Published 18 September 2026 from the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.
ISO 9001:2026 requires documented information at 27 points in Clauses 4 to 10: eight where information must be available for use (what most people call documents) and nineteen where it must be available as evidence (what most people call records). That is the same set ISO 9001:2015 required. Nothing was added and nothing was removed; what changed is the wording, which no longer says “maintain” or “retain”. This page lists all 27 by clause, states plainly what the standard does not require, and shows what an existing 2015 documentation set needs updated for the 2026 edition.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
The wording change first, because it confuses people
ISO 9001:2015 said “maintain documented information” when it meant a document you keep current, and “retain documented information” when it meant a record you keep as proof. ISO 9001:2026 drops both verbs. It now says “shall be available as documented information” for the first case and “documented information shall be available as evidence of” for the second. Annex A.2 e) confirms the intent: the first refers to information obtained, used or provided by the organisation; the second refers to the retention of objective evidence, and “as evidence of” does not imply a legal evidential standard.
For a document controller the practical rule is unchanged. Items in the first table below are documents: controlled, current, approved, available where the work is done. Items in the second table are records: protected from alteration, retained for a defined period, retrievable when an auditor or a customer asks.
Documents: eight places where information must be available for use
| Clause | What must be available as documented information | Typical form |
|---|---|---|
| 4.3 | The scope of the quality management system, stating the types of products and services covered and the justification for any requirement determined as not applicable | Scope statement in the manual, on the intranet or on the certificate application |
| 4.4.2 a) | Documented information, to the extent necessary, to support the operation of the organisation’s processes | Procedures, work instructions, process maps, forms, checklists, system configurations |
| 5.2.2 a) | The quality policy | One-page policy, signed and dated |
| 6.2.1 g) | The quality objectives | Objectives register or dashboard with targets and owners |
| 7.1.5.2 a) | The basis used for calibration or verification where no international or national measurement standard exists | Calibration procedure or method statement for the affected equipment |
| 7.5.1 b) | Documented information the organisation itself determines as necessary for the effectiveness of the system | Whatever the organisation decides: manual, plans, specifications, matrices |
| 8.1 | Documented information, to the extent necessary, to have confidence that the processes have been carried out as planned | Quality plans, job travellers, batch records, service checklists (this item sits between document and record: the plan is a document; the completed plan is the record) |
| 8.5.1 a) | Documented information defining the characteristics of the products or services, the activities to be performed and the results to be achieved, available and used as a controlled condition, as applicable | Specifications, drawings, recipes, service standards, work instructions at the point of use |
Records: nineteen places where information must be available as evidence
| Clause | What must be available as evidence of | Typical form |
|---|---|---|
| 4.4.2 b) | That the processes are being carried out as planned | Completed forms, logs, system transaction records |
| 7.1.5.1 | Fitness for purpose of the monitoring and measurement resources | Calibration certificates, verification checks, maintenance records |
| 7.2 | Competence | Qualifications, training records, competence assessments, licences |
| 8.1 | Conformity of products and services | Inspection and test records, service completion records |
| 8.2.3.2 a), b) | The results of the review of requirements for products and services, and any new or changed requirements | Order or contract review records, signed quotations, change confirmations |
| 8.3.3 | Design and development inputs | Design brief, requirements specification, input review record |
| 8.3.4 f) | Design and development control activities: reviews, verification, validation and the actions taken on problems | Design review minutes, verification reports, validation and test reports |
| 8.3.5 | Design and development outputs | Approved drawings, specifications, bills of materials, service designs |
