ISO 9001:2026 Is Here: What Changes and What UK Businesses Should Do Now

On 16 September 2026, ISO published the sixth edition of ISO 9001, the world’s most widely used quality management standard. It is the first full revision since 2015, and if your business holds an ISO 9001 certificate, is working towards one, or is asked for one in tenders, it raises some practical questions. Do you need to do anything now? Will your current certificate still be accepted? Should you certify to the old version or wait for the new one?

This guide explains what ISO 9001:2026 is, what stays the same, what changes, what is still to be confirmed, and what a sensible UK business should do next. We have kept the detail practical, and we have been clear about where the picture is still settling, because certification bodies and the UK accreditation system are still publishing their transition arrangements.

ISO 9001:2026 in Brief

ISO 9001 sets out the requirements for a quality management system (QMS). It does not tell you how to run your business or what your product should look like. It asks you to show that you understand your customers’ requirements, plan and control the work that meets them, check the results, and keep improving. Organisations of any size and sector can use it, and it is one of the most common certificates requested in UK tenders, from security and cleaning contracts to construction and facilities management.

The previous edition, ISO 9001:2015, introduced the structure most certified businesses work to today: the same high-level layout used by ISO 14001, ISO 45001 and ISO 27001, with clauses on context, leadership, planning, support, operation, performance evaluation and improvement. The 2026 edition is an evolution of that structure, not a rewrite. If you understand your current QMS, you will recognise the new one.

What Stays the Same

Before looking at the changes, it helps to be clear about what has not changed, because this is where most of the reassurance lies.

• The process approach. You still manage the business as a set of connected processes with defined inputs, outputs, owners and controls.
• Plan, Do, Check, Act. The improvement cycle remains at the centre of the standard.
• Risk-based thinking. Considering what could go wrong, and what could go right, when planning remains a core idea.
• The certification model. Certification is still carried out by an independent certification body through a Stage 1 and Stage 2 audit, followed by surveillance audits and a recertification audit on a three-year cycle. The certificate then runs on a three-year cycle with annual surveillance visits.
• It is still voluntary. There is no legal requirement in the UK to hold ISO 9001. It is a commercial requirement, driven by customers and tender evaluators. If you are still deciding, read do I need ISO 9001?

What Changes in ISO 9001:2026

Publicly available summaries from major certification bodies point to a small number of themes. As with any new standard, the exact wording of each clause matters, so treat this as an overview and read the published text, or ask your certification body or consultant, before you rewrite procedures.

1. Quality culture and ethical behaviour

The new edition builds quality culture and ethical behaviour more explicitly into the requirements, particularly for top management and the environment in which processes operate. In practice this means leaders are expected to do more than sign the quality policy. Auditors are likely to look for evidence that senior people set expectations, that staff feel able to raise problems, and that the way the organisation behaves matches what its documents say.

For a service business such as a security, cleaning or maintenance company, this is a natural fit. Quality in these sectors depends on what supervisors and frontline staff do every day, not on a manual on a shelf.

2. Risks and opportunities are separated

ISO 9001:2015 dealt with “risks and opportunities” together. The 2026 edition treats them as separate requirements. Many small businesses handle this with a single risk register, and a common weakness is that opportunities are barely mentioned. Expect to need a clearer record of both: what could stop you meeting customer requirements, and what you could do to improve results, win work or reduce cost.

3. Stronger control of change

Requirements for planning, communicating, monitoring and reviewing changes to the QMS are strengthened. If your business is growing, taking on new contracts, opening new sites, changing suppliers or introducing new systems, auditors will want to see that you think through the effect on quality before the change, not after something has gone wrong. A simple change log that records what changed, why, who was affected and how you checked the result is often enough for a small firm.

4. Definitions brought into the standard

Core terms and definitions are now set out directly in the standard’s terms clause instead of relying on a separate vocabulary document. This is mostly a usability improvement, but it can affect how consistently auditors interpret terms such as “risk” or “documented information”.

5. A more useful Annex A

The informative annex has been expanded to explain the intent of the requirements more clearly. An informative annex does not add obligations, but it is useful for anyone writing procedures, because it shows what the standard is trying to achieve and reduces over-documentation.

Transition: What Is Confirmed and What Is Not

The publication date of 16 September 2026 is confirmed. What happens next depends on the transition rules set by the accreditation community. A three-year transition period has been widely anticipated, which would put the end of the transition at around 2029, but at the time of writing that end date has been described by certification bodies as expected rather than final.

In previous revisions, certificates issued to the old edition stayed valid until the end of the transition period and were then replaced through a normal surveillance or recertification audit. That is the most likely pattern again, but you should confirm the details with your own certification body, because each one publishes its own transition plan under the rules of the accreditation body that oversees it. In the UK, look for a certification body accredited by UKAS. Certificates from non-accredited bodies may not be accepted by buyers at all.

