ISO 9001:2026

Identify the internal and external issues relevant to the organisation's purpose and strategic direction that affect its ability to achieve the intended results of the quality management system, including whether climate change is a relevant issue, and monitor them.

Determine the interested parties relevant to the quality management system and their requirements, including any related to climate change, decide which of those requirements the system will address, and monitor information about them.

Define and document the boundaries and applicability of the quality management system, taking account of context, interested parties, and the organisation's products and services; any requirement judged not applicable must not affect the ability to deliver conforming product.

Establish, implement, maintain, and continually improve the quality management system, determining the processes needed, their inputs, outputs, sequence, criteria, resources, responsibilities, risks, and how they are evaluated and improved.

Top management must demonstrate leadership and commitment to the quality management system: taking accountability, setting policy and objectives, integrating requirements into business processes, promoting continual improvement, promoting a quality culture and ethical behaviour, and ensuring resources and results.

Top management must ensure customer and applicable legal requirements are determined and met, that risks and opportunities affecting conformity are addressed, and that the focus on enhancing customer satisfaction is maintained.

Top management must establish, communicate, and maintain a quality policy that is appropriate to the organisation's purpose and context and supports its strategic direction, commits to satisfying requirements and to continual improvement, and provides a framework for quality objectives.

Assign and communicate responsibilities and authorities for the quality management system, including ensuring conformity to the standard, process performance, reporting to top management, customer focus, and integrity during changes.

Considering the organisation's context and the requirements of interested parties, determine the risks and opportunities that need to be addressed to give assurance the quality management system achieves its intended results, prevents or reduces undesired effects, and supports continual improvement.

Plan actions proportionate to the risks determined, integrate them into the quality management system processes, and evaluate their effectiveness.

Plan actions to take up the opportunities determined where they can enhance the intended results, integrate them into the quality management system processes, and evaluate their effectiveness.

Establish measurable quality objectives consistent with the policy at relevant functions and levels, and plan how to achieve them including what, resources, responsibility, timing, and evaluation.

When changes to the quality management system are needed, carry them out in a planned way so they are implemented effectively, considering purpose and consequences, system integrity, resources, and reallocation of responsibilities; monitor and evaluate their effectiveness, communicate them, and review the results.

Determine and provide the resources needed to establish, implement, maintain, and continually improve the quality management system, considering internal capability and what must be obtained externally.

Determine and provide the people necessary for effective operation of the quality management system and its processes.

Determine, provide, and maintain the infrastructure (buildings, equipment, hardware, software, transport, communications) needed for process operation and conformity of products and services.

Determine, provide, and maintain a suitable environment (social, psychological, and physical factors) for operating processes and achieving conforming products and services, one that supports a quality culture and ethical behaviour.

Provide and maintain suitable, fit-for-purpose resources for monitoring and measurement, and where measurement traceability is required, calibrate or verify measuring equipment and keep evidence.

Determine the knowledge needed to operate processes and achieve conformity, maintain it, make it available, and acquire additional knowledge when addressing changing needs and trends.

Determine the competence needed for people whose work affects quality performance, ensure it through education, training, or experience, take action where gaps exist, and retain evidence.

Ensure people doing work under the organisation's control are aware of the quality policy, relevant objectives, their contribution to effectiveness and to improved performance, the implications of not conforming, and the organisation's quality culture and ethical behaviour.

Determine the internal and external communications relevant to the quality management system: what, when, with whom, how, and who communicates.

The quality management system must include, and make available, the documented information required by the standard plus whatever the organisation determines is necessary for its effectiveness.

When creating or updating documented information, ensure appropriate identification and description, format and media, and review and approval for suitability and adequacy.

Control documented information so it is available and suitable where needed and adequately protected, addressing distribution, access, storage, version control, retention, disposal, and documents of external origin.

Plan, implement, and control the processes needed to meet product and service requirements: set criteria and acceptance, determine resources, control per criteria, and keep documented information to confirm conformity.

Establish communication with customers covering product and service information, enquiries and orders including changes, feedback and complaints, handling of customer property, and contingency requirements where relevant.

When determining requirements for products and services offered to customers, ensure requirements are defined including applicable legal and regulatory ones, and that the organisation can meet its claims.

Before committing to supply, review that the organisation can meet the requirements, including those stated by the customer, those not stated but necessary, legal requirements, and any organisation-specified requirements; retain evidence.

When requirements for products and services change, ensure relevant documented information is amended and relevant people are made aware of the changed requirements.

Establish, implement, and maintain a design and development process appropriate to ensure subsequent provision of products and services. This and the other design and development subclauses may be excluded from scope where the organisation does not perform design and development.

