ISO 9001

ISO 9001 is the most widely used management system standard in the world, with more than a million certificates in circulation. It applies to organisations of any size in any sector: manufacturers, consultancies, charities, contractors and public bodies all hold it.

It is often described as a quality standard, which is slightly misleading. ISO 9001 does not tell you what your product should be like. It sets requirements for the system you use to run the business: how you understand what customers need, how you plan work, who is responsible for what, how you check results, and what you do when something goes wrong.

Certification does not require you to change how you operate. It requires you to be clear about how you operate, do it consistently, and be able to show evidence of both.

The current edition is ISO 9001:2026, published on 16 September 2026. Organisations certified to ISO 9001:2015 have until 30 September 2029 to move to it, and the changes are explained below.

Why organisations get certified

Three reasons come up repeatedly, usually in combination.

It is a condition of doing business. UKAS-accredited ISO 9001 certification is frequently a requirement for supplying large companies, local authorities and government-funded bodies including the NHS and MoD. For many organisations the first conversation about ISO 9001 begins with a tender document.

It reduces the cost of getting things wrong. Rework, missed deadlines, repeated mistakes and customer complaints all have a price. A system that catches problems earlier, and stops the same problem recurring, pays for itself in ways that are visible on the profit and loss.

It survives people leaving. Organisations that depend on a few individuals knowing how everything works are fragile. Documented processes make that knowledge transferable.

The seven quality management principles

ISO 9001 is built on seven principles, all of which carry over unchanged into the 2026 edition. They are worth understanding, because they explain why the standard asks for what it asks for.

• Customer focus. Meeting customer requirements, and aiming to exceed them.
• Leadership. Top management setting direction and creating the conditions for people to deliver it.
• Engagement of people. Competent, empowered people at every level.
• Process approach. Understanding activities as connected processes rather than isolated tasks.
• Improvement. Treating improvement as ongoing rather than occasional.
• Evidence-based decision making. Decisions grounded in data and analysis.
• Relationship management. Managing relationships with suppliers and partners deliberately.

What ISO 9001 actually requires

The standard follows the common structure shared across ISO management system standards, which is why it integrates cleanly with ISO 14001, ISO 45001 and others. The summary below reflects the 2026 edition.

Context. Understanding your organisation, the issues affecting it (including whether climate change is relevant), who your interested parties are and what they need, deciding which of those needs the system will address, and defining the scope of the system.

Leadership. Demonstrable commitment from top management, including promoting a quality culture and ethical behaviour, a quality policy, and clearly assigned responsibilities. Auditors probe this one hard, because a system nobody senior owns tends not to work.

Planning. Identifying and evaluating risks and, separately, opportunities, setting quality objectives and planning how to achieve them, and planning changes so they are carried out in a controlled way.

Support. Resources, competence, awareness, communication and documented information, plus the organisational knowledge your people need, which must be retained, applied and shared.

Operation. Controlling the processes that deliver your product or service, from understanding requirements through design, purchasing, production and delivery, including anything supplied by an external provider.

Performance evaluation. Monitoring, measurement, internal audit (with defined objectives for each audit) and management review.

Improvement. Handling nonconformities, taking corrective action, and improving the system over time.

What changed in ISO 9001:2026

ISO 9001:2026 was published on 16 September 2026, replacing ISO 9001:2015. It is the first substantial revision since 2015.

The transition rules are set by Global Accreditation Cooperation Incorporated (Global ACI), which took over the role of the International Accreditation Forum in January 2026:

• Organisations certified to ISO 9001:2015 have until 30 September 2029 to move to the new edition.
• From 31 March 2028, new and initial accredited certificates can only be issued to ISO 9001:2026.
• The move can be assessed at a scheduled surveillance or recertification audit, or at a separate transition audit.
• In the UK, certification bodies need UKAS approval for the new edition before they can issue UKAS-accredited ISO 9001:2026 certificates. UKAS begins making these decisions in January 2027 and all must be completed by 30 September 2027, so check with your certification body when it will be ready.

