The final edition turns prediction into controlled work. Here is what an organization with a functioning ISO 9001:2015 QMS should do during the first 90 days—and what still needs to wait.
On September 16, 2026, ISO 9001 moved to stage 60.60: published.
That small catalog change closes an important period of uncertainty. Until today, responsible organizations could study the approved direction, improve weaknesses already visible in their quality management systems, and prepare reversible transition machinery. They could not perform a final-text delta analysis because the final text did not yet exist.
Now it does.
The sixth edition of ISO 9001 can be obtained, controlled as an authoritative external source, compared with the system an organization actually operates, and translated into specific decisions. Draft-era assumptions can finally be confirmed, corrected, or retired. A transition plan can now be built on requirements instead of forecasts.
That does not make publication day a starting gun for rewriting the QMS.
ISO describes the 2026 edition as a targeted update within the same trusted framework. Its public materials emphasize clearer wording, stronger attention to leadership and quality culture, a clearer separation of risks and opportunities, an informative Annex A intended to reduce ambiguity, and closer alignment with other ISO management-system standards. The revision is real. It is also deliberately restrained. (ISO 9001:2026; ISO’s edition overview; ISO fact sheet)
The right response is controlled movement, not documentary panic.
Same framework. Sharper expectations.
One thing is final. Several others are not.
The requirement source is now final. The surrounding transition system is still catching up.
ISO’s catalog now identifies ISO 9001:2026 as the current edition and marks ISO 9001:2015 as withdrawn. That word can sound more dramatic than it is. Withdrawal is the publication status of the superseded standard; it is not a command that causes every certificate issued against the 2015 edition to disappear on September 16.
ISO directs organizations certified to ISO 9001:2015 to consult their certification bodies about transition arrangements. Until an organization completes the accredited transition and receives an updated certificate, its external claims should remain aligned with the certificate it actually holds. A company certified to ISO 9001:2015 on September 15 does not become certified to ISO 9001:2026 because someone changed the footer on September 16. (ISO 9001:2015 status and transition FAQ)
The distinction matters because several clocks are involved:
- ISO publishes the requirements.
- Global Accreditation Cooperation Incorporated establishes international transition requirements for the accredited certification system.
- Accreditation bodies translate those requirements into processes for certification bodies.
- Certification bodies establish their readiness, schedules, audit arrangements, and client instructions.
- Sector schemes, regulators, customers, and contracts may adopt the new edition on their own timelines.
- Each certified organization must implement the changes, operate them, generate evidence, audit them, and obtain a certification decision.
As of this publication-day review, Global ACI’s transition-document category did not yet contain a final ISO 9001:2026 transition-requirements document, and ANAB’s current-transition table did not list an ISO 9001:2026 end date. ANAB reported in April that the draft under consideration proposed transition of accreditations within twelve months and completion of certified-organization transitions within three years. That makes a three-year window a credible planning assumption. A proposal is still not a final rule. (ANAB Heads Up 553; Global ACI transition documents; ANAB current transitions)
A date does not become authoritative through repetition. Record the expected window as an assumption, watch for the issued requirement, and replace the assumption when authority arrives.
This remaining uncertainty does not prevent meaningful work. It simply determines which work belongs now and which decisions still need an external dependency.
The first 90 days: build control before speed
The purpose of the first 90 days is not to finish the transition. It is to establish an authoritative baseline, identify the real delta, implement proportionate changes, and begin producing trustworthy evidence.
| Period | Primary objective | Concrete outputs |
|---|---|---|
| Days 0–7 | Control the transition inputs | Source register, governance, assumptions log, certification-body questions, dependency inventory |
| Days 8–30 | Determine the actual delta | Final-text delta-and-evidence map, no-change rationales, prioritized action plan |
| Days 31–60 | Implement proportionate change | Controlled revisions, assigned actions, communications, competence records, early operating evidence |
| Days 61–90 | Test whether the changes work | Evidence sampling, internal-audit results, corrective actions, management decision, provisional audit window |
This is a management-system plan, not a document-conversion schedule.
Days 0–7: control the source and the decision system
The first task is almost boring, which is usually a good sign in quality management: obtain and control the right sources.
Acquire properly licensed copies of ISO 9001:2026 and ISO 9000:2026. If the redline edition is useful to the transition team, obtain it through an authorized source. Record the edition, acquisition source, license boundaries, owner, controlled location, and review status. The redline can accelerate comparison, but it cannot decide organizational impact. A changed sentence may require no operational change; a small clarification may expose a control that was never effective.
Retire draft-era material from decision authority without destroying the history. DIS and FDIS analyses, webinar notes, consultant briefings, and pre-publication checklists may still explain how the market reached this point. They should no longer control implementation when the final edition is available.
