplier evaluation procedure, the approved vendor criteria, a scorecard and the records to go with it takes considerably longer from a blank page.

Internal audits are where it stalls

A registrar wants to see a complete audit cycle, auditors independent of the areas they audit, and evidence you acted on your own findings. This is the most common reason a first certification attempt slips by months.

You can't see your own blind spots

Every system looks complete to the person who built it. An auditor spends twenty minutes finding the three things you never thought to document, and by then it's a finding rather than a fix.

Where help makes it faster

Start free, and add help only where it earns its place.

Free

Gap analysis

Sixty-seven questions across every clause, including the 2026 changes. Scored by section, with every gap identified by clause reference. Set aside 30 to 45 minutes and you'll know the size of the job.

Start the assessment

$997

The course

The procedures and forms already written, a completed example of each, and the order to build them in. Most ISO training tells you what the clause requires. This tells you how to produce it.

See what's covered

From $600

Consulting calls

One-to-one time for the places where your shop doesn't look like the example. Blocks of five calls for $600 or ten for $1,000.

How the calls work

Working to an aerospace or medical device standard? There are add-on courses covering what AS9100 and ISO 13485 require beyond ISO 9001.

Free · 30 minutes · No obligation

Not sure how much of this applies to you?

Tell me what you make, who's asking you to get certified and what shape your system is in. I'll give you a straight read on where you stand against the 2026 requirements, what the work involves, and the order I'd tackle it in.

Forty years of doing this. A short conversation usually saves people months, and a fair number of these calls end with someone deciding they can handle it themselves.

Book a free 30-minute call

Common questions

Do I need to buy the standard?: Yes, eventually. You can't build a compliant system from summaries alone, and you'll want the real text when an auditor quotes a clause at you. It's sold by ISO and by national standards bodies. Budget a couple of hundred dollars.
Can I get certified to the 2026 edition right away?: Not immediately. Registrars need to complete their own accreditation for the new version first, which typically takes several months to a year. Certifying to the 2015 edition in the meantime is entirely normal, and your certificate will be valid through the transition window.
How much does certification cost?: The registrar's fee is separate from anything you spend on preparation, and for a small shop it typically runs several thousand dollars across the Stage 1 and Stage 2 audits, plus annual surveillance after that. Get quotes from two or three accredited registrars early. Their pricing varies more than most people expect.
How long does it take?: Four to six months is typical for a shop with reasonable processes already running. The floor is set by the standard itself, not by how fast you work: a registrar wants to see a complete internal audit cycle and at least one management review before certifying, and that takes the time it takes.
Does ISO 9001 apply if we only machine to customer prints?: Yes, but not all of it. Clause 8.3, design and development, is a legitimate exclusion if you don't design product. Parts of clause 8.4 may not apply if material arrives on consignment and you purchase nothing — though outside processing like heat treat, plating or calibration does count as purchasing, and most shops send something out.
Is AS9100 or ISO 13485 different?: Both build on ISO 9001 and add sector requirements — configuration management, counterfeit parts and first article inspection for aerospace; design controls, sterilization and regulatory reporting for medical devices. AS9100 is being renamed IA9100 and revised this quarter to align with the 2026 edition. ISO 13485 stays on its 2016 edition, now written into US federal regulation.

Find out where you stand before you spend anything.

Sixty-seven questions across every clause of ISO 9001, scored by section. Set aside 30 to 45 minutes. Free, and your answers save as you go.

Start the gap analysis Or book a free 30-minute call

Falcon Quality

ISO 9001, AS9100 and ISO 13485 consulting and courses for small and medium manufacturers. A one-person practice — you work with me, not an account manager.

Phone: (925) 557-8570
Email: [email protected]
Office: 499 Highland Dr
Danville, CA 94526

Standards

Work with me

Falcon Quality

Falcon Quality is an independent consultancy. It is not a certification body, a registrar or an accreditation organization, and it does not issue certificates. ISO 9001, AS9100 and ISO 13485 are the property of their respective standards organizations.