If you’ve made it this far, you’re probably in one of two situations: your company is getting ready for its first ISO 9001 certification, or it’s already certified and needs to maintain, or renew, the certificate without any surprises at the next audit.
Either way, 2026 is a pivotal year: the standard has gone through its biggest update in a decade. This guide brings together what you need to know right now, from the basic definition to the revised version, covering cost, timeline, requirements, audit preparation and how to sustain compliance day to day, without relying on a last-minute scramble.
What is ISO 9001?
ISO 9001 is the most widely adopted international standard for quality management in the world, published by the International Organization for Standardization (ISO). It sets out the requirements for a Quality Management System (QMS): a set of processes, policies and records that ensure an organization delivers products or services consistently, within defined criteria, with continual improvement.
The standard is generic: it applies to companies of any size or industry, from manufacturing to the public sector. It is structured in ten clauses (the Annex SL framework, shared by all ISO management system standards), built around the PDCA cycle (Plan, Do, Check, Act) and risk-based thinking. It is not a product certification but a process certification: it attests that the company has a management system capable of ensuring quality, not that a specific item “is high quality.”
The companies that typically pursue certification are suppliers in the automotive, food, pharmaceutical and construction industries that need to prove contractual compliance; IT and B2B service companies facing customer or public tender requirements; and organizations that want to formalize internal processes before scaling their operations.
ISO 9001:2026: what changed in the standard and what it means for your certification
This is the single most important point for anyone planning a certification or recertification right now: ISO officially published ISO 9001:2026 on September 16, 2026, closing a revision cycle that began with the Draft International Standard (DIS) in August 2025 and moved through approval of the Final Draft International Standard (FDIS) in August 2026, with overwhelming international support.
The good news: this is an evolutionary revision, not a break with the past. The ten-clause structure and Annex SL stay the same, and most of your current QMS remains valid.
| Aspect | ISO 9001:2015 | ISO 9001:2026 |
|---|---|---|
| Structure | 10 clauses, Annex SL | Unchanged |
| Leadership (5.1) | Leadership commitment | Adds quality culture and ethical behavior, with evidence that they are demonstrated |
| Context (4.1) | Periodic review | Continual monitoring and updating |
| Documented information | “Maintain” documented information | “Make available” as documented information |
| Emerging technologies | Not mentioned | Cited in Annex A (A.7.1.3/A.7.1.4) as a risk/opportunity factor; not a specific AI requirement |
| Environmental context (4.1 and 4.2) | No explicit mention of climate change (added through Amendment 1:2024, already in effect for the 2015 version) | Formally built into the text: the organization must determine whether climate change is a relevant issue for the QMS and for interested parties |
| Change management | Addressed in scattered places, with no clause of its own | New clause 6.3, dedicated to planning and managing changes |
| Transition | — | 3 years, through September 2029 |
If your company is already certified to the 2015 version, your certificate remains valid as usual, but your certification body will move your next surveillance or recertification audit to the new requirements within the transition window. The first certifications to the 2026 version are expected from mid-2027 onward. It’s worth mapping the points in the table above against your current QMS now, so you don’t leave everything for the end of the deadline.
What are the benefits of ISO 9001 for a company?
Beyond the certificate itself, certification solves concrete management problems:
- Opens commercial doors: many contracts, public tenders and international supply chains require ISO 9001 as a prerequisite for qualifying.
- Reduces rework and waste by standardizing processes and eliminating uncontrolled variation in operations.
- Builds customer and partner trust with auditable evidence of quality control, not just a sales promise.
- Institutionalizes continual improvement, instead of relying on one-off efforts tied to a specific person.
- Serves as the foundation for integrated systems: companies that already have ISO 9001 can implement ISO 14001 (environmental) or ISO 45001 (occupational health and safety) with far less effort, since all three share the Annex SL structure.
How much does ISO 9001 certification cost and how long does it take?
