How long do we actually have to transition to ISO 9001:2026?
Two published dates, and one you have to go and get.
ISO 9001:2026 was published on 16 September 2026. The IAF transition period is three years from publication, so ISO 9001:2015 certificates are expected to remain valid until 30 September 2029. Confirm the exact cut-off dates with your own certification body.
That last sentence is the one sites skip. Nobody transitions on the IAF deadline. You transition at whichever audit your certification body schedules the assessment for, which is a date inside your existing audit programme, not a date on an ISO website. Find out what that date is before you plan anything else. It converts a three year problem into a real one with a real deadline, and it is usually sooner than people expect.
Why a twelve month plan and not a three year one?
Because the work is not big, and a three year plan means nothing happens for two of them.
For a site already certified to the 2015 edition, the revision asks for an opportunity register under 6.1.3, a rebuilt change record under 6.3, a split of the combined risk and opportunity register with an analysis and evaluation step added on the risk side, two extra management review inputs, an objective line on each internal audit plan, a policy that takes context into account, and awareness of quality culture and ethical behaviour on the floor. If Amendment 1:2024 never made you record a climate change decision under 4.1, add that too. Expect twenty to forty lines of a gap assessment to move, not two hundred.
Twelve months is enough to do that properly and still get a full internal audit cycle and one management review through the new requirements before the certification body arrives. Anything shorter and you are showing an auditor a system that has been alive for three weeks.
What does the month by month plan look like?
| Month | What you do | Done when |
|---|---|---|
| 1 | Buy ISO 9001:2026 and ISO 9000. Do a gap assessment against the 2026 text only, not against your old checklist | Every line has a status, an owner and a target date, and a written justification where you have said not applicable |
| 1 | Write to your certification body with three questions: when does it stop auditing to the 2015 edition, at which of your audits will the transition be assessed, and how much extra audit time will it charge | The written answer is filed and the date is in the plan |
| 2 and 3 | Update the documents that actually change: the risk register split into two, the change record, the management review agenda, the interested parties register, the policy if context is not visible in it, the audit plan template, and the induction pack for 7.3 e) | Each gap line is closed by a named document or record that a process owner can use |
| 3 | Train. Top management on 5.1.1 i) and k) and on the Note 2 wording. Process owners on 6.1.2 and 6.1.3. Internal auditors on the whole change list. Everyone else on 7.3 a) to e) | Training records exist against the specific changes, not against a generic awareness session |
| 4 | Run an internal audit against the 2026 edition. This audit exists to find the transition gaps, so audit the changes, not the whole system | Findings raised, corrective actions opened with owners and dates |
| 5 | Management review with the eight inputs and the seven trend items under d), including the two new ones | Minutes exist that a stranger could act from, with decisions, owners and dates |
| 6 | Transition audit with the certification body, on the date they gave you in month 1 | Findings closed, certificate reissued to the 2026 edition |
| 7 to 12 | The slack. Use it for the findings you did not expect, the objective that did not move, and the process owner who left in month 4 | You are well inside 30 September 2029 |
Notice that the plan finishes in month 6 and the year has twelve months in it. That is deliberate. Every transition I have watched has lost two months somewhere, usually to a resignation or a customer crisis. Plan the slack rather than discovering you needed it.
What do you have to keep as evidence of the transition itself?
Auditors assessing a transition look for the trail as well as the result. Four things, in one folder:
- The gap assessment, dated, against the 2026 text.
- Training records against the specific changes, with who was trained and on what.
- The internal audit that used the 2026 edition as its criteria.
- Management review minutes in which the transition was discussed.
Those four convert a difficult audit into a short one. Without them you are asking the auditor to take your word that the system changed, and the auditor’s job is not to take your word.
What will certification bodies look at first?
This is ASC’s expectation, based on how transition assessments have run in previous revisions and on where the new text actually puts new duties. It is not a statement about any certification body’s published policy, and your body may do it differently. Ask them.
We expect the first five things an assessor opens to be these.
- The opportunity register under 6.1.3. It is the only genuinely new build in the revision. If a site has done nothing, this is where the nothing shows. The test is not whether a register exists. It is whether each line carries an analysis, an evaluation, an action, how the action is integrated into a process and how its effectiveness will be evaluated.
