ISO 9001:2015 vs ISO 9001:2026 – What Are the Changes?

The company should not simply list these items and consider the planning activity complete. It needs to determine which actions are appropriate, assign responsibility, and evaluate whether the actions are effective.

How should the risk register change?

A company that already has a risk register should review its format and content rather than automatically replace it.

A useful register may include:

• The issue or opportunity.
• The affected process or objective.
• The possible effect on quality.
• The action selected.
• The responsible person.
• The planned completion date.
• The method for evaluating effectiveness.

A combined register can still be useful if it clearly distinguishes risks from opportunities and records the relevant actions separately. The format itself is not the objective; effective planning is.

Should every risk receive the same treatment?

No. Actions should be appropriate to the potential effect and the organization’s circumstances.

For example, a supplier delivering low-cost office stationery does not normally present the same quality risk as a supplier providing a critical component used in a safety-related product.

A practical risk assessment helps organizations focus resources where they matter most.

Practical recommendation: Review the current risk and opportunity process, confirm that the two are clearly distinguished, and ensure that selected actions are integrated into relevant business processes.

Clause 7: Support – Competence, Awareness, and Quality Culture

Clause 7 covers the resources and support required to operate an effective quality management system. Its established areas include people, infrastructure, the environment for operating processes, monitoring and measuring resources, organizational knowledge, competence, awareness, communication, and documented information.

The 2026 edition strengthens the emphasis on awareness of quality culture and ethical behavior. This means organizations should consider whether employees understand not only their tasks but also the quality-related behavior expected of them.

What is the difference between competence and awareness?

Competence concerns a person’s ability to perform assigned work effectively. Awareness concerns understanding relevant requirements, policies, objectives, and the effect of one’s activities.

A person can be technically competent but still make poor quality decisions if they do not understand the importance of a required control.

For example, an experienced machine operator may know how to set up a machine correctly but may not understand that bypassing a documented first-piece inspection can allow a batch of nonconforming parts to proceed.

Both competence and awareness matter.

Example: Training a new quality inspector

A company hires an inspector to measure machined components.

The training program should cover the measurement method, equipment handling, acceptance criteria, recording of results, and action to take when a component fails inspection.

The inspector should also understand why accurate records matter, why results must not be changed to meet production targets, and whom to notify when a serious problem is identified.

The company can demonstrate effective training through relevant competence records, practical assessments, observation of work, and evidence that the employee follows the required process.

What should be reviewed?

Organizations should check whether existing arrangements adequately cover:

• Competence requirements for relevant roles.
• Training and evaluation of training effectiveness.
• Awareness of the quality policy and relevant objectives.
• Awareness of the effect of individual work on product and service quality.
• Expected quality culture and ethical behavior.
• Internal communication and escalation of problems.
• Control of documents and records.

There is no need to send every employee to an external ISO training course. Training should match the person’s responsibilities and the requirements that affect their work.

A production operator may need practical process and defect-reporting training, while a department manager may need training on leadership responsibilities, risk decisions, and performance evaluation.

Clause 8: Operation – Planning and Controlling Work

Clause 8 contains the operational requirements of the quality management system. It addresses customer requirements, design and development where applicable, external providers, production and service provision, release of products and services, and control of nonconforming outputs.

The operational framework remains largely intact in the 2026 edition. The revision is primarily focused on clarifications and consistency rather than requiring organizations to redesign all their operational controls.

What should manufacturers review?

Manufacturing organizations should confirm that the existing processes adequately control:

• Review of customer and product requirements.
• Design and development, where applicable.
• Purchasing and supplier performance.
• Production planning and process control.
• Equipment and monitoring resources.
• Identification and traceability, where required.
• Product inspection and release.
• Control of nonconforming outputs.

For example, a company producing industrial pumps may already have inspection plans, supplier approval records, production travelers, test results, and final release records.

These controls should remain in place where they are effective. The company should assess whether any revised requirements affect how these processes are defined, documented, or implemented.

What about service organizations?

Service providers should apply Clause 8 to their actual service delivery processes.