There is no fixed market price. The investment depends on a combination of factors:
| Factor | Impact on cost/timeline |
|---|---|
| Company size | More employees and sites = more audit days |
| Maturity of the current QMS | Companies with processes already documented get certified faster |
| Certification body chosen | Fees vary among accredited bodies |
| External consulting | Optional, but speeds up the gap assessment and documentation prep |
| Scope | Multi-site or multi-standard (integration with 14001/45001) extends the timeline |
As a general benchmark, companies starting from scratch usually take 6 to 12 months from the decision to the certification audit, including the gap assessment, implementation, internal audit and the two stages of the external audit (Stage 1 and Stage 2). Companies that already have part of their documentation in order, or use a quality management system to centralize evidence, tend to shorten that timeline significantly.
What are the requirements and mandatory documents of ISO 9001?
The standard doesn’t require a lengthy “quality manual” as older versions did, but it does require specific documented information. The items auditors check most often in practice:
- QMS scope and quality policy
- Quality objectives and the plan to achieve them
- Supplier evaluation criteria and results
- Records of team competence and training
- Evidence of calibration and verification of measuring instruments
- Internal audit results
- Records of nonconformities and corrective actions
- Management review minutes
The most common mistake isn’t a missing document; it’s a document that exists but doesn’t reflect how the company actually works. Auditors quickly spot when a QMS lives “on paper” rather than “in practice,” and ISO 9001:2026 reinforces exactly this point by replacing “maintain” with “make available” for documented information: the focus shifts to real access and use, not just filing.
How to prepare for the ISO 9001 certification audit
A structured path reduces nonconformities on audit day:
- Maturity assessment against the requirements of the standard.
- Definition of the scope, quality policy and quality objectives.
- Mapping of processes and risks/opportunities by area.
- Implementation of controls and the required documented information.
- Team training on the processes and on the standard itself.
- Internal audit, with correction of the nonconformities found.
- Management review of indicators and risks.
- Two-stage external audit: Stage 1 (document review) and Stage 2 (verification of implementation in practice).
The earlier evidence is generated as a routine, rather than pulled together in a rush before the auditor’s visit, the lower the risk of nonconformity, and the less strain on the team along the way.
What the auditor assesses in the ISO 9001 certification audit
Before organizing your preparation, it helps to know exactly what’s being checked. The auditor doesn’t assess “whether the company is good”; they assess whether there is objective evidence that each requirement of the standard is met in practice, not just on paper.
| Area of the standard | What the auditor assesses | Typical evidence expected | How Qualiex helps |
|---|---|---|---|
| Leadership and commitment (5.1) | Whether leadership actively takes part in the quality policy and objectives, rather than just signing documents | Management review minutes, internal communication of the policy, interviews with top management | Management review minutes recorded and linked to QMS indicators, with a complete history of decisions: evidence of real participation, not just a signature |
| Context and interested parties (4.1/4.2) | Whether the company has mapped internal/external risks and the requirements of customers, suppliers and regulators | Context matrix, up-to-date register of interested parties | Risks and opportunities module with a centralized context matrix, updatable at any time without depending on a Word file lost in a shared folder |
| Competence and training (7.2) | Whether employees in critical roles have recorded qualifications and up-to-date training | Competence matrix, certificates, training records | Automatic competence matrix, with alerts before each training or certification expires, so you don’t discover the problem only at the audit |
| Operational control (8.1/8.5) | Whether processes are carried out as planned, with defined acceptance criteria | Operating procedures, production or service records | Versioned procedures linked directly to execution records, all in one place, with no gap between “what’s written” and “what’s done” |
| Supplier evaluation (8.4) | Whether there are defined criteria and an evaluation history for critical suppliers | Supplier register, periodic evaluation results | Supplier register with evaluation history and automatic alerts for periodic re-evaluation |
| Monitoring and measurement (9.1) | Whether QMS performance indicators are tracked and used for decision-making | Indicator dashboard, management review minutes | Real-time indicator dashboard, already connected to management review minutes: decisions based on current data, not last month’s spreadsheet |
| Internal audit (9.2) | Whether the company audits itself before the external auditor arrives | Internal audit program, reports, action plan | Internal audit program with checklists, with report and action plan tracked in the same workflow and the deadline of each nonconformity monitored |
| Nonconformity and corrective action (10.2) | Whether identified problems lead to root cause investigation and effective action, not just a one-off fix | NC records, root cause analysis, effectiveness verification | Complete NC workflow: opening, root cause investigation, action plan and effectiveness verification, all recorded and traceable, with nothing lost between an email and a spreadsheet |
ISO 9001 certification audit preparation checklist
We’ve broken the 8 preparation steps into individual blocks. Copy each one into your team’s task management tool and use it as a tracking checklist up to the audit date.