| 8.3.6 a) to d) | Design and development changes, the results of reviews, the authorisation of the changes and the actions taken to prevent adverse impacts | Engineering change records |
| 8.4.1 | The evaluation, selection, monitoring of performance and re-evaluation of external providers, and any actions arising | Approved supplier list, supplier evaluations, performance reviews, supplier corrective actions |
| 8.5.2 d) | Traceability, where traceability is a requirement | Batch, lot or serial records; service logs |
| 8.5.3 | What has occurred when property belonging to a customer or external provider is lost, damaged or found unsuitable | Incident report and notification to the owner |
| 8.5.6 | The results of the review of changes to production or service provision, the person(s) authorising the change and any necessary actions | Production or service change records |
| 8.6 a), b) | Conformity to the acceptance criteria at release, and traceability to the person(s) authorising release | Final inspection, release notes, sign-offs |
| 8.7.2 a) to d) | The nature of the nonconformity, the actions taken, any concessions obtained and the authority deciding the action | Nonconformance reports |
| 9.1.1 | The results of monitoring, measurement, analysis and evaluation | KPI reports, analysis reports, customer satisfaction results |
| 9.2.2 | The implementation of the audit programme(s) and the audit results | Audit programme, audit plans, audit reports, findings and closure |
| 9.3.3 | The results of management reviews | Management review minutes with decisions, owners and dates |
| 10.2.2 a), b) | The nature of the nonconformities and any subsequent actions taken, and the results of any corrective action | Nonconformity and corrective action records with effectiveness checks |
Two related requirements sit outside these tables. Under 8.3.2 j), design and development planning must consider what documented information will be needed as evidence that design requirements have been met, which is a planning consideration rather than a record in its own right. Under 7.5.3.2, documented information of external origin that the organisation needs (customer specifications, standards, regulations, supplier data) must be identified and controlled, and documented information kept as evidence of conformity must be protected from unintended alteration.
What ISO 9001:2026 does not require you to document
This list matters as much as the tables, because most over-documented systems were built on assumptions rather than requirements.
- A quality manual. Not required since 2015 and still not required. Many organisations keep one because customers and tender evaluators ask for it, which is a business reason, not a standard’s requirement.
- Documented procedures. The standard names no mandatory procedure. Under 4.4.2 a) and 7.5.1 b) you decide which procedures your processes need, based on size, complexity and competence (7.5.1 NOTE).
- A documented risk register or risk-management process. Clause 6.1 contains no documented-information requirement, and Annex A.6.1.2 states that risk-based thinking does not imply a formal risk-management approach or a documented process. In practice, because 6.1.2 and 6.1.3 now require risks and opportunities to be analysed and evaluated, and 9.1.3 and 9.3.2 require their effectiveness to be evaluated and reviewed, a register is the simplest way to show it. It is recommended, not mandated.
- Context and interested-party analyses (4.1, 4.2). No documented-information requirement, but both must be monitored and reviewed, and 9.3.2 b) and c) make changes in them management review inputs. A dated record is the practical way to demonstrate the monitoring.
- The climate-change determination (4.1). No explicit record is required. A recorded decision with reasons, even a “not relevant, because”, is what auditors have come to expect since Amendment 1:2024.
- Change plans (6.3). No documented-information requirement in 6.3 itself. Records of changes are required for design (8.3.6) and for production or service provision (8.5.6).
- Organisational knowledge (7.1.6), awareness (7.3), communication (7.4). No documented-information requirements. Awareness of quality culture and ethical behaviour (7.3 e)) is tested by interview, not by a document.
- A management representative. Not a requirement since 2015. The responsibilities in 5.3 must be assigned and communicated; how you do that is your choice.
What to update in an existing ISO 9001:2015 documentation set
Because the required set of documents and records is unchanged, the transition work on documentation is editorial and targeted rather than a rebuild (the clause-by-clause register shows every item that moved). The items below are the ones that actually change content.
