ISO 9001 certification is independent confirmation that your quality management system (QMS) meets the ISO 9001 standard. It matters most for organizations that sell to larger customers, bid for public tenders, or sit in a regulated supply chain.
ISO 9001 certification is a formal statement from an independent certification body that your QMS meets the requirements of ISO 9001. The auditor checks how you plan, run, measure, and improve the work that affects quality for your customers.
The certificate covers your management system within a defined scope. It doesn't certify a product, and it doesn't certify a person.
The scope statement printed on the certificate is the part to read closely. It names the sites, activities, products, or services the audit covered. For example, it may say "design and manufacture of hydraulic valves at the Leeds site." Anything outside that statement isn't certified, even if it's run by the same company.
Many buyers assume a certificate covers everything a supplier does. It often doesn't, so set a scope that matches what your customers actually buy from you.
Only organizations can be ISO 9001 certified. People can hold related qualifications, such as ISO 9001 Lead Auditor or Internal Auditor certificates, which show they can audit or run a QMS. These don't make the person, or their employer, certified.
No. ISO 9001 is voluntary, and you can implement it without ever getting certified.
Certification becomes relevant when someone else needs proof that you follow the standard. Customers, public tenders, and supplier questionnaires often ask for an accredited certificate, and self-declared compliance rarely counts.
To get certified, you need a QMS that meets the standard, runs day to day, and improves over time.
Every ISO 9001 certification audit comes down to three questions:
Come to your Stage 1 audit with:
Anything missing becomes a finding to close before the Stage 2 audit.
ISO 9001 sets no minimum run time. In practice, most certification bodies want to see around three months of records before they'll audit. That's enough time to show completed internal audits, a management review, and data such as customer feedback or nonconformity logs.
This varies by body, so ask yours before you book a date.
You build and run your QMS first, check it internally, then invite a certification body to audit it in two stages.
Stage 1 is a readiness check. The auditor reviews your documentation, confirms the scope, checks that an internal audit and management review have taken place, and plans Stage 2.
Any gaps go into a Stage 1 report. You need to close them before Stage 2 goes ahead, which usually takes place a few weeks later.
Stage 2 is the main assessment, held on-site, remotely, or as a mix of both. The auditor interviews staff, samples records across processes and sites, and checks that what happens matches what you've documented.
Findings are graded as nonconformities:
Once the body accepts your corrective actions, it issues the certificate.
For a small or mid-sized organization starting without a QMS, plan for 6 to 12 months from kickoff to certificate. If your processes are already documented and followed, it can be faster.
What drives the timeline:
Choose an accredited body with auditors who know your sector, and compare quotes over the full three-year cycle rather than year one alone.
The United Kingdom Accreditation Service (UKAS) is the UK's national accreditation body. It checks that certification bodies are competent and impartial against ISO/IEC 17021-1, and their certificates carry the UKAS mark. Certificates accredited elsewhere, for example by DAkkS in Germany, carry equal weight through the International Accreditation Forum (IAF).
Non-accredited certificates are cheaper and faster to get. They're also rejected by many buyers, public tenders, and supplier audits, which defeats the point for most organizations.
If you're certifying to win or keep business, you need an accredited certificate.
Use this checklist when you compare quotes:
Not always. If someone on your team understands ISO 9001, your processes are already documented, and you have time, you can prepare for the audit yourself. Software that structures the QMS and its records closes much of the gap.
A consultant helps when you have no in-house expertise, a tender deadline, or a combined project with another standard such as ISO 27001.
However, note that accreditation rules bar a certification body from certifying a QMS it helped build. If a body offers both consulting and certification, make sure you book two different companies to help you with each.
The certification body's fee is driven by audit days multiplied by its day rate. For a very small UK business, published examples start at around £1,400 for the initial assessment, with annual surveillance at about £1,000 (NI Business Info). Your own team's time usually costs more than that.
Certification bodies calculate audit days using the IAF MD 5 guidance, then adjust for your situation:
As a reference point, IAF MD 5 suggests around 1.5 audit days for 1 to 5 employees, 2 days for 6 to 10, 2.5 days for 11 to 15, and 3 days for 16 to 25 for an initial certification.
Usually included:
Usually excluded:
A certificate runs for three years, so compare quotes across the whole cycle. Here's the audit effort for an organization with 16 to 25 employees:
| When | Audit | Audit days | Share of initial effort |
| Year 1 | Initial certification (Stage 1 and Stage 2) | 3 | 100% |
| Year 2 | First surveillance audit | 1 | About one third |
| Year 3 | Second surveillance audit | 1 | About one third |
| End of year 3 | Recertification audit | 2 | About two thirds |
| Cycle total | 7 |
Multiply the audit days by the body's day rate and add travel and annual fees. Over the cycle, that's more than double the year-one headline.
Internal time is almost always the largest cost, and it's never on the certification body's quote. Someone has to write procedures, run internal audits, chase records, prepare management reviews, and sit through the audits themselves.
Budget for it upfront, and use tools or templates to take manual work off your team.
ISO published ISO 9001:2026 on September 16 2026, and it replaces the 2015 edition. For certification, the key change is the timeline: every certificate will need to move to the new edition within about three years.
