ISO management system standards are not static documents: they are reviewed periodically to stay aligned with the real risks and priorities of organisations. For 2026, the most relevant change every certified company should have on its radar is the revision of ISO 9001, together with the consolidation of the climate change amendment that ISO introduced in 2024 across its main management standards. This guide explains, precisely and without alarmism, what is moving in ISO 9001, ISO 14001 and ISO 45001, and how to prepare for an orderly transition.
The revision of ISO 9001: what to expect
The current version, ISO 9001:2015, has been in use for more than a decade. ISO confirmed the opening of the formal revision process, so the next edition (commonly referred to as ISO 9001:2026, subject to ISO's publication schedule) will introduce incremental adjustments, not a complete overhaul. The known lines of work point towards reinforcing risk management, explicitly integrating climate change considerations into the analysis of context, accommodating digitalisation and the use of emerging technologies in processes, and improving consistency with the harmonised structure (the former Annex SL, now the Harmonized Structure) shared by all management system standards.
It is worth managing expectations: the revision will retain the process approach, the continual improvement cycle and the customer focus that are the DNA of the standard. When ISO publishes the new edition, the usual three-year transition period will open, during which certificates under the previous version remain valid until migration. There is no need to rush, but there is a need to plan.
The climate change amendment (Amendment 1:2024)
The change that is already in force and that many organisations have not yet fully incorporated is the February 2024 amendment, which ISO added simultaneously to ISO 9001, ISO 14001, ISO 45001 and the other standards with a harmonised structure. The amendment introduces two sentences in clause 4.1 (understanding the organisation and its context) and in clause 4.2 (needs and expectations of interested parties): the organisation must determine whether climate change is a relevant issue and consider that interested parties may have requirements related to it.
In practice, this means that during audits (surveillance or recertification) auditors are already verifying that the analysis of context includes an explicit assessment of the relevance of climate change. It does not require rewriting the management system, but it does require leaving documentary evidence that the issue has been analysed, whether the conclusion is that it is material to the organisation or not.
ISO 9001, ISO 14001 and ISO 45001: a status table
| Standard | Scope | Status in 2026 |
|---|---|---|
| ISO 9001 | Quality management | Under revision; new edition expected with a 3-year transition. Climate amendment applicable. |
| ISO 14001 | Environmental management | 2015 edition in force with the 2024 climate amendment; revision under way. |
| ISO 45001 | Occupational health and safety | 2018 edition in force with the 2024 climate amendment. |
| ISO/IEC 27001 | Information security | 2022 edition in force; transition from 2013 completed. |
The three most widespread management standards share the same high-level structure, which makes an integrated management system (quality, environment and occupational health and safety) easier, with common policies, audits and management reviews. The 2024 climate amendment is identical across all three, so a single update of the analysis of context is enough to cover the requirement in every system.
Implementation methodology: the PDCA cycle applied to the transition
Every management system standard is built on the PDCA cycle (Plan-Do-Check-Act, or the Deming cycle), and the regulatory transition itself is managed with that same logic. In the plan phase you carry out a gap analysis between the current system and the new requirements. In do you update procedures, train staff and incorporate the evidence (for example, the climate assessment in clause 4.1). In check you run an internal audit to verify conformity. In act you correct the non-conformities detected before the external certification audit.
Concrete implementation steps for 2026:
- Confirm that the analysis of context (4.1 and 4.2) already incorporates the climate change assessment with documentary evidence.
- Review the scope of the system and the interested-parties matrix.
- Schedule an internal audit that covers the current requirements and anticipates those expected in the ISO 9001 revision.
- Keep a register of non-conformities with root cause analysis (the five whys technique) and verified corrective actions.
- Coordinate the transition schedule with the accredited certification body once the new edition is published.
Risk-based thinking and the process approach
Two concepts have underpinned ISO 9001 since the 2015 edition and will remain in the revision: the process approach and risk-based thinking. The first requires understanding the organisation as a network of interrelated processes, each with inputs, outputs, resources and measurable control criteria, rather than as a sum of siloed departments. The second replaces the old requirement for "preventive actions" with a broader logic: the organisation must identify the risks and opportunities that may affect the conformity of products and services and customer satisfaction, and plan proportionate actions to address them. It does not impose a specific methodology (you can use an FMEA analysis, a probability-impact matrix or sector-specific tools), but it does require demonstrating that risk is managed consciously and not reactively.
The climate change amendment fits precisely into this logic: climate is one of the context issues that can generate risks (supply disruptions, regulatory changes, expectations of customers and financiers) and opportunities that the organisation must weigh when planning its management system.
Documented information and effective internal auditing
ISO 9001 abandoned its obsession with paper procedures years ago and speaks of documented information, a term that covers both the documents describing how the work is done and the records evidencing that it was done. The principle is proportionality: you document what is necessary to ensure the effectiveness of the processes, no more and no less. Under-documenting leaves processes without control; over-documenting generates bureaucracy that no one maintains and that audits end up flagging as obsolete information.
The internal audit is the mechanism through which the organisation examines itself before the certification body does. An effective internal audit is planned with a programme based on the importance and prior performance of each process, is carried out by people independent of the area being audited, and produces actionable findings (non-conformities, observations and opportunities for improvement) that feed the continual improvement cycle. The ISO 19011 standard offers recognised guidelines for auditing management systems with rigour.
Common mistakes in managing the transition
- Documenting for the sake of documenting: creating procedures no one uses just to pass the audit, instead of living processes.
- Ignoring the climate amendment: assuming it does not apply without leaving evidence of the analysis, which already generates non-conformities.
- Waiting until the last day of the transition: concentrating the migration in the final stretch of the three-year period multiplies the risk and the cost.
- Mistaking certification for quality: obtaining the seal without continual improvement being real, losing the value of the system.
- Forgetting the certifier's accreditation: hiring a body not accredited by ENAC or an equivalent, which detracts from the validity of the certificate.
Frequently asked questions
Do I have to recertify immediately when ISO 9001:2026 comes out?
No. When ISO publishes the new edition, a transition period opens (usually three years) during which the current certificate remains valid. Migration is done in a planned way, normally coinciding with the surveillance or recertification audit.
Does the climate change amendment require having an environmental policy?
Not directly. It requires determining whether climate change is a relevant issue for the organisation's context and considering the expectations of interested parties in this respect. The conclusion may be that it is not material, but it must be documented.
Can I integrate ISO 9001, 14001 and 45001 into a single system?
Yes, and it is advisable. They share the harmonised structure, so policy, internal audits, risk management and management review can be unified, reducing duplication and documentary burden.
What is the difference between certification and accreditation?
Certification is the assessment of your system against the standard, carried out by a certification body. Accreditation is the recognition of the competence of that certification body (in Spain, by ENAC). A certificate from an accredited body carries greater recognition.
Conclusion
The message for 2026 is not one of disruption but of anticipation. The revision of ISO 9001 will leave its philosophy intact (process approach, risk and continual improvement) and will open a transition period with ample time to migrate without upheaval; those who plan early will turn the change into an opportunity to refine their system, while those who leave it to the last minute will pay for the rush and emergency consultancy. The immediate and unavoidable action, by contrast, is the 2024 climate change amendment: it is already being audited, and the organisation that fails to leave evidence of the context analysis exposes itself to an avoidable non-conformity. At Summum Quality we approach the transition with a rigorous gap analysis and an integrated system that takes advantage of the harmonised structure so that quality, environment and safety move forward with a single update, not three.