A consulting firm, for example, may control customer requirements through contract reviews, project planning, technical review, approval of deliverables, and customer feedback. A software provider may rely on requirements management, version control, testing, release approvals, and incident handling.

The principle is the same: establish controls that help ensure the service meets requirements.

Example: Supplier-related nonconformity

A US equipment manufacturer receives a batch of components that do not meet the agreed dimensions.

A suitable response includes identifying and controlling the affected material, evaluating the impact on production, contacting the supplier, and deciding whether replacement or another approved disposition is appropriate.

The company should also consider whether the event indicates a wider problem with supplier selection, specification clarity, incoming verification, or supplier monitoring.

A one-time correction may be sufficient for an isolated event. Repeated failures may indicate the need for broader corrective action.

Do companies need to change every operational procedure?

No. Organizations should avoid unnecessary revisions that do not improve conformity or satisfy a revised requirement.

A gap analysis should identify specific changes needed to meet the new edition. Where an existing procedure already satisfies the applicable requirements, it can normally be retained.

This approach reduces disruption and helps employees focus on meaningful improvements rather than repeated document changes.

Clause 9: Performance Evaluation – Audits, Measurement, and Management Review

Clause 9 addresses the evaluation of quality management system performance. It covers monitoring and measurement, analysis and evaluation, internal audits, and management review.

The central approach remains the same in ISO 9001:2026. Organizations must monitor relevant performance, evaluate whether the system is effective, and use the results to make informed decisions. 

What should organizations measure?

Relevant performance indicators depend on the organization’s products, services, risks, and objectives.

Common examples include:

• Customer complaint rates.
• On-time delivery performance.
• First-pass yield.
• Scrap and rework rates.
• Supplier defect rates.
• Corrective action completion and effectiveness.
• Internal audit findings.
• Customer satisfaction results.

A company should select indicators that help it evaluate performance. It does not need to measure every possible activity.

Example: Using data to identify a recurring problem

A manufacturer records its monthly defect rate and finds that defects have increased from 1.8% to 3.6% over three months.

The data indicates a trend that deserves investigation. The quality manager may examine the affected product families, machines, shifts, operators, raw materials, and recent process changes.

The organization should not automatically assume that the operators are responsible. It should use evidence to identify the cause and determine what action is appropriate.

This is how performance evaluation supports actual process improvement.

Internal audits under the new edition

Internal audits remain a key method for determining whether the quality management system conforms to applicable requirements and is effectively implemented.

Organizations should update their audit criteria and checklists to include relevant changes in ISO 9001:2026. Auditors should be trained to distinguish revised requirements from practices that were already required under the 2015 edition.

An internal audit can examine whether leadership supports quality culture, employees understand ethical expectations, and risk and opportunity planning leads to appropriate action.

Auditors should evaluate evidence rather than rely only on interviews or the existence of documents.

Management review

Management review remains an important opportunity for top management to assess quality performance and determine whether the system remains suitable, adequate, and effective.

Organizations should ensure that management review considers the required inputs, evaluates relevant performance information, and produces decisions and actions consistent with the applicable requirements.

For example, if customer complaints rise while delivery performance improves, management should examine whether production pressure is affecting product conformity. The aim is to make balanced decisions based on the complete picture of quality performance.

Clause 10: Improvement – Corrective Action and Continual Improvement

Clause 10 covers improvement, nonconformity, corrective action, and continual improvement. These activities remain fundamental to ISO 9001:2026.

The revision gives clearer emphasis to the role of leadership in supporting continual improvement. Organizations should therefore examine whether improvement activities are supported by management decisions, resources, and follow-up rather than being left entirely to the quality department. 

Correction versus corrective action

A correction addresses a detected problem. Corrective action addresses its cause to prevent recurrence or occurrence elsewhere, as appropriate.

For example, if an inspector finds a batch of incorrectly machined parts, sorting the batch and replacing defective components may correct the immediate issue.

If the investigation finds that the machine’s fixture has gradually worn beyond acceptable limits, the organization may need to repair the fixture, review maintenance controls, and assess whether other batches or machines are affected.

The corrective action should be appropriate to the problem and supported by evidence that the action was effective.

