ISO 9001 requirements: what your quality management system
must do

ISO 9001 sets out what a quality management system (QMS) must do to deliver products and services that consistently meet customer and regulatory requirements.

This guide walks you through every auditable clause of the 2026 edition, the documents and records an auditor will ask for, and the date by which you need to transition.

framework_ISO9001_pillar_en

What are the ISO 9001 requirements?

The ISO 9001 requirements are the "shall" statements in Clauses 4 to 10 of the standard. Together, they describe a QMS that reflects business context, is led from the top, plans around risks and opportunities, runs controlled processes, measures its results, and keeps improving.

Which edition applies now?

ISO 9001:2026 is the current edition, which ISO published on September 16 2026 as edition 6. Existing 2015 certificates stay valid during the transition period, which we cover below.

The clause structure at a glance

Clauses 1 to 3 cover scope, normative references, and terms and definitions. They set the standard's ground rules but contain nothing to audit. Clauses 4 to 10 carry the auditable requirements and follow the harmonized structure shared with ISO 27001, ISO 14001, and other management system standards.

Clause Title In one line
1 Scope What the standard covers
2 Normative references ISO 9000, the vocabulary standard
3 Terms and definitions Key QMS terms, now partly included in the standard itself
4 Context of the organization Understand your situation and define what the QMS covers
5 Leadership Top management owns the QMS, the policy, and the culture
6 Planning Act on risks and opportunities, set objectives, plan changes
7 Support Provide people, competence, infrastructure, and documented information
8 Operation Plan, make, buy, and deliver products and services under control
9 Performance evaluation Measure, audit, and review how the QMS performs
10 Improvement Fix nonconformities and keep getting better

What counts as a requirement?

Only the "shall" statements are requirements, and only those can lead to a nonconformity in an audit. "Should" signals a recommendation, "may" signals a permission, and "can" signals a possibility. Notes under a clause and the informative Annex A explain intent, but an auditor cannot raise a finding against them. Read the notes anyway: they show how your auditor is likely to interpret the requirement.

What changed in ISO 9001:2026?

ISO 9001:2026 is a refinement of the 2015 version of the standard. The clause structure stays the same. Most changes clarify wording, raise the profile of leadership and culture, and split risks and opportunities into separate requirements.

What ISO says the 2026 edition focuses on

ISO describes the new edition around four aims:

  • Clearer requirements so organizations of all sizes and levels of maturity can understand what they need to do
  • More emphasis on quality culture and leadership, placing them firmly with top management
  • Risks and opportunities separated, so you act to pursue beneficial results, not only to avoid threats
  • Better alignment with other ISO management system standards, which makes an integrated management system easier to run

In practice, that means a few concrete updates. Top management must now promote a quality culture and ethical behavior (Clause 5.1). Risks and opportunities have separate analysis and evaluation requirements (Clause 6.1). Management review inputs are now mandatory, with a new input on changing interested party needs (Clause 9.3). The 2024 climate change amendment is part of the main text: you must decide whether climate change is a relevant issue for your context (Clause 4.1). Annex A is expanded guidance, while Annex B is gone.

What stays the same?

The Clause 4 to 10 structure, the process approach, the Plan-Do-Check-Act cycle, and risk-based thinking all carry forward. The edition adds no new mandatory documents and no new requirements on AI, cybersecurity, or sustainability. If your ISO 9001:2015 QMS works well today, consider transitioning to the 2026 version an update instead of a complete re-write.

How long do you have to transition?

You have three years since the new standard was published. Under the transition arrangements reported for the accreditation community, certification bodies stop issuing new and initial accredited certificates to the 2015 edition from March 31 2028. Every existing ISO 9001:2015 certificate must transition by September 30 2029 (ISO/TC 176).

Certification bodies expect a rush in 2029. Plan your transition for a 2027 or 2028 audit to keep your options open.

Is your ISO 9001:2015 certificate still valid?

Yes. Your ISO 9001:2015 certificate stays valid during the transition period, up to September 30 2029 at the latest. Most organizations transition at a scheduled surveillance or recertification audit, which keeps cost and disruption low. A separate transition audit is also possible. If you miss the deadline, your 2015 certificate will no longer be valid and you'll need a full initial certification audit.

Group%20290520

Future-proof your QMS for ISO 9001:2026 and beyond

Achieve ISO 9001:2026 readiness 60% faster while building a modern, future-proof QMS foundation

ISO 9001 requirements clause by clause

Each of Clauses 4 to 10 asks your QMS to do something specific and to show evidence that it does it effectively. Use the table to orient yourself, then read further to expand on the clause you're working on.

