ISO 9001:2026 is 36 pages long, and the requirements occupy 20 of them, in Clauses 4 to 10. Read in the standard’s own language they sound like law. Read as questions about how a business is run, they are mostly things a well-run company already does, plus a handful it should. This page translates every requirement into everyday business language, clause by clause, keeping the clause number so that you, your consultant and your auditor are talking about the same thing. It is written for the owner, the general manager and the department head, not the quality professional, and it marks what is new or changed since ISO 9001:2015. For a scored view of the requirements that changed, use the free online ISO 9001:2026 gap check.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
Before the requirements: what the standard is for
Clause 1 says the standard applies to any organisation that needs to show it can consistently deliver products and services that meet customer and legal requirements and that wants to increase customer satisfaction through a working system. Clause 2 says ISO 9000 supplies the vocabulary. Clause 3 defines 23 terms; the ones that matter most to a business reader are that “top management” means whoever directs and controls the organisation at the top (the owner, the board, the general manager), that “interested party” means anyone who can affect or be affected by what you do, that “risk” is the effect of uncertainty and can be good or bad, and that “documented information” covers both the documents you keep current and the records you keep as proof. The Introduction sets out the seven quality management principles (customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making, relationship management), the process approach and the Plan-Do-Check-Act cycle, and, new in 2026, names opportunity-based thinking alongside risk-based thinking.
Clause 4: know your situation and draw the boundary
Know what is going on outside and inside the business that affects your ability to deliver: the market, competitors, laws, technology, the economy, social and environmental conditions outside; people, culture, skills, finances, systems and performance inside. Decide whether climate change is one of those things, and record the decision either way. Keep this under review (4.1).
Know who matters to the business and what they need from you: customers, owners, staff, suppliers, regulators, lenders, neighbours. Then decide, and this is new in 2026, which of those needs your quality system will actually take on and manage, and which you will note but not manage through it (4.2 a) to c)). Some of those parties may expect something from you on climate change (4.2 NOTE).
Write down what the quality system covers: which sites, activities, products and services are in, which are out, and why any requirement of the standard does not apply to you. If you do not design products, say so and why. Keep this statement available (4.3).
Work out the processes that make the business run, from winning the order to after-sales; know what goes into each, what comes out, how they connect, how you know each is working, what resources it needs, who owns it, what could go wrong or go better in it, and how you review and improve it (4.4.1 a) to i)). Keep the procedures and instructions people need to run them, and the records that show they were run as planned; no more than is useful (4.4.2).
Clause 5: leadership has to lead, visibly
Top management shows it means it in twelve ways (5.1.1 a) to l)): a policy and objectives that fit where the business is going; quality built into how the business runs rather than a separate ISO activity; resources provided; the importance of quality communicated in leadership’s own words; a check that the system delivers results; people directed and supported; continual improvement pushed; other managers helped to lead on quality in their areas; a culture promoted in which people do the job right, speak up and behave ethically (new, 5.1.1 i)); the process approach promoted; both risk-based and opportunity-based thinking promoted (changed, 5.1.1 k)); and accountability for the whole system accepted at the top. The standard says what culture and ethics mean in one line: they are reflected in shared values, attitudes, practices and actions (NOTE 2).
Top management makes sure customer and legal requirements are identified and consistently met, that the things which could stop customers being satisfied, and the chances to satisfy them better, are dealt with, and that customer focus survives after the sale (5.1.2).
Top management sets a quality policy that fits the business, frames the objectives, commits to meeting requirements and to improving the system, and, strengthened in 2026, takes the business’s situation into account and supports its direction (5.2.1 a) to e)). The policy is written down, communicated inside the business, available to outsiders who ask, and, new word in 2026, implemented as well as understood and applied (5.2.2 a) to d)). If the policy could belong to any company, it does not meet e).
Top management makes sure people know their responsibilities and authority, and assigns six specific ones: keeping the system conforming to the standard; reporting on how it performs; making sure processes deliver; keeping customer focus alive; reporting improvement opportunities to top management (now a separate assignment); and keeping the system intact through changes (5.3 a) to f)).
Clause 6: plan for what could go wrong, what could go better, what you want to achieve, and what you are about to change
Use what you learned in Clause 4 to work out the risks and opportunities that need attention, for four reasons: to be confident the system will deliver, to prevent or reduce bad outcomes, to keep improving, and to make good outcomes more likely (6.1.1).
For risks, and this is tightened in 2026: identify what could go wrong (including disruptions), analyse how likely and how serious each is, decide which matter, plan what to do about them, build the action into the relevant process, and check whether it worked. Match the effort to what the risk could do to the system’s results (6.1.2).
For opportunities, and this is new as a requirement of its own: identify what could go better (new markets, products, partnerships, technology, changing customer needs), analyse the benefit and what it would take, decide which to pursue, plan the action, build it into the process, and check whether it delivered. Keep the actions sensible for a business of your size and situation (6.1.3).