Plan the design and development stages and controls, considering the nature, duration, and complexity of the activities, the review, verification, and validation steps needed, responsibilities and resources, interfaces between the people involved, customer and user involvement, and the documented information required.

Determine the requirements essential for the products and services being designed, including functional and performance requirements, information from earlier similar activities, statutory and regulatory requirements, standards or codes of practice, and the potential consequences of failure; resolve conflicting inputs and retain documented information.

Apply controls to the design and development process: define the results to be achieved, conduct reviews, verification, and validation activities, take action on problems found, and retain documented information.

Ensure design and development outputs meet the input requirements, are adequate for the subsequent processes, include or reference monitoring and measuring requirements and acceptance criteria, and specify the characteristics essential for their intended and safe, proper use; retain documented information.

Identify, review, and control changes made during or after design and development to the extent needed to ensure no adverse impact on conformity to requirements; retain documented information on the changes, the review results, the authorisation, and the actions taken to prevent adverse impacts.

Ensure externally provided processes, products, and services conform to requirements: determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, and retain evidence of these activities.

Ensure externally provided processes, products, and services do not adversely affect the ability to deliver conforming products and services to customers: keep them within the control of the quality management system, define the controls applied to external providers and to their outputs, and determine the verification needed.

Communicate to external providers the requirements for the processes, products, and services to be provided, including approvals, competence, their interactions with the organisation, how their performance is controlled and monitored, and any verification or validation planned at their premises.

Implement production and service provision under controlled conditions: documented information defining the products, services, and results to be achieved, suitable monitoring and measuring resources, appropriate infrastructure and environment, competent people, validation of processes whose output cannot be verified, actions to prevent human error, and release, delivery, and post-delivery activities.

Use suitable means to identify process outputs where needed to ensure conformity of products and services, identify the status of outputs against monitoring and measurement requirements, and control and retain documented information on unique identification where traceability is a requirement.

Exercise care with property belonging to customers or external providers while it is under the organisation's control or in use: identify, verify, protect, and safeguard it, and report to the owner when it is lost, damaged, or found unsuitable, retaining documented information.

Preserve process outputs during production and service provision to the extent necessary to ensure conformity to requirements, including identification, handling, contamination control, packaging, storage, transmission or transportation, and protection.

Meet requirements for post-delivery activities associated with products and services, considering statutory and regulatory requirements, potential undesired consequences, the nature, use, and intended lifetime of the products and services, customer requirements, and customer feedback.

Review and control changes for production or service provision to the extent necessary to ensure continuing conformity with requirements, and retain documented information on the results of the review, the persons authorising the change, and any necessary actions.

Verify at appropriate stages that product and service requirements are met, and do not release to the customer until planned arrangements are satisfactorily completed unless authorised; retain evidence of conformity and release authority.

Identify and control outputs that do not conform to requirements to prevent unintended use or delivery, take appropriate action based on the nonconformity, and retain documented information about it and any concessions.

Determine what needs monitoring and measuring, the methods, and when it is performed and evaluated, to assess the performance and effectiveness of the quality management system, and retain the evidence.

Monitor customers' perception of the degree to which their needs and expectations are met, and determine methods for obtaining, monitoring, and reviewing this information.

Analyse and evaluate appropriate data and information from monitoring and measurement to assess conformity, customer satisfaction, system performance, planning effectiveness, risk actions, external providers, and improvement needs.

Conduct internal audits at planned intervals to find out whether the quality management system conforms to the organisation's own requirements and to the standard, and is effectively implemented and maintained.

Plan, establish, implement, and maintain an objective audit programme covering frequency, methods, responsibilities, and reporting; define the criteria and scope of each audit, select impartial auditors, report results to relevant management, take the necessary actions, and retain evidence.

Top management must review the quality management system at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with strategic direction.

The management review must include inputs such as status of prior actions, changes in external and internal issues, changes in the needs and expectations of relevant interested parties, performance and effectiveness information, adequacy of resources, effectiveness of actions on risks and opportunities, and opportunities for improvement.

The results of management review must include decisions and actions on continual improvement opportunities, any needed changes to the system, and resource needs, and must be retained as documented information.

Continually improve the suitability, adequacy, and effectiveness of the quality management system: determine and select opportunities for improvement, including improving products and services to meet customer requirements and enhance customer satisfaction and correcting undesired effects, using analysis and evaluation results and management review results to identify needs.

When a nonconformity occurs, react to it, evaluate the need to eliminate its causes so it does not recur, implement and review corrective action, update risks if needed, and retain evidence of the nonconformity and actions taken.