The main changes

Most of the standard is reworded rather than rewritten, but several clauses add requirements that auditors will look for evidence of:

• Quality culture and ethical behaviour. Top management must promote both, and people working under your control must be aware of them.
• Risks and opportunities, handled separately. Each now has its own clause. Risks must be analysed and evaluated, which can include your ability to keep delivering during and after a disruption, and opportunities must be identified and acted on in their own right.
• Planning of changes. Change planning must now cover how changes are communicated, how their effectiveness is monitored and how the results are reviewed.
• Interested parties. You must decide which of their requirements the system will address, and changes in their needs become a required management review input.
• Organisational knowledge. Knowledge must be retained, applied and shared, and must support the results of the whole system, not only product conformity.
• External providers. Controls now apply to any process supplied by an external provider, not only those you decided to outsource.
• Customer communication. Where relevant, customers must be given information about contingency actions, including any disruption to the products or services you provide.
• Internal audit. Each audit needs defined objectives, as well as criteria and scope.
• Continual improvement. The improvement clauses are combined into one, with opportunities drawn from monitoring, analysis and management review.

The guidance in Annex A has also been expanded to cover every clause, and the core management system terms are now defined within the standard itself.

If you are already certified

For a well-maintained system the transition is manageable, but it is more than a find-and-replace. Most organisations will need to update their context and interested party analysis, separate their risk and opportunity records, strengthen how changes are planned, add objectives to audit plans, revise the management review agenda, and bring quality culture and ethics into induction and awareness material. Our transition support covers each step.

What matters more than the deadline is the practical timing: certification bodies usually assess the transition at a scheduled surveillance visit, so the real decision point arrives well before 2029, and slots become scarce when everyone moves at once.

If you are certifying for the first time

If you are ready to start but unsure whether to wait for the new edition, there is no need to. We build new systems to meet the requirements of both ISO 9001:2015 and ISO 9001:2026, so you are ready for certification whenever you want or need it, whichever edition your certification body audits against at the time.

Two dates are worth knowing. UK certification bodies stop accepting new applications against ISO 9001:2015 on 16 March 2028, and from 31 March 2028 new certificates can only be issued to ISO 9001:2026. Any certificate issued to the 2015 edition before then still has to transition by 30 September 2029.

How certification works

Certification is issued by an independent certification body, not by a consultancy. Equas prepares you for that audit and is with you during it, but the certificate comes from the certification body, which is itself accredited by UKAS.

The assessment happens in two stages. Stage 1 is largely a documentation and readiness review, checking you have a system and that it is ready to be audited. Stage 2 is the substantial audit of whether the system is genuinely implemented and effective. They are usually a few weeks apart.

Before either can happen, you need to have completed at least one internal audit of the whole system and held a management review. These are the two things certification bodies check for first, and the two most commonly missing.

Why UKAS accreditation matters

UKAS is the sole accreditation body recognised by the UK government. It does not certify organisations: it accredits the certification bodies that do.

Certificates from non-accredited bodies are cheaper and faster, and they are routinely rejected in tenders and supply chain assessments. If certification is being driven by a customer requirement, check the wording of that requirement before choosing a certification body, because "ISO 9001 certified" and "UKAS-accredited ISO 9001 certified" are not the same thing.

How long it takes

For a single standard in a small to medium organisation, three to six months from starting work to the certification audit is common. Multi-site, multi-standard or heavily regulated organisations take longer.

Whether the effort is worth it is a fair question, and our honest assessment of the benefits sets out which ones hold up. The main variable is not the standard. It is how much time your own people can give the project, and how much of the existing way of working is already written down. A gap analysis at the start will tell you which of those two you are dealing with, and implementation support covers the build itself.

Working in Construction or Property?

If your organisation designs, builds, maintains or operates built assets, BS 99001 extends ISO 9001 with requirements written specifically for the built environment. Your ISO 9001 system forms the foundation, so the step up is usually smaller than you might expect.