Set quality objectives where they matter, at company level and for relevant departments and processes. Each must connect to the policy, be measurable, take the requirements into account, be tracked, be communicated, be updated when needed, be written down, and be about things that affect product or service quality and customer satisfaction (6.2.1 a) to h)). For each, plan what will be done, with what resources, by whom, by when, and how the result will be judged (6.2.2).
When you decide to change something about the system (a new site, new software, a restructure, outsourcing, the transition to this edition), plan it. Think through the purpose and consequences; the effect on the system; the resources and, added in 2026, the information needed; who will be responsible; and, all new in 2026, how the change will be communicated, how you will know it worked, and how the result will be reviewed (6.3 a) to g)).
Clause 7: give the system what it needs to run
Work out and provide the people, equipment, premises, IT and money the system needs, considering what you already have and what must be bought in (7.1.1). Have enough people with the right skills (7.1.2). Provide and maintain the buildings, equipment, software, transport and IT the processes need, for people on site and, acknowledged in 2026, for people working remotely (7.1.3). Provide a working environment, physical, social and psychological, in which people can do good work; some of that is shaped by your culture (7.1.4).
Where you use equipment or checks to confirm products and services are right, make sure it is suitable and maintained, and keep the proof (7.1.5.1). Where measurements must be trustworthy, calibrate or verify equipment against recognised standards, show its status, protect it, and, if it turns out to have been wrong, check what it affected (7.1.5.2).
Identify the know-how the business depends on, and, strengthened in 2026, retain it, apply it and share it, so that it does not leave when a person does; when needs change, work out what you need to learn (7.1.6).
Decide what competence each quality-affecting role needs, make sure the people in those roles have it, close any gaps and check the training worked, and keep the proof (7.2). Make sure everyone doing work for you knows the policy, how they contribute, what happens if they do not follow the agreed way of working, the objectives that apply to them, and, new in 2026, what the business expects of them in doing things properly and behaving ethically (7.3 a) to e)). Decide what needs communicating about quality, when, to whom, how and by whom (7.4).
Keep the documents the standard requires and the ones your business needs, no more; identify and approve them properly; make sure people can find the current version and that documents and records are protected; control distribution, storage, changes and retention; control the outside documents you rely on; and protect records from being altered after the event (7.5). The 2026 edition changes the wording that requires documents and records but not the list of them.
Clause 8: run the work under control
Plan the work: know the requirements, set what “acceptable” means for the product or service and for the process, run the process to those criteria with the right resources, keep enough records to be confident it was done as planned and to prove the result was right, control planned changes and deal with unplanned ones, and control anything you outsource (8.1).
Communicate properly with customers: information about what you offer; enquiries, contracts, orders and changes; feedback and complaints; how their property is handled; and, extended in 2026, what happens if things go wrong, including disruptions to supply (8.2.1 a) to e)). Define what your products and services must meet, including the law, and only claim what you can deliver (8.2.2). Before committing to an order, check you can meet everything the customer asked for and everything they obviously need; resolve differences from the quotation; confirm verbal orders; keep records; and when requirements change, update the paperwork and tell everyone affected (8.2.3, 8.2.4).
If you design products or services: have a design process (iterative development is explicitly fine in 2026); plan the stages, reviews, verification, validation, responsibilities, resources and customer involvement; capture the inputs (functional needs, past lessons, law, standards, consequences of failure) and resolve conflicts; control the design with reviews, verification that outputs meet inputs and validation that the result works in use; make sure outputs give production and service what they need; and control changes with records (8.3). If you do not design, exclude 8.3 in your scope with the reason.
Control what you buy and outsource: make sure bought-in goods, services and outsourced processes meet requirements; set criteria for choosing, monitoring and re-checking suppliers and keep the records; match the control to how much the supplier could affect your customers; and tell suppliers clearly what you need, what needs your approval, what competence their people need, how you will monitor them, and what checks you may do at their premises (8.4).
Run production and service delivery under controlled conditions: information on what to make and how, suitable checks at the right stages, the right equipment and environment, competent and where required qualified people, validated processes where the result cannot be fully checked afterwards, practical steps to prevent human error, and proper release, delivery and after-sales (8.5.1). Identify work in progress and its status; trace it where traceability is required (8.5.2). Look after customer and supplier property, including data, and tell the owner if anything goes wrong (8.5.3). Protect products and outputs through handling, storage, packaging and transport (8.5.4). Meet your after-delivery obligations (8.5.5). Control changes to how work is done, with records (8.5.6).
Check products and services against the acceptance criteria before release, hold them until the checks are done unless someone with authority approves release, and record what passed and who released it (8.6). When something turns out wrong, identify and control it so it is not used or delivered by mistake; correct it, separate it, inform the customer or get approval to use it as is, as appropriate; re-check after correction; and record what happened, what you did, any concession and who decided (8.7).
