On Sept. 16, 2026, ISO published the sixth edition of ISO 9001. Within days, the summaries arrived: what changed in Clause 5, what the new Annex A says, how the 2024 climate amendment carries forward. They’re useful, but they answer the questions certified organizations ask least often. The question we hear most across the audit table is simpler: What do we actually have to do, and when?

The honest answer is that most certified organizations don’t need to rebuild anything. The top-level clause structure is unchanged, and this revision is an evolution rather than a rewrite. They need to have a plan, and get started sooner than the deadline suggests. In early conversations, I’ve found that organizations are less concerned about the individual changes than about when those changes must start showing up as evidence in their management system.

The dates that matter, and why three years is shorter than it looks

The transition rules for accredited certification are set by Global ACI, the international cooperation of accreditation bodies. The milestones are:
• September 16, 2026: ISO 9001:2026 published.
• March 31, 2027: accreditation bodies ready to assess certification bodies against the new edition.
• June 30, 2027: certification bodies submit their transition declarations.
• September 30, 2027: accreditation bodies complete their transition decisions.
• March 31, 2028: new and initial accredited certifications can only be issued to ISO 9001:2026.
• September 30, 2029: all ISO 9001:2015 certificates must have transitioned.

Figure 1: The ISO 9001:2026 transition timeline. Source: Global ACI transition requirements for ISO 9001:2026

Read those dates from the certified organization’s side. Your certification body can't issue an accredited 2026 certificate until its own accreditation body has assessed it, and for many that won’t happen until sometime in 2027. The real window for transition audits is closer to two years than three. On a normal three-year certification cycle, that leaves most organizations one or two scheduled audits in which to make the move. Leave it late, and you’ll be competing for audit dates with everyone else who did the same.

Choosing your transition route

The transition can happen at a scheduled surveillance audit, at recertification, or in a separate transition audit. Which one fits depends mostly on where you sit in your cycle.

• Recertification between late 2027 and mid-2029. This is often the natural point. The transition is assessed alongside the full recertification, and you avoid an extra visit.
• Recertification close to, or after, September 2029. Don’t wait for it. A recertification in the summer of 2029 leaves little room to address any nonconformities before the deadline. Transition at a surveillance audit instead.
• Timing that doesn’t line up, or a major change underway. A separate transition audit costs an extra visit but lets you choose the date, which can be worth it if you’re also restructuring, merging sites, or changing scope.

Integrated systems

If you run ISO 9001 alongside ISO 14001, you have a second transition to plan. ISO 14001:2026 was published in April 2026, and its accreditation transition arrangements are still being finalized. The two revisions overlap in useful ways, including climate considerations and a stronger focus on managing change, so it’s worth asking your certification body whether both transitions can be assessed at the same visit. One gap assessment, one set of updates, and one audit is cheaper and less disruptive than doing the work twice, a year apart.

Figure2: Which transition route fits your certification cycle?

One detail to settle early is audit time. The transition requirements don’t fix an amount of additional audit time; your certification body determines it. Ask for it in writing, and get it into the quote now, so it isn’t a budget surprise in 2028. And build in a buffer: Anything the transition audit raises has to be addressed before the certification decision.

What auditors will look for as evidence, not paperwork

The most common transition mistake is treating new requirements as new documents. Auditors will be looking for evidence that the system works the way the standard now describes. Four areas stand out, starting with the one we’re asked about most.

Leadership, quality culture, and ethical behavior (5.1.1 and 7.3).

This is the change people find hardest to picture at audit. The 2026 edition requires top management to promote quality culture and ethical behavior, and requires people doing work under the organization’s control to be aware of both. Neither can be proven with a document. A values statement, a poster, or a training attendance sheet shows that the words exist, not that anyone acts on them.

So how does ethical behavior actually get audited? Through what people do when quality conflicts with something else: schedule, cost, or a customer’s deadline. Expect the auditor to work from three directions.

Top management decisions. The auditor will ask for a recent, dated example where leadership chose quality over convenience, such as holding a shipment, refusing a supplier shortcut, or changing a target that was driving the wrong behavior, and what triggered it. Management review minutes that record these decisions and their follow-up are strong evidence.

Interviews on the floor. Operators, inspectors, and engineers will be asked, in their own words, what they would do if they saw a problem that would delay an order, and whether they have ever done it. Consistent answers across shifts and departments, backed by a real example, say more than any policy.

The escalation trail. Nonconformity reports, stop-work records, concerns raised, and how they were handled. An organization that reports no concerns at all will prompt more questions, not fewer.

What won’t satisfy the requirement is a new ethics policy written the month before the audit. What will is a short, honest record of decisions and behaviors that already happen, with management review showing that leadership is paying attention to them.

In one audit, I found that the organization’s internal audit had missed a process that should have been included in the audit program. What stood out was the response from senior leadership. Rather than treating the nonconformity as something to close for the audit, they wanted to understand why the process had been missed, correct the internal audit approach, and make sure the management system was properly aligned with the standard going forward. For me, that response was stronger evidence of quality culture than any policy or training record.

Figure 3: Ethical behavior and quality culture: Evidence that counts at audit risks and opportunities (6.1).

The revision draws a clearer line between the two. Good evidence is opportunities treated as items in their own right, linked to quality objectives and customer outcomes, with owners and actions. Weak evidence is a risk register with an “opportunities” column full of “N/A.”

Climate change (4.1 and 4.2).

The consideration introduced by the 2024 amendment carries forward. Organizations certified since then should already have a recorded determination of whether climate change is relevant to their QMS. Auditors will check that the determination is real, and where climate is relevant, that it shows up in risks, objectives, or interested-party requirements.

The new Annex A

Annex A clarifies key terms and the intent of requirements. Use it to calibrate what you already do, not as a list of new things to write.

A month-by-month plan for the first year

Months 1–3: Get the standard and run a clause-by-clause gap assessment against the 2026 text. Train your internal auditors, and brief top management, who are the people an auditor will interview about Clause 5. Ask your certification body for its own transition timeline.

Months 4–6: Make targeted updates where the gaps are real, typically the risk-and-opportunity process, leadership responsibilities, and the climate determination. Resist the urge to rewrite the manual.

Months 7–9: Run an internal audit against the 2026 requirements and hold a management review that explicitly covers the transition, with actions and owners.

Months 10–12: Close the internal audit findings and agree the route, date, and audit time with your certification body.

Figure 4: A four-phase plan for year one

An organization that follows this plan will walk into its transition audit with a year of evidence that the updated system is working, which is exactly what the auditor is there to see.

Four mistakes we already expect to see

1. Rewriting the whole QMS. The structure hasn’t changed. A rewrite burns months and introduces new risk into a system that already works.

2. Treating culture as a document. A policy statement is not evidence of culture. Behavior, decisions, and how problems are escalated are.

3. Leaving it to a 2029 recertification. This compresses the timeline into the busiest audit period and leaves no margin for findings.

4. Not confirming your certification body is accredited for the 2026 edition. Ask for its accreditation status and check the accreditation body’s directory. A certificate is only as credible as the body that issues it.

The transition to ISO 9001:2026 should be unremarkable. Organizations that treat year one as a planned project, not a paperwork exercise, will get exactly that.