No dramatic announcements this week — but the calendar kept moving. ISO 9001:2026 is inside the final stretch before its expected September publication, the comment window on the ISO 45001 draft has passed its halfway mark, and the Philippine privacy regulator issued a warning that lands squarely on any organization running artificial intelligence through outside vendors. Here is what Philippine certificate holders and compliance teams should know.
ISO 9001:2026 — no ballot result announced yet; September still the target
Two and a half weeks after voting on the Final Draft International Standard closed on 9 July, ISO has not yet formally announced the result, and the official project page continues to show the revision in the approval stage with publication expected in September 2026. Nothing about the timetable has changed, and ISO 9001:2015 remains the only version an organization can be certified against today. For Philippine companies, August is the sensible preparation window: brief leadership on the expected changes — climate considerations, separate treatment of risks and opportunities, and new expectations on quality culture and ethical conduct — and schedule an early gap review so your transition can begin at the first audit after certification bodies are accredited for the new edition.
Outsourcing AI does not outsource accountability, warns the privacy regulator
In remarks reported on 23 July, Deputy Privacy Commissioner Jose Amelito Belarmino II warned that companies remain legally accountable under the Data Privacy Act when third-party AI systems process personal data on their behalf, urging organizations to understand their data flows before deployment and to integrate AI governance with privacy compliance rather than treating them as separate workstreams. The position builds on the National Privacy Commission’s standing guidelines on AI systems processing personal data (NPC Advisory No. 2024-04). For BPO and IT-BPM providers adopting AI in customer-facing operations, the message is clear: clients and the regulator will look through the vendor to the deploying organization — exactly the gap that management-system certifications such as ISO/IEC 27701:2025 for privacy and ISO/IEC 42001 for AI governance are designed to close.
ISO 45001 revision — the comment window is now more than half spent
The ballot on the Draft International Standard of the revised ISO 45001 passes its halfway point this week: it opened on 16 June and runs until 8 September 2026, according to ISO/TC 283, the committee revising the occupational health and safety standard, with publication expected in 2027. The draft points toward stronger requirements on worker well-being and psychosocial risk, hazard identification that reflects modern working arrangements, and closer control of externally provided products and services, as summarized in certification-body guidance. Organizations certified to ISO 45001:2018 need take no action yet — but safety teams with strong views on the draft’s direction should raise them through the Bureau of Philippine Standards while the window is open.
Transition deadlines at a glance
- ISO/IEC 27701:2025 (published 14 October 2025) — certified organizations must transition by 31 October 2028.
- ISO 14001:2026 (published April 2026) — transition ends 30 April 2029; certification bodies stop issuing ISO 14001:2015 certificates to new clients after 31 October 2027.
- ISO 9001:2026 — not yet published; publication expected September 2026, with a three-year transition anticipated to follow.
- ISO 45001 — revised edition expected 2027; the DIS ballot closes 8 September 2026.
- ISO 22000 — revised edition expected 2027.
We publish this roundup every Monday. For plain-English explainers, side-by-side comparisons and transition checklists written for Philippine organizations, visit our ISO standards revision hub.