Create a transition governance record with, at minimum:
- an executive sponsor;
- a transition owner;
- accountable process owners;
- document and evidence control responsibility;
- internal-audit independence;
- decision rights for interpretations, expenditures, and release;
- a method for recording assumptions and external dependencies.
Then inventory everything outside the QMS that may influence timing: certificate expiration, surveillance and recertification dates, sector rules, customer-specific requirements, supplier qualifications, regulatory references, contract language, tender commitments, public claims, and integrated-management-system dependencies.
Finally, ask the certification body precise questions rather than requesting a generic transition brochure:
- When will it be accredited and ready to audit against ISO 9001:2026?
- Will transition normally occur during surveillance, recertification, or a special audit?
- How will additional audit time be determined?
- What operating evidence will it expect before the transition audit?
- How will existing certificate dates and expiration be handled?
- Are any sector, multisite, integrated-system, or customer-specific rules likely to alter the plan?
- When will formal client instructions be issued, and how will revisions be communicated?
Record the answers as controlled external direction. “The auditor said” is not a durable transition control unless the statement can be traced, interpreted, and updated.
Days 8–30: build the final-text delta-and-evidence map
The central deliverable of the first month is not a revised quality manual. It is a defensible map between the final requirements and the operating system.
For each relevant requirement, connect:
Requirement → management-system response → operating practice → record → evidence of effectiveness
That chain is more useful than a clause-to-document crosswalk. Documents describe intended control. Records show activity. Evidence shows whether the activity produced the intended result.
Each reviewed area should receive one of four findings:
- No material delta. The current system already meets the final requirement and the evidence supports that conclusion.
- Control exists; evidence is weak. The practice may be sound, but records, sampling, measurement, or traceability are inadequate.
- A real change is required. A process, responsibility, decision rule, resource, communication, or control must be improved.
- An external decision is pending. The answer depends on issued transition rules, certification-body direction, sector guidance, a customer, or another controlled source.
The fourth category is important. Mature systems do not conceal uncertainty; they govern it.
The official public summaries identify several areas that deserve deliberate attention during this review.
Leadership, quality culture, values, and ethical behavior
Do not begin by drafting a culture policy. Begin by examining how leaders make decisions when quality competes with schedule, revenue, output, or convenience.
Look for evidence in objectives, incentives, resource decisions, escalation practices, management review, responses to bad news, protection of speaking-up behavior, customer communications, record integrity, and corrective action. If the organization rewards bypassing controls and then publishes an ethics statement, the statement is not the management system.
Risks and opportunities
The clearer separation of risks and opportunities should produce clearer judgment, not necessarily two new registers.
Ask whether the organization identifies beneficial possibilities with the same seriousness it applies to threats. Determine how actions enter processes, who owns them, what resources they receive, and how effectiveness is evaluated. A single condition can create both risk and opportunity; forcing both into one score may obscure rather than clarify the decision.
Management of change
Review completed changes, not just the change procedure. Sample system implementations, supplier substitutions, reorganizations, new services, facility moves, automation, outsourcing, and changes to inspection or acceptance methods.
Was the change merely approved, or were consequences considered, resources supplied, affected people informed, implementation monitored, and results reviewed? The evidence after approval often reveals more than the approval form.
Climate relevance
Climate relevance did not first appear today. Amendment 1:2024 already introduced climate-action changes to ISO 9001:2015. The superseding 2026 edition is now the controlling source, so confirm the final placement and wording there rather than treating climate as a brand-new publication-day topic. (ISO 9001:2015/Amd 1:2024 lifecycle)
Organizations that deferred the relevance determination while waiting for the revision are not waiting on a new obligation. They are carrying an existing gap.
Annex A
Use Annex A to understand terminology and intent. Do not quietly promote it into a second set of auditable requirements. Guidance can shape interpretation; a nonconformity still needs a defensible connection to a normative requirement.
By day 30, the organization should have a prioritized action plan based on operational risk, customer impact, evidence lead time, and transition dependency—not on clause order.
Days 31–60: change the system, then let the documents catch up
Once the delta is understood, implementation can begin. The sequence matters.
Design the operating change first. Confirm ownership, resources, affected interfaces, communication, measures, records, and effectiveness criteria. Then revise documented information where revision is necessary to make the change reliable.
This order prevents a familiar failure: releasing a new procedure that describes a process nobody has actually designed, resourced, or agreed to operate.
Changes during this period may include:
- revising leadership routines, escalation channels, or incentives that undermine quality behavior;
- improving how risks and opportunities are determined, acted upon, and reviewed;
- scaling change controls according to consequence rather than treating every change alike;
- clarifying responsibilities and decision rights;
- improving communications and awareness around organization-specific expectations;
- updating objectives, measures, reviews, or records where they do not support the intended result;
- integrating the climate-relevance determination into context and planning where applicable;
- revising references, forms, workflows, or workspace structures only where the final delta makes that useful.