- The change record under 6.3. Seven considerations now, where 2015 had four. The three that sites miss are e) the communication of the changes, f) how effectiveness will be monitored and evaluated, and g) how the results will be reviewed. An assessor will pick one change made since the transition started and read the record for those three columns.
- The climate change decision under 4.1. The sentence is short: “The organization shall determine whether climate change is a relevant issue.” It came in with Amendment 1:2024 to the 2015 edition and is carried forward, so a site that handled the amendment already has this. A dated decision with a reason passes whichever way it goes. A blank is a finding.
- Evidence for 5.1.1 i) and k). Promoting quality culture and ethical behaviour, and promoting risk-based thinking and opportunity-based thinking. This will be asked of top management in the leadership interview, and the answer that fails is the one that points at a poster. What did they do, when, and what changed as a result.
- Awareness of 7.3 e) on the floor. The organizational quality culture and ethical behaviour is now the fifth awareness item, and awareness is tested by talking to people, not by reading a register. An assessor will ask an operator, and if the operator has never heard the phrase, the finding is against the site, not the operator.
Two of those five are register work you can do in a week. Three of them need the site to have actually changed something, and those are the ones that need the twelve months.
Where do sites lose the transition?
Three failure modes, and they are the same three as in a first implementation.
The paper system. Every new clause has a document and nothing on the floor has changed. It survives the transition audit and fails the following year when the assessor starts sampling records instead of reading procedures. The test: ask an operator what the quality policy means for their job. If the honest answer is nothing, you have a paper system.
The consultant’s system. The new registers are excellent, the terminology is the consultant’s, and nobody on site can maintain them. Six months later the opportunity register still has the four lines the consultant wrote. The test: ask a process owner to change one line in their own register. If they phone the consultant, you have bought a hostage situation.
The QA system. QA writes the transition, QA owns it, and the rest of the business treats the audit as a visit from QA. The test: count how many of the transition actions are owned by somebody outside QA. Most of the new duties in the 2026 edition sit with top management, with process owners and with the people on the floor, so most of the actions should too.
Who on our site needs which course?
| Role | What they need | Course |
|---|---|---|
| QA or quality manager, QMS coordinator, management representative | The whole change list, the two registers, the rebuilt change record, the eight review inputs, the gap assessment | Implementation, R4800 |
| Internal auditors | The 2026 numbering, the new requirements, the audit objective line and how to write a nonconformity in three parts | Implementation, R4800 |
| Process owners in production, engineering, procurement, planning, sales and NPD | What 6.1.2, 6.1.3 and 6.3 now ask of their own process, and what they will be asked in an audit | Introduction, R1495. One of them on Implementation if they also write registers |
| Top management | The twelve items in 5.1.1, especially i) and k), and the Note 2 wording | Introduction, R1495, coached by the person who did Implementation |
| Supervisors, line leaders, administrators, everyone else in scope | The five awareness items in 7.3, including the new e), answered about their own job | Introduction, R1495 |
| Consultants advising sites | Everything, plus the argument for what clients do not need to buy | Implementation, R4800 |
What is the first thing to do this week?
Send the three questions to your certification body. When does it stop auditing to the 2015 edition, at which of our audits will the transition be assessed, and what will the extra audit time cost. File the written answer. Then open your existing risk register and count how many lines in it are actually opportunities. Those lines are the start of your 6.1.3 register, and counting them takes twenty minutes.
If you own the transition, take ISO 9001:2026 Understanding and Implementation, R4800, about fourteen hours. It carries the clause by clause change list, a 161 line gap assessment tool, both registers, the change record, the internal audit programme builder and the management review pack builder, and it ends in a marked implementation workbook you can take back to your own site.
If your people need to survive the interviews, put them on Introduction to ISO 9001:2026, R1495, about four hours. For teams of five or more, contact ASC for a group arrangement.
Everything, including the clause by clause change article, sits at ISO 9001:2026 training.
ISO 9001:2026 is a standard published by ISO. This course is an independent training product and is not approved or endorsed by ISO or by any certification body.