QA/RA Consulting, Auditing & Training
QA/RA Consulting, Auditing & Training
It is common practice to refer to revisions of standards as “significant” from time to time. The newly revised ISO 9001:2026 standard is termed “substantive” by the ISO standards body. However, the certification bodies that were members of the drafting committee use their own expression for this: a targeted evolution. Approximately 90% of the text is taken from the 2015 standard, with the language having been made clearer. The other 10% is where the actual changes lie, and it is this part to which auditors will now need to pay attention. The 2026 revision contains 65 requirements, namely Clauses 4 to 10, of which 16 have been amended, 2 are new, and Annex A has been expanded and rewritten.
ISO 9001:2026 was issued on 16 September 2026 and replaces the 2015 version. The new standard places more emphasis on how leadership, organizational culture, and ethical behavior are demonstrated in practice rather than being recorded in procedures and manuals.
The guiding principle in the developments from 1959 to 2026 has been trust:
The key features of ISO 9001 remain the same in the new edition. ISO 9001:2026 is fully compatible with the ISO Harmonized Structure – which is the common framework of clauses, core text, and definitions used by all of the ISO management system standards – and the sequence of Clauses 4 to 10 is identical to that in the 2015 version. A medical device company holding certification to both ISO 13485 and ISO 9001 can update the ISO 9001 part of its system without needing to make any changes to the ISO 13485 structure that comes below it.
ISO 9001:2026 is still based on the same seven quality management principles as before: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. In the 2026 edition, the importance of two of these principles – leadership and engagement of people – is made clearer, and each clause in Annex A is restated to explain this. Annex A remains entirely informative and is meant for use in training and internal audits; it can be quoted when a clause is in question, but no nonconformity can ever be issued against it directly.
Ninety percent of the ISO 9001:2026 standard is almost identical to the 2015 version. Five changes in ISO 9001:2026 have led to the introduction of new requirements or to the strengthening of existing ones, and any audit carried out based on ISO 9001:2026 will have to consider them. Let’s review these five changes.
The February 2024 amendment to ISO 9001 has been incorporated into the main part of the document and is no longer shown as an appendix. When addressing external matters, ISO had to determine whether climate change was relevant; if it was, then it must be considered in the quality management system, but if it was not, ISO had to be able to provide a reason. This obligation is set out in Clause 4.1 and relates to the reliability and consistency of supply, not to a reduction in carbon emissions.
ELIQUENT “IQ” insight: The reply “We don’t track that” can no longer be regarded as a valid answer if someone asks about climate relevance, since in such cases one has to respond, “We have looked at it and this is why it does not apply to us.”
Top management should demonstrate their leadership and commitment in this area by, for example, promoting these concepts and serving as an example of a culture grounded in quality and ethical conduct. The standard defines culture as including the shared values, beliefs, attitudes, and actual behavior. This is the first time in Clause 5.1.1 that behavior – not just documents – is required of leadership, and it is also the change most likely to result in audit findings. One way of determining what quality culture means to each individual on site is to ask them directly, and a blank look will function as objective evidence.
ELIQUENT “IQ” insight: If the leadership team’s involvement in quality had consisted of nothing more than a single annual review, then every person in the room (as well as all of the operators whom the auditors encounter on the floor) would realize this.
The quality policy should take into account the organization’s circumstances and its strategic plan; a general quality policy made up of only three lines that was copied from a template will eventually make it difficult for the company to meet the requirements of Clause 5.2.1. It is essential that the quality policy indicates where the organization is going and what requirements the organizational environment places on it. This is why the committee in charge of preparing the quality policy and the committee responsible for drawing up the strategic plan must take part in the same discussions and not have their determinations contained in two separate documents that happen to be kept in the same binder.
ELIQUENT “IQ” insight: A lack of coordination will be revealed by Clause 5.2.1 if the quality policy and the strategic plan are prepared by two different teams that have little communication between them.
Clause 6.1 is no longer a single section but has instead been split up into three parts:
The planning and evaluation criteria are specific to each section. Opportunities should no longer be viewed simply as the positive counterpart to risks; the 2026 revision gives each distinct consideration. merely having a risk register that also included opportunities would not by itself be sufficient to meet the ISO 9001:2026 stipulations. The requirement in Clause 6.3 on the planning of changes also includes a separate provision requiring organizations to first check whether a change has had an effect and then to examine the results of that change. Even though such checks have previously been carried out in an informal manner, the standard now makes this requirement explicit.