Step 1. Maturity assessment
Before implementing anything, you need to know exactly where the company stands against the standard. Without that, effort gets scattered across points that are already resolved.
- Review the 10 clauses of ISO 9001 one by one
- Identify what already exists, what partially exists and what doesn’t exist
- Document the gap found in each clause
- Prioritize gaps by criticality and the time left until the audit
Step 2. Definition of the scope, quality policy and quality objectives
These three elements form the stated foundation of the QMS: they define how far the certification reaches and what the company commits to deliver in terms of quality.
- Define the QMS scope in writing (products, services, sites covered)
- Draft the quality policy and validate it with leadership
- Set measurable quality objectives, each with a deadline and an owner
- Communicate the scope and policy to the whole team
Step 3. Mapping of processes and risks/opportunities
With the scope defined, the next step is to understand how work actually gets done, and what could go wrong (or better than expected) at each stage.
- Map the key QMS processes (at minimum, one flowchart per process)
- Identify risks and opportunities for each process
- Define actions to mitigate critical risks
- Review the context of the organization (interested parties, internal/external issues)
Step 4. Implementation of controls and documented information
This is where the QMS comes off the page: mapped processes become procedures, and the requirements of the standard become real records, used day to day.
- Write or update the procedures required by the standard
- Implement the mandatory records (scope, policy, supplier evaluation, competence, calibration, NC/corrective action, management review)
- Make sure every document has an owner, a version and a review date
- Make the documentation available to the people who need it day to day, rather than leaving it filed away
Step 5. Team training
A documented process is useless if the people carrying it out don’t know it exists, or don’t understand why it exists.
- Train the team on the QMS processes relevant to each person’s role
- Train the team on the basic concepts of ISO 9001
- Record attendance, content and an effectiveness evaluation for each training
- Update the competence matrix with each employee’s status
Step 6. Internal audit
Before welcoming the external auditor, the company audits itself. It’s the last chance to find and fix problems before they become a formal nonconformity.
- Draw up the internal audit program, covering all clauses
- Conduct the audit with a qualified internal (or outsourced) auditor
- Record every finding, even the smallest ones
- Open an action plan for each nonconformity found
Step 7. Management review
The standard requires leadership to formally review QMS performance, not as a bureaucratic formality but as a real decision about what changes from that point on.
- Gather QMS performance indicators before the meeting
- Review internal audit results and open nonconformities
- Assess whether the quality objectives are being met
- Record decisions and actions in formal minutes
Step 8. External audit (Stage 1 and Stage 2)
The final step: the certification body checks, first on paper and then in practice, whether everything that was implemented actually works as stated.
- Confirm the date, scope and audit team with the certification body
- Gather and organize all documentary evidence for Stage 1
- Prepare the team for interviews and on-site verification in Stage 2
- Assign one person to accompany the auditor throughout the visit
How to maintain ISO 9001 certification (surveillance audits and recertification)
ISO 9001 certification is valid for three years, but it doesn’t sit idle during that time: the certification body conducts surveillance audits, usually once a year, to confirm the QMS is still active. At the end of the cycle, recertification repeats the initial certification process in a shorter form.
Nonconformities left unaddressed in surveillance audits can lead to suspension or even withdrawal of the certificate. The biggest risk at this stage is rarely technical; it’s operational: losing track of when each corrective action is due, when a training needs renewing or when a piece of equipment needs recalibration, especially when those controls are scattered across spreadsheets, emails and shared folders.