Training should focus on the organization’s actual changes. A generic “ISO 9001:2026 awareness” slide deck may establish basic familiarity, but it does not demonstrate that a process owner understands a changed decision, record, escalation path, or measure.
Begin collecting evidence immediately. Culture, change effectiveness, opportunity realization, and leadership behavior cannot be proven by documents released the night before an audit. They become visible through repeated decisions and operating records.
Days 61–90: verify operation and make a management decision
The third month is where the transition begins to prove whether it is part of the QMS or merely a project beside it.
Sample the changed practices. Look for completed records, decisions, exceptions, measurements, escalations, and results. Test whether people can use the controls under ordinary pressure. Where evidence is missing, determine whether the problem is recordkeeping or whether the practice never became operational.
Internal audit should examine the effectiveness of the changed system, not simply confirm that revised documents contain expected words. Audit trails should follow real work across functions and records. Findings should enter the organization’s normal corrective-action process.
Management review should then consider:
- the confirmed delta and remaining uncertainties;
- action status and resource constraints;
- early evidence of implementation and effectiveness;
- internal-audit results and corrective action;
- certification-body and accreditation direction;
- sector, contract, customer, and certificate-cycle dependencies;
- risks of moving too early and risks of moving too late;
- the proposed transition-audit window.
The output should be a recorded management decision: proceed toward a defined window, continue operating and gathering evidence, revise the plan, or hold a date-dependent decision until external authority arrives.
That is a much stronger readiness decision than “all documents updated.”
The minimum transition record set
A proportionate transition does not need a bureaucracy. It does need a coherent chain of decisions and proof. At minimum, retain:
- an authoritative-source register;
- a final-text delta-and-evidence map;
- an assumptions, interpretations, and dependency log;
- transition governance and assigned ownership;
- a prioritized implementation plan;
- controlled change and document-revision records;
- competence, awareness, and communication evidence;
- samples showing the changed system in operation;
- internal-audit findings and corrective actions;
- management review and transition authorization;
- certification-body direction and scheduling records;
- a certificate, contract, portal, and public-claim update checklist.
These records should live where the work can be governed and retrieved. A transition folder full of disconnected files is not traceability.
Seven things not to do on publication day
Do not run a global search-and-replace from “2015” to “2026.” Some references will remain contractually or historically correct, and a reference change is not evidence of conformity.
Do not rebuild a functioning QMS from a new template set. The current system is the baseline; the final delta determines what moves.
Do not present September 2029 as an issued universal deadline until the responsible accreditation authority publishes the applicable transition requirements.
Do not treat Annex A as though it creates additional normative requirements.
Do not declare the organization certified to ISO 9001:2026 before its certification body makes that decision and issues the corresponding certificate.
Do not confuse a culture statement, ethics training, or a new risk register with changed organizational behavior.
Do not choose an audit date before considering certificate-cycle timing, evidence maturity, certification-body readiness, sector rules, major business changes, and customer obligations.
The fastest visible transition is not necessarily the shortest real transition.
The first 90 days are a foundation, not a finish line
ISO 9001:2026 is now real enough to support concrete planning. That is different from being ready for a certification decision.
An organization may complete its analysis quickly and still need time for changed practices to operate. Leadership behavior has to be observed. Change results have to be reviewed. Opportunities have to be acted upon. Records have to accumulate. Internal audit has to test the system. Management has to judge readiness using evidence.
Publication ends the forecasting phase. It does not remove the obligation to implement, operate, evaluate, and improve.
Good transition behavior should itself demonstrate quality: authoritative inputs, controlled decisions, proportionate action, assigned ownership, operating evidence, independent verification, and management authorization.
That is why the most useful question on September 16 is not, “How quickly can we change the certificate?”
It is this:
What must be true in the way our organization operates before changing the certificate would be honest?
Start there.
Continue the work
Read the Foundry’s living dossier, ISO 9001:2026: Prepare Early. Transition Deliberately., for the broader revision narrative, myth desk, and source trail.
For organizations with a functioning ISO 9001:2015 QMS, the ISO 9001:2026 Transition Readiness Kit provides a controlled structure for authoritative inputs, delta analysis, ownership, implementation, evidence, internal verification, management authorization, and certification handoff. It does not include the copyrighted standard, replace organizational judgment, or guarantee certification.
Independent analysis by 9th Story Foundry. ISO standards are copyrighted; obtain the official editions from ISO or an authorized national standards body or reseller. Publication and transition-rule status last checked September 16, 2026.