Clause What it requires What an auditor looks for
4 Context Know your issues, interested parties, and QMS scope A documented scope, a current issues and stakeholder analysis, a process map
5 Leadership Top management owns the QMS and its culture A quality policy, assigned roles, managers who can explain both
6 Planning Act on risks and opportunities, set objectives, plan changes A risk and opportunity register, measurable objectives with owners
7 Support Provide resources, competence, awareness, and documentation Competence records, calibration records, controlled documents
8 Operation Control how you design, buy, make, and deliver Requirements reviews, supplier evaluations, release and nonconformity records
9 Performance evaluation Measure, audit, and review KPI data, customer feedback, internal audit and management review records
10 Improvement Correct nonconformities and keep improving Corrective action records with root causes and effectiveness checks

Clause 4, context of the organization

Clause 4 asks you to understand your situation before you build anything. Determine the internal and external issues that affect your ability to deliver quality: market pressure, technology, staffing, regulation, and, under the 2026 edition, whether climate change is relevant to you.

Identify your interested parties and what they require of you: customers, regulators, owners, suppliers, and employees. Then define the scope of your QMS (Clause 4.3): which sites, products, and services it covers, and which requirements, if any, don't apply.

Finally, establish your QMS processes (Clause 4.4). For each one, you need to know its inputs and outputs, sequence, owners, criteria, risks, and how you measure it. An auditor will expect a process map or equivalent, and will test whether the people running each process recognize it.

Clause 5, leadership

Clause 5 makes top management accountable for the QMS. Delegating the work is fine, but delegating the accountability isn't.

Leaders must integrate the QMS into business processes, provide resources, promote the process approach and risk-based thinking, and keep customer focus front and center (Clause 5.1.2). They set a quality policy that fits the organization's context and strategic direction, and they communicate it (Clause 5.2). They assign roles, responsibilities, and authorities so everyone knows who does what (Clause 5.3).

This is where the 2026 emphasis on quality culture lands. Clause 5.1 now requires top management to promote a quality culture and ethical behavior. Expect auditors to ask leaders how they do that: through decisions, recognition, how they respond to bad news, and what they prioritize when quality and deadlines collide.

Clause 6, planning

Clause 6 turns context into a plan. It covers actions to address risks and opportunities (6.1), quality objectives and how you'll achieve them (6.2), and planning of changes to the QMS (6.3).

The 2026 edition's biggest structural change sits in Clause 6.1. ISO 9001:2015 treated "risks and opportunities" as one item, so many organizations kept a risk register and listed a few opportunities at the bottom. The 2026 edition separates them: risks and opportunities each need to be determined, analyzed, and evaluated in their own right, and you plan actions for both. The aim is to pursue beneficial results actively, not only to prevent harm.

In practice, what this means is that you need to review your register. Opportunities need the same treatment as risks: an owner, an evaluation, an action, and a follow-up. The same split carries into analysis (Clause 9.1.3) and management review (Clause 9.3).

Quality objectives must be measurable, monitored, communicated, and updated, with a plan for what, who, by when, and how you'll evaluate results. For changes, the 2026 edition adds considerations on communicating changes and reviewing whether they worked.

Clause 7, support

Clause 7 makes sure your processes have what they need to run. That includes people, infrastructure, a suitable working environment (which now explicitly covers culture and behavior), monitoring and measuring resources, and organizational knowledge (Clause 7.1). It also covers awareness (7.3), communication (7.4), and documented information (7.5).

Note that ISO 9001 doesn't prescribe specific courses. Instead, Clause 7.2 asks you to:

  • Define the competence each role needs to affect quality
  • Make sure people are competent through education, training, or experience
  • Close gaps through training, mentoring, or hiring, and check the action worked
  • Retain evidence of competence

An auditor will pick a role, ask what competence it requires, and check the records for the person doing it. Under Clause 7.3, everyone working under your control must also know the quality policy, relevant objectives, their contribution, and, in the 2026 edition, the quality culture and expected behavior.

Clause 8, operation

Clause 8 is the largest clause and covers how you deliver. It requires operational planning and control (8.1), and determining and reviewing customer requirements before you commit (8.2). Design and development has a controlled path from inputs to validated outputs (8.3). Production and service provision (8.5) runs under controlled conditions, with identification, traceability, and care for customer property. You release products only after planned checks pass (8.6), and you identify and control nonconforming outputs (8.7).

These requirements extend to your vendors too. Clause 8.4 covers externally provided processes, products, and services, including outsourced work. You must:

  • Set criteria to evaluate, select, monitor, and re-evaluate suppliers, and retain the results
  • Decide how much control to apply based on the supplier's impact on your output
  • Give suppliers clear requirements: what you're buying, approval, competence, and verification

Auditors usually sample a critical supplier and follow the trail from evaluation to purchase order to incoming inspection.