ELIQUENT “IQ” insight: Even though the attitude in 2015 was that the combined risk-and-opportunity spreadsheet was defensible, in 2026 it is expected that auditors should have each element of that equation separately planned, owned, and reviewed.
All the individuals who carry out work under the organization’s control must be made aware of:
Since simply being aware of the quality policy is no longer enough – awareness training and induction materials based on the 2015 version will have to be amended. People who are currently on site may now be the subject of an audit interview, and the standard requires that they should be able to talk about the culture and ethics, not just recite the policy.
ELIQUENT “IQ” insight: Annual awareness training was enough for 2015 auditors. However, in 2026, the more relevant question is whether or not your front-line staff would attain the same standard of judgment as you yourself would if they didn’t get specific training.
In order to improve clarity, some amendments have been made in the ISO 9001 standard, even though no single occurrence of the word “shall” has been included. The definitions in Clause 3 have been made more specific, and in those cases where terms such as “risk,” “opportunity,” or “documented information” appear to have changed in meaning, one should first consult that clause. Clauses 8, 9 and 10 – the ones covering operation, performance evaluation, and improvement – have undergone only minor changes in terminology and structure; the essential content from 2015 is still present, even though Clause 10 now clearly links continual improvement to the leadership requirements set out in Clause 5. Annex A has been rewritten sentence by sentence and is now a useful resource for training and for internal audits, although it must be noted that no nonconformity can be found against it.
After much discussion among the committee members, the standard has been intentionally kept technology-neutral with regard to artificial intelligence. There are no specific requirements concerning AI. In those cases where AI is involved in making decisions that have an effect on quality, the existing clauses on process control, output validation and competence apply.
It is anticipated that a three-year transition period will take place, provided that the International Accreditation Forum gives its formal approval.
The true limitation isn’t the main date but rather the practical deadline (i.e., the point by which an organization must have finished its transition audit), which is set several months prior to September 2029 after both the certification body’s audit schedule and the organization’s own plans for 2028 have been taken into account. Companies that carry out a gap analysis at this stage will be in a better position than those who wait for their certification body to start the process.
As a result of the five changes discussed above, ISO 9001:2026 is now specifying a quality management system that can no longer merely rely on documentation:
An organization cannot simply update its current quality manual in order to meet all of the stipulations of ISO 9001:2026. Therefore, organizations must review how each clause is put into practice on a day-to-day basis – just having it in writing is not enough.
ISO 9001:2026 is not by any means just a routine update, and the greatest risk that organizations will face in the years to come is that they won’t recognize it. This is due to the fact that the standard has 65 requirements spread over Clauses 4 to 10; includes 5 changes that bring in new expectations; has a practical deadline that is long before the September 2029 date mentioned in the standard; and now demands that leadership, culture, and strategy be demonstrated through evidence rather than just being listed in the quality manual. Therefore, organizations that begin to plan early will be able to make the transition manageable rather than having to rush to compliance.
In order that organizations may be able to compare their existing quality management system with ISO 9001:2026, identify the five changes that involve a real risk to conformance to the standard, and set up a realistic timetable for the transition before the practical cutoff (not just the September 2029 deadline), ELIQUENT Life Sciences offers training, carries out gap assessments, and provides advisory support to help organizations:
For more information and assistance in meeting the new specifications of ISO 9001:2026, reach out to us online or call 800-472-6477 to get the answers you need.
US Office Washington DC
Build risk review into existing tools and processes: Add safety-related acceptance criteria to user stories, identify backlog items that implement or affect controls, address failure behavior in architecture reviews, and use controlled continuous-integration evidence for verification.
Developers can translate technical failure conditions into controls and testable criteria; risk-management and clinical stakeholders can connect them to potential harm and intended use.
Top management should demonstrate their leadership and commitment in this area by, for example, promoting these concepts and serving as an example of a culture grounded in quality and ethical conduct. The standard defines culture as including the shared values, beliefs, attitudes, and actual behavior. This is the first time in Clause 5.1.1 that behavior – not just documents – is required of leadership, and it is also the change most likely to result in audit findings. One way of determining what quality culture means to each individual on site is to ask them directly, and a blank look will function as objective evidence.
ELIQUENT “IQ” insight: If the leadership team’s involvement in quality had consisted of nothing more than a single annual review, then every person in the room (as well as all of the operators whom the auditors encounter on the floor) would realize this.
ELIQUENT Life Sciences offers training and advisory services in medical device software development, risk management, verification and validation, design controls, and quality systems. Explore its offerings to strengthen risk-based decisions across the software lifecycle. Learn more about ELIQUENT Life Sciences’ training and consulting services.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.