ISO 9001

ISO 9001 is the international standard for a quality management system (QMS): the way you make sure what you deliver meets customer and legal requirements, and keep getting better at it. It is voluntary and certifiable, and fits any organisation of any size. Customers, tenders and supply chains ask for it, and an accredited certification body issues the certificate.

What it is and who it applies to

The International Organization for Standardization (ISO) published ISO 9001:2026, the sixth edition, on 16 September 2026. It replaces ISO 9001:2015 and its Amendment 1:2024, which asked you to decide whether climate change is relevant to your context and your interested parties (ISO 9001:2015 4.1 and 4.2). That climate text carries over into the 2026 edition.

The top-level structure is unchanged: requirements in clauses 4 to 10, in the same order as every recent ISO management system standard. Certification bodies and consultancies report four main changes: top management now has to promote a quality culture and ethical behaviour, risks and opportunities get separate requirements, planning of changes asks for more, and the informative annex has grown. Most certificates in force in October 2026 still name the 2015 edition, so the sub-pages cite 2015 clause numbers and say where the 2026 edition differs.

No UK or EU law makes ISO 9001 compulsory for most organisations. It applies when someone you work with asks for it: a manufacturer qualifying you as a supplier, a public-sector buyer scoring a tender, or a distributor that only stocks certified products. Automotive and aerospace quality standards build on it, and so does the ISO 13485 standard for medical devices, which keeps the older layout of ISO 9001:2008, with its requirements in clauses 4 to 8.

The standard is generic on purpose. A software company, a cleaning contractor and a laboratory all meet the same requirements, each through its own processes.

This is guidance to help you understand the requirement, not legal advice.

Structure

ISO 9001 has no control annex. The numbered clauses are the requirements, and the certification auditor tests each one against your processes. The table paraphrases each clause group; the standard’s own wording is not reproduced.

What “not applicable” means

ISO 9001 does not use the word “exclusion”. If a requirement cannot apply to you, such as design and development for a firm that builds only to customers’ drawings, your scope says so and why (ISO 9001:2015 4.3). The test is strict: leaving it out must not affect your ability to deliver conforming products and services or to satisfy customers. A software company that writes its own product cannot set aside design and development (ISO 9001:2015 8.3).

The 2015 edition also stopped asking for a quality manual and a fixed set of six documented procedures. You keep the documented information the clauses name (ISO 9001:2015 7.5) and whatever else your processes need to run well.

Certification and enforcement

Certification is voluntary and nobody enforces ISO 9001 itself; the contract or tender that asks for it does. Certificates come from certification bodies. In the UK, choose one accredited by UKAS for ISO 9001, because an accredited certificate is the one buyers and tenders recognise.

The first certification runs in two stages. Stage 1 checks that the system is designed, documented and ready, and that the scope makes sense. Stage 2 checks that it runs: the auditor follows work through your processes, samples records and talks to the people doing the job. Findings are graded as major or minor nonconformities, and a major one must be closed before the certificate is issued.

A certificate lasts three years. Surveillance audits in the first and second years sample the system, and a recertification audit in the third year looks at all of it again.

Moving to the 2026 edition

Certification bodies report that the transition ends on 30 September 2029, when certificates to the 2015 edition expire or are withdrawn. The move usually happens at a surveillance or recertification audit, sometimes with extra time added, and covers the changed requirements: quality culture, the separate handling of opportunities, and planning of changes. Ask your certification body for its own cut-off dates, because some stop offering initial certification to the 2015 edition before the transition ends.

What a certificate actually says

A certificate names a scope: the products, services and sites it covers, and often any requirement set aside as not applicable. Read the scope before you rely on a supplier’s certificate. A certificate for a head office’s “sales and administration” says nothing about the factory that makes your parts.

How long a first certificate takes depends on how much of the system already exists, how many sites and processes are in scope, and how long the auditor wants to see records. Certification bodies expect an internal audit and a management review before stage 2, so plan for months rather than weeks.

How the pieces fit

The clauses form a plan, do, check and act loop. Context and interested parties tell you what quality means for your customers. Leadership turns that into a quality policy and roles. Planning decides which risks and opportunities to act on and sets objectives. Operation does the work. Measurement, internal audit and management review check whether it worked, and improvement fixes causes and feeds the next round of planning.

Operation is highlighted because it is where most of an ISO 9001 audit is spent. Unlike ISO 27001, which has the same clause layout but puts its weight on risk assessment and Annex A, ISO 9001 puts the detail in clause 8: customer requirements, design, suppliers, production, release and nonconforming output.

Clause 7 runs underneath every step. It supplies the competent people, working infrastructure, calibrated measuring equipment and controlled documents the loop depends on. Customer satisfaction runs through the whole loop: it is a planning input, a measure in clause 9 and the reason improvement exists.

In this section

• Context and leadership: what is in scope, who has a stake in your quality, and what must top management do?
• Planning, risks, opportunities and quality objectives: how much risk management does ISO 9001 want, and what makes a good quality objective?
• Support, resources, competence and documented information: what people, equipment, knowledge and documents does the system need?
• Operation: how do you control customer requirements, design, suppliers, production and nonconforming output?
• Performance evaluation: what do you measure, how do you audit, and what does management review cover?
• Improvement: what happens when something goes wrong, and how do you show you keep improving?

How Sted maps it

ISO 9001 is one of the standards, regulations and schemes in Sted’s catalogue.

Sted treats it as committed when you already hold it, are working towards it, a customer requires it, or you already run a quality management system. It recommends it when its benefit assessment says a customer or supply chain expects it. It never treats ISO 9001 as a legal requirement. Those rules work from your recorded onboarding answers; the AI model does not decide them.

Sted shows the recommendation with its reasons, and you select ISO 9001 or leave it. Administrators and Policy and Process Owners make that choice. Selecting it and pressing Update and generate framework builds the documents it needs.

For ISO 9001 Sted’s knowledge base carries 17 policies and procedures and 41 record templates tagged to its clauses, led by the Quality Policy and a set of procedures shared with ISO 13485 and ISO 27001. They are drafted for your organisation, for you to review and approve. Clause 4 is not a document: your scope, interested parties, obligations, issues, objectives, risks and processes sit in management-system registers.

Sted does not certify you, audit you or choose your certification body. It prepares the documents and records an auditor samples, and shows how much of that work is done.

Frequently asked questions