ISO9001 is changing in 2026! – What’s Changing and Why You Should Care

Now I want to kick this post of with a caveat. Yes, ISO9001 is changing. Yes, there are lots of people out there telling you what they think is changing and yes there is a lot of noise.  Here's the thing, they don't actually know for sure!

ISO standards get updated on a regular basis and yes, ISO9001 is currently coming to the end of that process but it is a process, which is roughly like this:

The current situation is that  ISO have only recently released DIS/ISO9001 which is the draft of what they think it should be and that is then put out for public comment and feedback. On the chart that's at the stage labeled 40 Enquiry. It got there at the end of August and is open for feedback for 12 weeks. Then the committee get back together, look at the feedback, make any final updates based on that feedback, debate it and then issue the final draft text - FDIS. That still isn't live, it's still not the actual standard although it's pretty close. Then there are still more hoops to jump through after that. All of this is to say, DONT PANIC! It's not real yet and its not finalised.

That said, the useful thing about the draft is that you can get a good idea of what is changing and what isn't, and what areas people feel need a tune up and so it gives you an indication of how big a change is coming your way. That's what we want to cover, but remember, it could all completely change so don't do anything to your ISO9001 system just yet, not a thing, no matter what anyone says!

What we have decided to do is break this blog into 2 parts, because firstly, there are a few things we want to cover to get you thinking and secondly, we know you are busy! So in this post we'll cover Clauses 4 - 7 and in the next post clauses 8-10.

It's been a while since ISO9001 for Quality Management Systems was updated. The 2015 revision brought pretty significant changes compared to 2008, it's fair to say that the red ink was flowing and there was a real change in approach, bringing risk based thinking to the fore (a really good thing!).  In 2020, ISO reviewed the standard but decided no updates were needed, I guess they were busy.

Now, in 2025, ISO has looked again — and concluded that the world has in fact moved, so the standard should too. But how much has really changed?

Before diving in, remember: the 2025 version of the standard is still a draft. It's currently being voted on by ISO member organisations. They may propose further updates before it's final, so again don't panic yet.

Also important to remember that once approved, organisations who are already certified will have three years to align their existing systems to the new requirements — plenty of time to get ready.

Let's take a look at the changes that are jumping out from this draft. 

The thing that pops out in clause 4 is the reinforcement of climate change considerations and the requirement for the company to factor that into their business systems. A short while ago ISO released an addendum to 2015 on understanding climate change risks to your business. In the draft this is now firmly embedded.

• Clause 4.1: Organisations must determine whether climate change is a relevant issue. Understanding environmental and political issues is key to understanding context, as they impact supply chains and customers.  This make sense because as the world continues to grapple with increasing environmental issues it will have impacts on your supply chain and your customers, even when you operate, you need consider these.
• Clause 4.2: Organisations must determine which requirements of their interested parties will be addressed through the QMS. Not everything can be managed, but you'll need evidence of how decisions were made about what will and what won't be managed by the QMS.

This is an area where we are really seeing some change, there isn't a lot of wording change here, but what is here could have fairly large implications for your organisation, and your certification:

• The phrase "engaging, directing and supporting persons" is now "directing and supporting persons". Engagement may return, but the emphasis is now on leadership responsibility.  We've lost the engaging part, will it come back in the final version? Possibly, but the focus is now that leadership must direct. That, I think, is a backwards move, any system works by engaging people not by using a big stick which this now risks.
• "Promoting improvement" becomes "promoting continual improvement", reinforcing the continuous cycle of improvement.
• A new requirement: promoting quality culture and ethical behaviour, reflecting shared values, attitudes, and established practices. Evidence will of course be expected. This one is a bit of an issue and has created lots of discussion. Yes, you will no doubt have to write some ethical practices documents, especially around your purchasing program but the real challenge is what do you deem as Ethical behaviour? Is it the same assessment in New Zealand as it is in the UK, the US, the Middle East, Asia? I think this one is going to be interesting, especially as auditors move around the globe as people tend to do.
• Clause 5.2.2: The quality policy must be understood and applied — not just written. It should be concise, clear, and meaningful to everyone in the organisation.  For me, the key part of this is understood - too many companies keep writing policies that you need a legal degree to understand. This, I think, takes us back to making sure that everyone at every level can understand the policy and how they can apply it in their role.

There are some big changes in clause 6 especially around planning of changes, which, let's face it, most companies do badly anyway so ISO is genuinely trying to help you here.

• The first one is that ISO have split out Clause 6.1.2 into 2 clauses. It was "actions to address risks & opportunities", 6.1.2 stays as actions to address risks, now we also have clause 6.1.3 actions to address opportunities. (We have fed back to say this title is wrong, it should say "actions to enhance opportunities"). What they are saying here however, is that you need to genuinely look at the opportunities you have identified and have plans in place to capture them, use them in your system and build on them, plus you need to evaluate the effectiveness of any actions you put in place around these opportunities.
• 6.3 Planning of Changes: New "shall" requirements ensure changes achieve intended results. Consider:
  • How the effectiveness of the changes will be monitored and evaluated; i.e. how will you know it has done what you claimed the change would do.
  • Communication of the changes; - do you know who needs to know about the change and how exactly will you tell them and make sure they understand.
  • How to review the results of the changes. – actually go back and look at the change and see if it did what you claimed in a) above.

The change process really does now align with Deming's PDCA cycle — Plan, Do, Check, Act — to support continual improvement.

Changes are minor but important, if you skip over them they will absolutely come back to bite you and stop you sitting down for a while!

• Clause 7.1.4: Operational environment now depends on quality culture and ethical behaviour, not just products or services.
  • Yep, it's no longer about your products or services, it's all about quality culture and ethical behaviour, that new requirement back in clause 5. So, no more saying well these aren't applicable to my product, it's well tell me about your culture and how this environment supports or hinders good social, psychological and physical environments. That's not a small change! ​
• Clause 7.3 Awareness: Organisations must ensure everyone under their control understands the quality culture and ethical behaviour expectations.
  • The under the organisations control should give you a hint it's not just your employees and now they have added a new clause, e) that says: "organisational quality culture and ethical behaviour." Yep, there it is again, so now we are looking for evidence that those under your control fully understand what your quality culture is and what your definition of ethical behaviour is. How you do that is going to be something for each organisation to figure out but remember you will need to prove that awareness so how you record it becomes important. ​

That's all we'll cover in this post, but that's probably enough to get you thinking. While there is no wholesale rip it up and start again like they did between 2008 and 2015 the changes this time are more subtle but certainly impactful.  

If this draft goes forward as it is then it is going to take time to really understand it and tune your system up to meet it.

But remember, it's just a draft, DON'T PANIC!