Certify Now, or Wait for 2026?

This is the question we hear most often, and the honest answer depends on your situation.

You need a certificate for a live tender

Do not wait. If a bid needs ISO 9001 in the next few months, certifying now is usually the practical choice. Build the system in a way that already reflects the new themes, so that moving to the 2026 edition later is a small update, not a second project. Our tendering support team can help you show buyers the certificate and the evidence behind it.

You are certifying for the first time with no immediate deadline

Ask your certification body which edition they are auditing new clients against and from when. Building the system to the new edition from the start avoids rework. The 2026 changes are modest, so a well-built system will not look very different either way.

You already hold an ISO 9001:2015 certificate

You do not need to panic. Your certificate remains valid while the transition rules are confirmed. Use the time to run a gap analysis against the new edition, then update your system before your next surveillance or recertification audit that falls inside the transition window.

Practical Steps for Existing Certificate Holders

1. Get the standard and your certification body’s transition plan. Do not rely on summaries alone, including this one.
2. Run a gap analysis. Compare your current QMS with the new requirements clause by clause and list what is missing or thin.
3. Split your risk register. Keep risks and opportunities in separate sections, each with an owner, action and review date.
4. Add a simple change-management process. Record planned changes to the QMS, the people affected, and how you will check the outcome.
5. Show leadership and culture in action. Keep evidence such as management review minutes, examples of staff raising issues and how they were handled, and communications from top management about quality.
6. Update your management review and internal audit programme. Add the new topics so your next cycle already covers them. Our internal audit service can do this independently if you do not have an internal auditor.
7. Brief your team. A short session for managers and supervisors is often more valuable than rewriting a procedure.

What This Means for Security, Cleaning and Construction Contractors

The businesses we support tend to work under several schemes at once, so the revision affects more than a single certificate.

Security companies. ISO 9001 supports SIA Approved Contractor Scheme assessment and BS 10119 certification by giving you a documented, audited management system that covers competence, records and improvement. Companies working towards those standards should keep ISO 9001 aligned so their evidence stays consistent. See our guide to ISO 9001 for security companies for how the standard fits together with sector requirements.

Cleaning and facilities companies. Buyers commonly ask for ISO 9001 alongside a health and safety accreditation. The stronger emphasis on culture and change is relevant where supervisors manage several sites and contracts change hands regularly.

Construction contractors. ISO 9001 often appears with ISO 14001, ISO 45001 and an SSIP scheme such as CHAS, SafeContractor or Constructionline. The new edition should not change your health and safety accreditation, but it is worth keeping your management system documents consistent across all of them. Our contractor accreditation guide explains how the schemes fit together.

Common Mistakes to Avoid

• Rewriting everything. The core of your system is likely to remain valid. Update what is needed and leave the rest.
• Adding paperwork instead of behaviour. A culture statement with no supporting evidence will not satisfy an auditor.
• Treating opportunities as an afterthought. A risk register with an empty opportunities column is an easy finding.
• Relying on a certification body that is not UKAS accredited. Check accreditation before you commit.
• Waiting until the deadline. Transition deadlines can be tight for busy certification bodies. Booking early gives you choice of dates.

Frequently Asked Questions

When was ISO 9001:2026 published?

ISO 9001:2026 was published on 16 September 2026. It is the sixth edition of the standard and the first full revision since ISO 9001:2015.

Is my ISO 9001:2015 certificate still valid?

Yes. Existing certificates to the 2015 edition remain subject to the applicable transition arrangements. Confirm your certificate validity and transition schedule with your certification body. Your certification body will tell you how and when to move to the new edition, usually as part of a surveillance or recertification audit.

How long is the transition period?

A three-year transition, ending around 2029, has been widely anticipated, but it should be treated as expected until it is confirmed in the official transition arrangements. Check with your certification body for exact dates.

What are the main changes?

The main themes are a stronger focus on quality culture and ethical behaviour, separate treatment of risks and opportunities, tighter change management, core definitions in the standard itself and an expanded informative annex. The process approach and the Plan, Do, Check, Act cycle remain.

Should a first-time applicant certify to the 2015 or 2026 edition?

Ask your certification body which edition they are offering and when. If you have no urgent deadline, building to the new edition from the start avoids rework. If you have a tender deadline, certify as soon as you can and plan the update afterwards.

Do small businesses need to make big changes?

Usually not. Small businesses generally need a clearer risk and opportunity record, a simple change log and better evidence of leadership involvement. Most of the effort is in showing what you already do.

Do I need a consultant to make the transition?

No, but many businesses find an independent gap analysis useful because it shows exactly what needs updating and saves time before the audit.