Clause 9, performance evaluation

Clause 9 asks you to prove the QMS works. Decide what to monitor and measure, how, and when, then analyze the results (9.1). Monitor customer satisfaction, through surveys, complaints, repeat business, or other feedback (9.1.2).

This is where internal audits come in. Clause 9.2 requires you to:

  • Plan an audit program that reflects process importance, changes, and past results
  • Define the criteria and scope of each audit
  • Select auditors who are objective and impartial, so no one audits their own work
  • Report results to relevant management and act on findings without undue delay
  • Retain evidence of the program and its results

Management review (9.3) closes the loop. In the 2026 edition, the listed inputs are mandatory, and risks and opportunities are reviewed separately. Outputs must include decisions on improvement, changes, and resources.

Clause 10, improvement

Clause 10 keeps the QMS moving forward. When a nonconformity occurs, including one raised by a complaint, you react to control and correct it, then deal with the consequences (10.2). Find the root cause, check whether similar issues exist or could occur, take corrective action, and review whether it worked. Retain records of the nonconformity, the action, and the result.

Continual improvement means using results from analysis, audits, and management review to improve the suitability, adequacy, and effectiveness of the QMS. The 2026 edition combines the general and continual improvement requirements under one "continual improvement" heading.

What are the 7 quality management principles?

The seven quality management principles from ISO 9000 sit behind every ISO 9001 requirement. They aren't auditable on their own, but each one shows up in what an auditor checks:

  1. Customer focus: you know your customers' requirements and track whether you meet them
  2. Leadership: top management sets direction, and staff can explain how their work connects to it
  3. Engagement of people: people at every level know their role in quality and are competent to do it
  4. Process approach: you manage activities as connected processes with owners, inputs, outputs, and measures
  5. Improvement: you act on audit findings, data, and nonconformities, and can show what changed
  6. Evidence-based decision making: decisions in management review trace back to data, not opinion
  7. Relationship management: you evaluate and manage suppliers and partners based on their impact on your quality

Strengthen Quality Management at scale

Move beyond fragmented tools and manual processes while retaining full control over your QMS and continuous improvement program.

What documents are mandatory for ISO 9001?

ISO 9001 calls everything you document "documented information." It splits into information you maintain, like policies and process descriptions, and information you retain as evidence, like records. The 2026 edition rewords many "maintain" requirements to "available as documented information," but adds no new mandatory documents.

Documented information you must maintain

  • Scope of the QMS (Clause 4.3)
  • Quality policy (Clause 5.2)
  • Quality objectives (Clause 6.2)
  • Documented information to support the operation of your processes, to the extent you need it (Clause 4.4)

Records you must retain

Record Clause (ISO 9001:2026)
Monitoring and measuring equipment: calibration and verification 7.1.5
Evidence of competence 7.2
Review of product and service requirements 8.2.3
Design and development: inputs, controls, outputs, changes 8.3
External provider evaluation, selection, and monitoring 8.4.1
Traceability, where it's a requirement 8.5.2
Changes to production or service provision 8.5.6
Release of products and services 8.6
Nonconforming outputs 8.7
Monitoring and measurement results 9.1.1
Internal audit program and results 9.2
Management review results 9.3
Nonconformity and corrective action 10.2

What does ISO 9001 not require?

ISO 9001 doesn't require a quality manual, and it doesn't require a fixed set of documented procedures. Both disappeared as mandatory items in 2015, and the 2026 edition doesn't bring them back. The standard asks you to demonstrate control over your processes, not to produce a specific list of documents. Many organizations keep a manual because it helps new staff and customers.

Confirm clause references against the 2026 edition

The clause numbers above follow ISO 9001:2026. For these records, they're the same as in ISO 9001:2015, so most existing document matrices still line up. The renumbering sits elsewhere: risks and opportunities now have separate subclauses in Clause 6.1, and Clause 10 merges general and continual improvement into 10.1. Before you update your document matrix, check each reference against your copy of ISO 9001:2026.

Can you exclude any ISO 9001 requirements?

Yes, but only where a requirement can't apply to your QMS scope. Under Clause 4.3, you can state that a requirement isn't applicable, and you must justify it in your documented scope. The test is strict: excluding it can't affect your ability to deliver conforming products and services, or to increase customer satisfaction.

In practice, exclusions come from Clause 8, such as design and development, and occasionally from monitoring and measuring resources (7.1.5), and only where you don't perform the activity. The management system requirements in Clauses 4, 5, 6, 9, and 10 always apply.

