ISO 9001 operation

ISO 9001:2015 clause 8 controls the work itself. You plan operations (8.1), agree and review customer requirements (8.2), control design (8.3) and external providers (8.4), run production and service under controlled conditions (8.5), release only what meets requirements (8.6), and stop nonconforming outputs reaching customers (8.7).

The requirement in plain English

Planning and requirements (ISO 9001:2015 8.1 and 8.2). You plan the processes that deliver your products and services, with criteria, resources and controls, including any process you outsource. Before you commit to a customer, you confirm what they need, what the law requires and that you can deliver it, and you keep the result of that review (ISO 9001:2015 8.2.3). When requirements change, documents and people are updated.

Design and development (ISO 9001:2015 8.3). If you design, you run a planned process: stages, reviews, verification, validation, responsibilities and customer involvement; clear inputs; controls that check results; outputs that meet the inputs; and controlled changes, each with records. A note to ISO 9001:2015 8.3.4 lets you combine reviews, verification and validation where that suits the product.

External providers (ISO 9001:2015 8.4). The clause covers anything bought in that becomes part of what you deliver, goes straight to your customers, or runs one of your processes (8.4.1). You set criteria to evaluate, select, monitor and re-evaluate providers and keep the results. Controls match the provider’s effect on your customers (8.4.2), and providers are told exactly what you need from them (8.4.3).

Production and service provision (ISO 9001:2015 8.5). Work happens under controlled conditions: defined outputs, suitable monitoring, competent people, adequate equipment, and validation of any process whose result cannot be checked afterwards (8.5.1). You identify outputs and, where required, trace them (8.5.2). You look after customers’ and providers’ property, which a note says can include intellectual property and personal data (8.5.3). You preserve outputs through handling and delivery (8.5.4), meet post-delivery needs such as support and warranty (8.5.5), and review and authorise changes to production or service before relying on them (8.5.6).

Release (ISO 9001:2015 8.6). Products and services are released only when planned checks pass, unless a relevant authority, and the customer where needed, approves otherwise. You keep evidence of conformity and of who authorised release.

Nonconforming outputs (ISO 9001:2015 8.7). Outputs that miss requirements are identified and held back, corrected, contained, returned or accepted under a concession, and you tell the customer where that is right. You keep a record of the problem, the action, any concession and who decided (8.7.2).

Clause 8 changes little in the 2026 edition, by certification-body and consultancy accounts.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person company sells scheduling software to care homes. Every enterprise contract goes through a requirements review: features promised, data protection terms, service levels and implementation dates, signed off by product and delivery leads before signature.

Design follows a plan per release: a requirements specification, a design review at the end of discovery, verification by automated tests and a test lead’s sign-off, and validation with two pilot care homes before general release. Changes after the design review go through a change record.

The cloud host, the payment provider and two contract developers are on the supplier list, each rated for its effect on customers. The host’s certificates and incident reports are reviewed every year; the contract developers’ work goes through the same code review as staff work.

Releases carry a version number traced to the change list and the test results, and the head of engineering authorises each one. Customer data is treated as customer property: access is logged, and any loss is reported to the customer and recorded.

A defect found after release is logged as a nonconforming output. Support contains it with a workaround, the customer is told, and a decision to fix in the next release is recorded with the authoriser. Repeat defects go to corrective action under ISO 9001:2015 10.2.

Evidence an auditor expects

Requirements review results (required documented information, 8.2.3): signed reviews for sampled orders or contracts, including changes.
Design and development records (required, 8.3): plan, inputs, review, verification and validation results, outputs and changes for a sampled project.
External provider evaluations (required, 8.4.1): criteria, results, re-evaluations and follow-up actions.
Traceability records (required where traceability is a requirement, 8.5.2).
Change reviews in production or service (required, 8.5.6): who authorised the change and why.
Release evidence (required, 8.6): conformity with acceptance criteria and the person who authorised release.
Nonconforming output records (required, 8.7.2): description, action, concessions and the decision-maker.

Common mistakes

Design treated as a single sign-off

One review at the end of a project, with no plan, no stated inputs and no validation, does not meet 8.3. Plan the stages and record each review, verification and validation result.

Suppliers that run your processes left off the list

Firms control raw-material suppliers but forget the cloud host, the outsourced call centre or freelance specialists. Clause 8.4 covers outsourced processes too. Evaluate them by their effect on your customers.

Release with no named authoriser

Software goes live by whoever merges last. Clause 8.6 wants evidence of who authorised release. Name the role and record the approval.

Forgetting what belongs to customers

Customer drawings, tooling and data get no special care. ISO 9001:2015 8.5.3 covers them, and its note names personal data. Identify, protect and report any loss.

Concessions without authority

Production ships a slightly out-of-tolerance batch because a manager said so. Clause 8.7 expects a concession from the right authority and, where applicable, the customer. Record who decided.

How Sted helps

For ISO 9001 design and development (8.3) Sted’s knowledge base carries the Design and Development Procedure (PRC-DDP) with its Design and Development Plan (REC-DDPL), Requirements Specification Record (REC-RSPEC), Design and Development Record (REC-DDR), Design Review Record (REC-DRR), Verification and Validation Record (REC-VVR) and Design Transfer Record (REC-DTR), and the Change Record (REC-CR) for design changes.
Records are part of the Full Management System plan.
For ISO 9001 production, service provision and release Sted’s knowledge base carries the Production and Process Controls Procedure (PRC-PPC) with its Production and Process Control Framework Record (REC-PPCF) and Process Validation Record (REC-PVR), the Traceability and Identification Procedure (PRC-TRID) with its Identification and Traceability Register (REC-ITR), the Customer Complaint Record (REC-CCR) for customer communication, and the Software Release Record (REC-SR) for release.
Records are part of the Full Management System plan.
Under the Supplier Approval and Management Procedure (PRC-SAMP) Sted’s knowledge base holds three record templates, the Supplier Approval Record (REC-SAR), the Supplier Review Record (REC-SRR), which comes with a suggested annual frequency, and the Supplier Disqualification Record (REC-SDQ), each tagged to ISO 27001 supplier controls, ISO 9001 8.4, ISO 13485 7.4 and SOC 2 CC9.2.
Records are part of the Full Management System plan.
Sted’s knowledge base includes a Nonconforming Output Record (REC-NCO), under the Production and Process Controls Procedure (PRC-PPC), for one output that came out wrong, from how it was found and held back to the disposition decided and who authorised it, with a cross-reference to any CAPA raised.
Records are part of the Full Management System plan.

Sted holds the procedures and the records for each stage. It does not approve your suppliers, release your product or accept a concession; the people you authorise do.

Supplier due diligence guide: tiering, evaluating and re-reviewing external providers.
Improvement: where nonconforming outputs go when their cause needs action.
Nonconformity: the term behind clauses 8.7 and 10.2.
Records in Sted: how design, release and nonconforming output records are kept.
ISO 9001: why operation is the centre of an ISO 9001 audit.

Frequently asked questions

When can a company exclude design and development from ISO 9001?

Only when it genuinely does no design: it makes or delivers to designs its customers own, for example. The scope must give the reason (clause 4.3), and the decision must not weaken your ability to deliver conforming products and services. If you write your own software or develop your own services, clause 8.3 applies.

Is a cloud hosting provider an external provider under ISO 9001?

Yes, if what it provides becomes part of what you deliver or runs a process for you. Clause 8.4 then asks you to evaluate, select and monitor it with criteria proportionate to its effect on your customers, which for a critical host usually means reviewing its certificates, its incident history and its service levels each year.