ISO 9001:2015 was withdrawn today. The more useful question is what a working quality system leaves behind

The sixth edition of ISO 9001 was published this morning. The line underneath it is the one almost nobody is leading with: the 2015 edition, and the climate amendment added to it in 2024, are now both listed as withdrawn.

16 September 2026

ISO’s catalogue entry records ISO 9001:2026 as published, edition 6, 36 pages, owned by ISO/TC 176/SC 2, at stage 60.60. The life cycle panel on the same page lists ISO 9001:2015 and ISO 9001:2015/Amd 1:2024 as withdrawn. The committee had announced on 7 August that “ISO/FDIS 9001 has been approved with overwhelming international support”, so this was not a surprise. Seeing the old edition move into the withdrawn column is still a different feeling from reading a publication date.

Nothing about a withdrawal invalidates a certificate. Certified organisations move on a timetable agreed through their certification body, and ISO directs people there rather than publishing a single global date. The deadline was in fact set before publication: Global ACI issued mandatory transition requirements on 4 September 2026 giving three years, to 30 September 2029, and UKAS restated it for the UK on publication day. Worth reading before anyone puts a deadline in a board pack.

What ISO says changed

In ISO’s own words: “Published on 16 September, the 2026 edition focuses on improving clarity to help organizations of all sizes, maturity and purpose to better understand the requirements. It emphasizes the importance of quality culture and leadership and separates risk and opportunities to ensure organizations proactively take actions to pursue beneficial results. And with improved alignment to other ISO management system standards, it’s easier than ever to integrate ISO 9001 into an organization’s existing management systems, no matter their size or sector.”

Certification bodies are reading it the same way. DNV characterises the extent of the changes as moderate, and less extensive than the move to the 2015 edition. BSI picks out quality culture and ethical behaviour, the separation of risk from opportunity, and the management of change among the important changes.

We have not read the standard. We have read ISO’s summary, the catalogue entry and the published guidance from certification bodies, and we are not going to pretend to a familiarity with the text that nobody outside the committee had yesterday afternoon. Almost everything published this week, this piece included, is a reading of the final draft rather than of the standard on your desk. We will say which is which.

The part we think is interesting

A moderate revision is still a revision, and the temptation is to treat it as a documentation exercise: reissue the manual, renumber the procedures, update the cross-reference matrix, book the gap analysis. That work has to happen. It is also the least interesting thing in the room.

The revision gets interesting when you stop asking what the standard says and start asking what a functioning quality system leaves behind. Take the themes ISO and the certification bodies have highlighted and ask, for each one, what an auditor could actually look at.

A quality culture is close to impossible to demonstrate with a poster, and easy to read in what happens the first time somebody reports a defect that is going to be expensive. Does the report exist? How long after the event was it made? Did it come from the person who found the problem or from the person who had to be told twice? Did anybody question a release, and is there a record of what happened to them when they did? Culture is not a document, but it is not invisible either. It shows up in the timestamps.

The same applies to the rest of it. Opportunities are the hardest of these to evidence, because a risk that materialises leaves wreckage and an opportunity that is missed leaves nothing at all. Separating the two in a standard only helps if somebody records the second kind while it is still an opportunity. Management of change is observable in whether a change was planned, assessed, communicated and then checked afterwards, or whether it simply happened and the paperwork caught up later. Nonconformities, audit findings and corrective actions are the easy cases. Everyone already knows those leave a trail. The question is whether the trail was created while the work was being done or reconstructed in the fortnight before an audit.

That distinction is the whole thing. Records assembled afterwards are a description of what people remember. Records created at the point of work are a description of what happened. Both will fill a folder. Only one of them will survive a conversation with somebody who was there.

Why we are saying this

We should be straight about where we stand. We are not a quality company that has just discovered evidence. We are an evidence company, fourteen years into the same problem, which we first met in safety and claims. This business was built on an observation the founder kept running into: good claims fail because the evidence arrives late or incomplete. Not because the claim was weak. Because the photograph was never taken, the form was filled in three days later, or the record sat in an inbox until it was worth nothing.

Quality is that problem wearing different vocabulary. A defect report that arrives a week late costs you the scrap. A near miss that is never logged costs you the pattern. A change that nobody recorded costs you the audit finding. We run a live quality platform with a heavy equipment dealer group, and almost nothing we have had to build there was new thinking. It was the same structure: capture at source, route it to somebody who has to act, and show the result on a dashboard where a gap is obvious rather than deniable.

None of this makes software a requirement of certification. Plenty of organisations hold ISO 9001 with paper and discipline, and a certification body will accept good paper without complaint. What the new edition changes, we think, is the balance of what you are being asked to demonstrate. More of it now lives in behaviour, and behaviour is only visible through the records that behaviour leaves.

If you want somewhere to start: read ISO’s own summary rather than the commentary, ask your certification body for their transition timetable, and then look at the last serious nonconformity you raised and ask how much of its record existed before somebody went looking for it.

Sources

• ISO, ISO 9001 catalogue entry and life cycle
• ISO/TC 176/SC 2, ISO 9001 revision update, 7 August 2026
• DNV, ISO 9001:2026 standard revision
• BSI, ISO 9001:2026 key changes and guidance

For the standard itself, what it asks for and how the parts fit together, start with our reference guide to ISO 9001 explained. For the mechanics of moving off the 2015 edition, including why the end date is not yet fixed, see the ISO 9001:2026 transition. We will update this article as certification bodies publish their transition timetables.

Last reviewed: 16 September 2026

About Logincident. We build data and software that captures structured evidence at the point of work, routes it through notification and task workflows, and presents it in dashboards, so records are assembled as the work happens rather than reconstructed afterwards. We are not a law firm or a claims handler, and nothing on this page is legal advice.