  • A legitimate exclusion: a distributor that resells finished products to a customer's specification excludes design and development (8.3). It doesn't design anything, so the clause has nothing to control
  • An exclusion that fails an audit: a software company excludes design and development because "we're agile and don't do formal design." It still turns customer requirements into new features, so it designs. The auditor will raise a nonconformity against the scope

ISO 9001 requirements checklist

Use these questions to run a quick self-assessment. If you can't answer "yes" and point to evidence, you've found your next gap to close.

  • Clause 4: Have we documented our scope, issues (including climate change), interested parties, and core processes, and reviewed them in the last 12 months?
  • Clause 5: Can top management show how they promote a quality culture, and is the quality policy communicated and understood?
  • Clause 6: Do we analyze and act on risks and opportunities separately, and do our quality objectives have owners, targets, and deadlines?
  • Clause 7: Do we hold competence records for every role that affects quality, and is our documented information controlled?
  • Clause 8: Do we review requirements before committing, evaluate suppliers, and control nonconforming outputs?
  • Clause 9: Did we complete our planned internal audits and a management review that covered every required input?
  • Clause 10: Does every corrective action have a root cause and an effectiveness check?

What does ISO 9001 certification require?

Certification means an accredited certification body confirms that your QMS meets the ISO 9001 requirements. It follows a three-year cycle:

  1. Stage 1 audit: the auditor reviews your documentation, scope, and readiness, and flags gaps before the main audit
  2. Stage 2 audit: the auditor checks that your QMS works in practice, through interviews, records, and observation. Pass, and you receive your certificate
  3. Surveillance audits: shorter audits in years one and two confirm that you maintain and improve the system
  4. Recertification audit: before the certificate expires after three years, a full audit renews it for another cycle

Certification isn't mandatory. You can implement ISO 9001 to improve quality without ever being audited. Many organizations certify anyway, because customers and tenders ask for the certificate.

How DataGuard helps your team meet ISO 9001 requirements

DataGuard brings your QMS into one platform, so the requirements in this guide become tasks with owners instead of a spreadsheet no one updates.

  • Run a gap analysis between your ISO 9001:2015 system and the 2026 edition, and see exactly what to update
  • Manage risks and opportunities in separate registers, with owners, actions, and follow-ups, as Clause 6.1 now expects
  • Keep documented information audit-ready, from your quality policy to competence and supplier records
  • Plan internal audits and management reviews with every required input in one place
  • Build on what you have: if you already run ISO 27001, NIS2, or the Cyber Resilience Act in DataGuard, reuse your controls in one integrated management system

Our customers have achieved a 100% first-time pass rate in audits against standards such as ISO 27001 for more than seven years. Ready to make ISO 9001:2026 your next one? Book a demo.

Frequently asked questions

What are the basic requirements of ISO 9001?

What are the 7 principles of ISO 9001?

What documents are mandatory for ISO 9001?

Which version of ISO 9001 applies now?

Is ISO 9001:2015 still valid?

How long do I have to transition to ISO 9001:2026?

How many requirements does ISO 9001 have?

Do I have to be certified to use ISO 9001?

🏢 Organization Schema Preview (Development Only)
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "www.dataguard.com#organization",
      "name": "DataGuard",
      "legalName": "DataCo GmbH",
      "description": "DataGuard, the European leader in security and compliance software, is trusted by more than 4,000 organizations across 50+ countries. We help you identify and manage your security and compliance risks and fast-track your certifications and compliance by combining expert consultancy with AI-powered automation. Our purpose-built, all-in-one platform is developed with the experience of over 1.5 million total hours by a team of certified security and compliance experts.",
      "foundingDate": "2018",
      "taxID": "DE315880213",
      "logo": "https://7759810.fs1.hubspotusercontent-na1.net/hubfs/7759810/DataGuardLogo.svg",
      "url": "www.dataguard.com",
      "email": "info@dataguard.de",
      "telephone": "+49 89 452459 900",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "Sandstrasse 33",
        "addressLocality": "Munich",
        "addressRegion": "Bavaria",
        "postalCode": "80335",
        "addressCountry": "Germany"
      },
      "sameAs": [
        "https://www.linkedin.com/company/dataguard1/",
        "https://www.youtube.com/channel/UCEQzPZ6sCBCj9cAoBvaLL6w",
        "https://x.com/i/flow/login?redirect_after_login=%2FDataGuard_dg"
      ]
    }
  ]
}

✅ Organization schema markup for "DataGuard" has been injected into the document head.