Example: Repeated customer complaints

A US service company receives repeated complaints about incorrect invoices.

The company initially corrects each invoice manually. However, the same error keeps returning because employees use an outdated pricing spreadsheet.

A stronger improvement process investigates the underlying cause, controls the outdated file, establishes an approved source of pricing data, trains relevant employees, and checks later invoices to confirm that the problem has been reduced.

This approach addresses the cause rather than repeatedly correcting individual outputs.

How can leadership support continual improvement?

Leadership can support improvement by:

• Reviewing recurring nonconformities and customer complaints.
• Assigning resources to address significant problems.
• Removing barriers that prevent employees from following processes.
• Reviewing the effectiveness of corrective actions.
• Encouraging employees to report problems and suggest improvements.
• Evaluating whether improvements have produced the intended results.

Improvement does not always require a large project. Small changes to process layout, inspection methods, training, or information flow can produce useful results when they address a genuine problem.

New Annex A: Why the Additional Guidance Matters

ISO 9001:2026 introduces a new Annex A containing explanatory information intended to clarify the structure, terminology, and intent of the requirements.

Annex A is informative rather than a separate set of mandatory requirements. It helps users understand the standard but does not replace the normative clauses or create additional requirements by itself. The 2026 edition also removes the previous Annex B, which provided information about other standards in the ISO/TC 176 family.

How can Annex A help quality professionals?

The guidance can help quality managers, auditors, consultants, and process owners interpret the standard more consistently.

For example, when a company is unsure how a requirement should be understood, it can consult the relevant clause and use Annex A for clarification. This can help prevent both under-implementation and unnecessary documentation.

However, Annex A should not be treated as a substitute for professional judgment. The organization must still determine how the normative requirements apply to its activities and demonstrate conformity.

Practical recommendation: Use the published standard and Annex A together during the gap analysis. Record the relevant clause, the existing control, the identified gap, and the action required. This creates a clear link between the requirement and the change made to the quality management system.

References to read more

• ISO — ISO 9001:2026 and information for businesses
• ASQ — Quality standards frequently asked questions
• BSI — ISO 9001:2026 key changes and guidance
• ISO — Official ISO 9001:2026 standard page

ISO 9001:2015 vs ISO 9001:2026 – Transition Planning, Implementation, and Certification

Understanding the changes is only the first step. The next challenge is to turn those requirements into practical actions that employees can follow and auditors can verify. 

For US organizations, a successful transition should protect existing quality controls, address genuine gaps, maintain customer confidence, and avoid unnecessary documentation or disruption to production and service delivery.

The most effective approach is to treat the transition as a controlled quality improvement project. Top management should provide direction, the quality manager should coordinate the work, process owners should implement changes, and internal auditors should verify that the revised system is working as intended.

How to Conduct an ISO 9001:2026 Gap Analysis

A gap analysis is a systematic comparison between the requirements of the new edition and the organization’s existing quality management system. It helps determine which requirements are already satisfied, which need additional evidence, and which require changes to processes or controls.

A gap analysis should be based on the published standard, not solely on a blog article or a generic checklist. The organization should also consider applicable customer-specific requirements and any additional obligations relevant to its industry.

Step 1: Obtain the published standard

Obtain the official ISO 9001:2026 edition and identify the requirements that apply to the organization’s quality management system.

Do not rely on draft documents or preliminary comparison tables when making compliance decisions. Drafts are useful for understanding how a revision developed, but the published edition is the appropriate reference for implementation.

Step 2: Review the existing quality management system

Gather relevant documents and records, including:

• Quality policy and quality objectives.
• Scope of the quality management system.
• Context and interested-party assessments.
• Risk and opportunity records.
• Competence and training records.
• Supplier approval and performance records.
• Operational procedures and inspection records.
• Internal audit reports.
• Management review minutes.
• Nonconformity and corrective action records.

The aim is to understand how the current system operates in practice, not simply to collect documents.

Step 3: Compare each applicable requirement

For each requirement, record the existing process, available evidence, any identified gap, the action required, the responsible person, and the target date.

The following example illustrates a practical gap analysis format.