Clause 9: check whether it is working
Decide what to monitor and measure, how, when, and when to analyse the results; evaluate how the whole system performs; keep the results (9.1.1). Monitor how satisfied customers are and decide how you gather and review that information (9.1.2). Analyse the data to learn from it: whether products and services conform, how satisfied customers are, how the system performs, whether plans were carried out effectively, whether the actions you took on risks worked, whether, separately in 2026, the actions you took on opportunities delivered, how suppliers perform, and where the system needs improving (9.1.3 a) to h)).
Audit your own system at planned intervals to check it conforms to your requirements and the standard and works in practice; run it through a programme that sets frequency, methods, responsibilities, planning and reporting and gives more attention to important processes, past problems and recent changes; define objectives, criteria and scope for each audit; use auditors who do not audit their own work; report to the managers responsible; fix findings without undue delay; keep the records (9.2).
Top management reviews the system at planned intervals to confirm it is still suitable, adequate, effective and aligned with where the business is going (9.3.1). The review covers the actions from last time; changes outside and inside; changes, new in 2026 as a separate item, in what customers, regulators, staff, suppliers and others expect; performance trends in nonconformities and corrective actions, monitoring and measurement, audits, customer satisfaction and stakeholder feedback, objectives, process and product performance and suppliers; improvement opportunities; whether resources are adequate; whether the actions on risks worked; and, separately, whether the actions on opportunities delivered (9.3.2 a) to h)). It ends with decisions on improvement, on changes to the system and on resources, and those decisions are recorded (9.3.3).
Clause 10: get better
Keep improving how well the system fits the business, whether it is sufficient and whether it delivers. Use the results of your analysis and of management review to find opportunities and act on them. Improvement covers processes as well as products and services (explicit in 2026), addresses future needs and expectations as well as current ones (explicit in 2026), and corrects, prevents or reduces things that go wrong (10.1 a) to c)). The 2015 sub-clause 10.3 no longer exists; its content is here.
When something goes wrong, react: control and correct it and deal with the consequences. Then decide whether it needs deeper action so it does not happen again, by reviewing it, finding the cause and checking whether the same thing exists or could happen elsewhere. Do what you decided, check later whether it worked, update your risks and opportunities if needed, and change the system if needed. Match the effort to the seriousness of the problem. Customer complaints are one source of these problems (10.2.1). Record what went wrong, what you did and whether it worked (10.2.2).
What this means for a business that is new to ISO 9001
Most of Clauses 7 and 8 describe things a competent business already does; the work is to make them consistent and to keep the proof. Clauses 4, 5, 6, 9 and 10 are where organisations that have never had a system tend to have gaps: a written view of the context and stakeholders, leadership that is visibly engaged, risks and opportunities actually analysed, objectives that are measured, internal audits, a management review that produces decisions, and a habit of corrective action that finds causes. The 2026 additions sit in those clauses too, which is why an organisation implementing for the first time should build to the 2026 edition from the start rather than to 2015 and transition later.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Get a plain-English gap analysis for your organisation
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
How many requirements does ISO 9001:2026 have? The requirements are in Clauses 4 to 10. Counted at the level of individual “shall” statements and list items, there are several hundred. The number that changed from 2015 is small: seven new list items, one new sub-clause (6.1.3) and about a dozen strengthened wordings.
Is ISO 9001:2026 harder than ISO 9001:2015? Not in volume. It is harder in one respect: the requirements on quality culture and ethical behaviour, opportunity-based thinking and the policy’s link to strategy are tested by interviewing leaders and staff, not by reading documents.
Does a small business need all of this? Yes, apart from any requirement that genuinely does not apply (typically design). The standard is written to be applied proportionately: the extent of documentation, the depth of risk analysis and the size of the management review all scale with the organisation (7.5.1 NOTE, 6.1.2, Annex A).
Do we need a consultant to implement ISO 9001:2026? No. Many organisations implement with their own staff using the standard and guidance such as ISO 9002. A consultant saves time and prevents over-documentation; the certificate is the same either way, provided the certification body is accredited.
Where do we start? With Clause 4: write down your situation, your stakeholders, your scope and your processes. Everything else hangs off those four items.
Is there a checklist in plain language? Yes, for the requirements that changed: the free online ISO 9001:2026 gap check asks twenty plain-language questions with the clause reference for each and scores the answers into a readiness report; the quick checklist (PDF) with the same twenty questions comes with it. This page covers every requirement in Clauses 4 to 10 in plain language.
Read next
The plain-language checklist download; the clause-by-clause register of changes; the documented information list; the ISO 9001:2026 playbook; how to get ISO certification in the Philippines; and ISO 9001 certification in the Philippines from Sterling.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026), Introduction and Clauses 1 to 10. ISO 9002, Quality management systems — Guidelines for the application of ISO 9001 (Bibliography reference). The wording above paraphrases the requirements for a business reader; the standard’s text governs.
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.