ISO 9001:2015 is withdrawn. Certification bodies can still issue first-time 2015 certificates for a limited period, reported as running until around March 31 2028. After that, new accredited certificates are issued to the 2026 edition only.
The content changes themselves are moderate. They include the Harmonized Structure, a split of risks and opportunities in Clause 6.1, the climate change requirement from Amendment 1:2024, and new emphasis on quality culture and ethical behavior. Our ISO 9001 requirements guide covers them clause by clause.
It stays valid during the transition period, reported as three years from publication, ending around September 30 2029. Most organizations will transition at a scheduled surveillance or recertification audit, although a separate transition audit is also possible. Plan the move early, because auditor capacity will tighten as the deadline approaches.
Certifying to the 2015 edition today buys you a certificate you'll have to transition almost immediately. That means paying for a second round of gap analysis, updates, and audit time within a year or two.
If you can, build your QMS to ISO 9001:2026 from the start. Before you sign with a certification body, ask:
If a tender deadline forces you to certify to 2015, budget for the transition as part of the same project.
You keep your certificate by running the QMS every day and passing an audit every year.
Your certificate is valid for three years. In years two and three, the certification body runs a surveillance audit. These shorter audits sample your processes and focus on internal audits, management review, corrective actions, and changes.
Before the certificate expires, a recertification audit reviews the whole system again. Pass it, and a new three-year cycle begins. Book it early, since a gap between cycles can mean extra audit work to restore the certificate.
A certification body can suspend your certificate, and eventually withdraw it, if:
A suspended certificate can't be used in tenders or marketing. Keep your body informed, and treat audit dates as fixed.
Read the certificate, then verify it with the certification body and the accreditation register. A PDF in a tender pack proves nothing on its own.
How to read a certificate:
Where to verify:
Warning signs in a supplier's tender pack:
The hardest part of ISO 9001 certification isn't the audit. It's the months of internal work that come before it. DataGuard takes as much of that off your plate as possible.
Our customers have achieved a 100% first-time pass rate in audits against standards such as ISO 27001 for more than seven years.
Ready to get started? Book a demo, and we'll show you how fast your team can get to certification.
It means an independent certification body has audited your quality management system and confirmed it meets ISO 9001 within a defined scope. The certificate covers the management system, not a product or a person.
For a very small business, certification body fees start at around £1,400 to £2,250 for the initial certification, plus annual surveillance audits. Costs rise with employee numbers, sites, and complexity. Your internal time, consultants, and software come on top.
Build a QMS that meets Clauses 4 to 10, run it for around three months, and complete an internal audit and a management review. Then book an accredited certification body for a Stage 1 and Stage 2 audit.
Most small and mid-sized organizations need 6 to 12 months from kickoff to certificate. Existing documentation and processes can shorten that considerably.
If you want the certificate to count with customers and in tenders, you need a certificate from an accredited body. In the UK that usually means UKAS, though bodies accredited by other IAF members are recognized too.
No. It's voluntary. Many customers and public buyers require it, though, which makes it essential in some markets.
No. Only organizations can be certified. Individuals can earn qualifications such as ISO 9001 Lead Auditor or Internal Auditor.
Certify to ISO 9001:2026 if your certification body can audit it. A new 2015 certificate will need to transition by around September 30 2029, so you'd pay for that work twice.
_HighPerformer_HighPerformer.svg)
TISAX® is a registered trademark of the ENX Association. DataGuard is not affiliated with the ENX Association. We provide Software-as-a-Service and support for the assessment on TISAX® only. The ENX Association does not take any responsibility for any content shown on DataGuard's website.
All data provided is for information only, based on internal estimates. This information is not indicative of KPIs, and is not given with any warranties or guarantees, expressly stated or implied in relation to accuracy and reliability.
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Organization",
"@id": "www.dataguard.com#organization",
"name": "DataGuard",
"legalName": "DataCo GmbH",
"description": "DataGuard, the European leader in security and compliance software, is trusted by more than 4,000 organizations across 50+ countries. We help you identify and manage your security and compliance risks and fast-track your certifications and compliance by combining expert consultancy with AI-powered automation. Our purpose-built, all-in-one platform is developed with the experience of over 1.5 million total hours by a team of certified security and compliance experts.",
"foundingDate": "2018",
"taxID": "DE315880213",
"logo": "https://7759810.fs1.hubspotusercontent-na1.net/hubfs/7759810/DataGuardLogo.svg",
"url": "www.dataguard.com",
"email": "info@dataguard.de",
"telephone": "+49 89 452459 900",
"address": {
"@type": "PostalAddress",
"streetAddress": "Sandstrasse 33",
"addressLocality": "Munich",
"addressRegion": "Bavaria",
"postalCode": "80335",
"addressCountry": "Germany"
},
"sameAs": [
"https://www.linkedin.com/company/dataguard1/",
"https://www.youtube.com/channel/UCEQzPZ6sCBCj9cAoBvaLL6w",
"https://x.com/i/flow/login?redirect_after_login=%2FDataGuard_dg"
]
}
]
}✅ Organization schema markup for "DataGuard" has been injected into the document head.