Common mistakes in ISO 9001 certification
The same mistakes show up, with few variations, in certification, surveillance and recertification audits:
| Most common mistakes | Root cause | How Qualiex solves it |
|---|---|---|
| Documenting a process that isn’t followed in practice: the classic “paper QMS,” quickly spotted by any experienced auditor. | Written procedure with no link to actual execution | Versioned procedures linked directly to execution records, so any gap between “written” and “done” is visible, not hidden |
| Treating a nonconformity as “resolved” without investigating the root cause, leaving the problem free to recur. | One-off correction instead of root cause analysis | NC workflow with a mandatory root cause step and effectiveness verification; it can’t be closed until these are completed |
| Letting trainings and calibrations expire without centralized deadline control. | Deadlines scattered across spreadsheets and emails, with no alerts | Competence and calibration matrix with automatic alerts before expiration |
| Running the internal audit just to tick a box, without generating a real action plan from the findings. | Findings recorded but not turned into action | Each internal audit finding becomes a trackable item with a deadline and an owner, within the same workflow |
| Defining a QMS scope larger than the company can sustain with consistent evidence. | Scope defined without considering the real capacity to maintain it | Indicator dashboard shows evidence gaps by process, helping calibrate the scope before the audit |
| Ignoring changes in context (a new customer, a new legal requirement, climate change) without updating the clause 4.1 analysis. | Clause 4.1 analysis not revisited over time | Risks and opportunities module with a centralized context matrix, easy to review whenever something changes |
| Leaving documentation review until just before the surveillance or recertification audit, instead of treating it as routine. | Documentation treated as an event, not a routine | Documents with owner, version and review date visible at all times, so there’s no last-minute rush before the audit |
How quality management software helps maintain ISO 9001 compliance
Sustaining ISO 9001 compliance between one audit and the next is exactly where most quality teams lose time and take on risk. Scattered spreadsheets, outdated documents and corrective actions without a clear owner are the most common causes of nonconformity in surveillance and recertification audits.
Qualiex, Quality Management Software, centralizes document control, nonconformities, risks, corrective actions, action plans, decision minutes, internal audits, indicators, supplier management, training and instrument calibration in a single system, with an evidence trail ready whenever the auditor asks.
For companies facing the transition to ISO 9001:2026, it also makes it easier to map, in one place, which of your current QMS controls already meet the new version and which need adjusting.
If your company is assessing the maturity of its QMS for the next audit, whether certification or surveillance, Qualiex is the definitive solution for you.
Frequently asked questions about ISO 9001
Is ISO 9001 certification required by law?
No. ISO 9001 is a voluntary certification, and no law requires the certification itself. The “requirement” usually comes from a contract: a customer, a public tender or an international supply chain that asks for the certificate as a commercial prerequisite.
Can any body certify my company to ISO 9001?
No. Check that the certification body is accredited by a recognized accreditation body that is a member of the IAF (International Accreditation Forum), such as Cgcre/Inmetro in Brazil. Certificates issued by non-accredited bodies may not be accepted by customers or in second-party audits.
Will my company lose its ISO 9001:2015 certificate now that ISO 9001:2026 has been published?
Not right away. There is a three-year transition period, through September 2029. Your 2015 certificate remains valid as usual until your next surveillance or recertification audit, when the certification body starts assessing your company against the new requirements.
Do I need to hire a consultant to get ISO 9001 certified?
It isn’t mandatory. A consultant can speed up the gap assessment and document preparation, especially for companies with no prior experience with management standards. Companies with a more mature QMS, or supported by a quality management system that already centralizes evidence, often run the process in-house at a lower cost.
How long does the certification audit take?
It depends on the company’s size and complexity, but it always follows two stages: Stage 1 (document review, usually shorter) and Stage 2 (verification of implementation in practice, which can take from one to several days per audited site).
What happens if my company fails the certification audit?
There is no such thing as a permanent “fail.” Nonconformities found come with a deadline for correction and an action plan, and the certificate is issued once there is evidence they have been addressed. Only major nonconformities that remain uncorrected usually require a new visit from the certification body.