| Document or record | What to change for ISO 9001:2026 | Driver |
|---|---|---|
| Every document that cites the standard | Replace “ISO 9001:2015” with “ISO 9001:2026” once the transition is complete; check every clause citation against the new list lettering (5.1.1, 5.3, 6.1, 6.2.1, 7.3, 9.1.3, 9.3.2) and replace any reference to 10.3 with 10.1 | Renumbering |
| Quality policy | Add or evidence how the policy takes the context into account and supports strategic direction; keep the four 2015 commitments | 5.2.1 e) |
| Risk and opportunity register | Separate risks from opportunities; add an analysis and evaluation step for each (likelihood and consequence for risks; benefit and feasibility for opportunities); record the effectiveness review of actions | 6.1.2, 6.1.3, 9.1.3 e) f) |
| Planning-of-change template or procedure | Add three fields: how the change will be communicated, how its effectiveness will be monitored and evaluated, and how the results will be reviewed; add “and information” to the resource check | 6.3 c), e), f), g) |
| Management review agenda and minutes template | Add changes in the needs and expectations of interested parties as an input; split the effectiveness of actions on risks and on opportunities into two items | 9.3.2 c), g), h) |
| Internal audit checklist | Rebuild against the 2026 lettering; add questions on culture and ethics, opportunity evaluation and change communication | 9.2.2 |
| Awareness and induction material | Add the organisation’s quality culture and ethical behaviour expectations; add the relevant quality objectives if they were missing | 7.3 e) |
| Knowledge management arrangements | Show how knowledge is retained, applied and shared, including in digital systems | 7.1.6 |
| Customer communication and contract terms | Where relevant, state what information customers receive on contingency actions, including disruptions | 8.2.1 e) |
| Continual improvement records | Show improvements to processes, not only products and services, and improvements aimed at future needs and expectations | 10.1 a), b) |
Building a documented information register that survives the audit
The tool that makes all of this manageable is a single register, in a spreadsheet or in a QMS platform, with one row per requirement in the tables above and columns for the document or record that satisfies it, its owner, its format and location, its retention period and its last review date. The register itself satisfies 7.5.1 b) as documented information the organisation has determined necessary, and it gives an auditor a map instead of a scavenger hunt. Organisations running their system on a platform such as Effivity keep the register, the version history and the evidence trail in one place, which also settles the 7.5.3.2 controls on distribution, access, storage, change control and retention without a separate procedure.
Under 7.5.2, every document created or updated needs identification (title, date, author or reference), a suitable format and medium, and review and approval. Under 7.5.3.1 it must be available where and when needed and protected from loss of confidentiality, improper use and loss of integrity. Those requirements are unchanged from 2015 and they apply equally to a paper form and to a record generated by a system.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Have your documented information checked against the 2026 list
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
How many mandatory documents does ISO 9001:2026 require? The standard requires documented information at eight points for information to be available for use and at nineteen points for information to be available as evidence. Because one point can be met by several documents or records, and one document can cover several points, the standard cannot be reduced to a single count of “documents”.
Does ISO 9001:2026 require a quality manual? No. It has not been required since 2015. Keep one if your customers, tenders or certification body’s application process ask for it.
Are documented procedures mandatory in ISO 9001:2026? No procedure is named as mandatory. You determine the procedures your processes need (4.4.2 a), 7.5.1 b)).
Did ISO 9001:2026 add any new records? No. The set of documents and records is the same as in ISO 9001:2015. The verbs “maintain” and “retain” were replaced by “shall be available as documented information” and “shall be available as evidence of”.
Do we need to document risks and opportunities? Not explicitly. Clause 6.1 has no documented-information requirement. Because risks and opportunities must now be analysed and evaluated and the effectiveness of actions reviewed, a register is the practical way to show it.
Do we have to record our climate-change decision? The standard does not say so explicitly. A recorded determination with reasons is what auditors expect, and it is the only way to show the decision was made.
What is the difference between “available as documented information” and “available as evidence of”? The first means a document you keep current and use; the second means a record you keep as proof. Annex A.2 e) explains the distinction.
Can our documentation stay on ISO 9001:2015 numbering until the transition audit? Yes. Certificates to ISO 9001:2015 remain valid during the transition period. Update the numbering as part of the transition work so that the internal audit and management review before the transition audit are conducted against the 2026 edition.
Read next
The clause-by-clause register of every change; the ISO 9001:2026 playbook; the transition checklist; a gap analysis against the ISO 9001:2026 standard; documentation and QMS manual services written to the 2026 standard; and ISO 9001:2026 transition consulting from Sterling.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026), Clauses 4 to 10 and Annex A.2 e). ISO 9001:2015 for the comparison. ISO 10013, Quality management systems — Guidance for documented information, cited in Annex A.7.5 NOTE 2.
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.
