ISO 9001: What It Is, What Changed in 2026 and How Certification Works

What is ISO 9001? It is the internationally recognized standard that describes how an organization sets up, runs and continually improves its quality management system (ISO 9001:2026). An ISO 9001 certificate is a management system certificate. The product still needs CE marking (European Commission, CE marking) or an EAC certificate or declaration, the conformity assessment used under Eurasian Economic Union technical regulations (EAEU decision on standard conformity assessment schemes).

The standard has just been revised. ISO 9001:2026 has been published, and companies certified to the 2015 edition have a set period to transition (Global ACI Publishes Transition Requirements for ISO 9001:2026).

What does the ISO 9001 quality management system cover, and who can use it?

ISO 9001 covers quality management and customer satisfaction. Any organization can apply it, whatever its size or sector. The fields it explicitly lists include manufacturing, services, healthcare, education, government and non-profit organizations.

Does it make sense for your business?

Whether ISO 9001 makes sense for your business depends more on your goal than on your sector. Any organization that wants to improve its quality management, meet customer and applicable statutory and regulatory requirements and increase customer satisfaction can use the standard. Certification bodies and other third parties use the same standard to assess whether an organization conforms.

Picture a company that makes metal parts and sells them to a buyer abroad. The buyer expects the same dimensions and the same delivery pattern in every shipment, plus records to trace any problem that comes up. The system ISO 9001 asks you to build aims at exactly that repeatability. You use the standard first to organize your own operations. When you want to prove your conformity to others, you go through an independent assessment.

How widespread is it?

ISO 9001 is the world's leading quality management standard, used by more than one million organizations according to ISO.

What did ISO 9001:2026 change, and how long do 2015 certificates stay valid?

ISO 9001:2026 was published in September 2026 as the sixth edition, replacing ISO 9001:2015 and its 2024 amendment (Amd 1). The new edition puts quality culture and leadership forward and treats risks and opportunities separately. Organizations certified to the 2015 edition have until 30 September 2029 to complete the transition. After that date, accredited 2015 certificates are no longer valid (ACI TECH-3-TR Transition Requirements for ISO 9001:2026).

What is different in the new edition?

The new edition focuses on clearer wording of the requirements and closer alignment with other ISO management system standards. A new Annex A explains key terms and the intent behind the requirements.

At clause level, the old risks-and-opportunities clause is split in two. Actions to address risk now sit in 6.1.2 and actions to address opportunities in 6.1.3. Clause 7.3 adds organizational quality culture and ethical behavior. Global ACI's transition document calls the changes minimal overall and expects most organizations to meet the new requirements with reasonable effort.

Transition timeline

If you plan to get your first certificate in spring 2028, the timeline makes the decision for you. No new 2015 certificates can be issued after 31 March 2028, so you need to build your system to the 2026 edition from the start.

If you already hold a 2015 certificate, you can transition during a scheduled surveillance audit (the interim audit held while the certificate is valid) or a recertification audit. A separate transition audit is another option. Which route suits you depends on your certification cycle, so ask your certification body for the details.

Is ISO 9001 certification mandatory? Certification vs accreditation

The standard itself does not make ISO 9001 certification mandatory. According to the International Organization for Standardization (ISO), organizations that implement the standard are free to choose whether to seek certification. Your customer or a tender you enter can still make the certificate a requirement (LRQA Kalite yönetim sistemleri için ISO 9001 belgelendirmesi). In certification, a body audits your system and issues your certificate. In accreditation, an independent body confirms that certification body's competence.

Who issues the certificate?

An accredited certification body issues the certificate, not ISO. A common misconception is that ISO issues it. ISO develops the standard. It does not certify, and it does not accredit certification bodies either. National accreditation bodies accredit them (How to verify an accredited certification).

The chain behind an accredited certificate looks like this:

• A certification body issues the certificate.

• An independent accreditation body, typically a government or semi-government organization, accredits that certification body.

• The International Accreditation Forum (IAF) assesses and recognizes the accreditation body (IAF CertSearch, General FAQ).

In Turkey, that link is TÜRKAK (Türk Akreditasyon Kurumu, the Turkish Accreditation Agency). Accredited certification bodies use the TÜRKAK accreditation mark to show that TÜRKAK has confirmed their competence (Türk Loydu, Yönetim Sistemleri Belgelendirmesi Belgelendirme Kuralları). You can see how we support certification on our ISO 9001 certification page, and find other management system standards in our certification services.

Why accreditation matters when you export

Buyers trust a certificate from an accredited body more, because accreditation independently confirms the certification body's competence. Accredited certificates are also generally more widely recognized and accepted than non-accredited ones.

If your buyer is in another country, the international link in the chain comes into play. The IAF Multilateral Recognition Arrangement (MLA) is the agreement that lets an accredited certificate be recognized in other countries. If the body that issued your certificate is accredited by an MLA signatory and the certificate's scope, meaning what it covers, falls within the MLA sub-scopes, it can be recognized in the worldwide IAF program (About the IAF MLA).

Signatory accreditation bodies are required to recognize certificates issued within the appropriate scope by bodies accredited by other signatories. That is why asking a certification body which accreditation body accredits it, and for which scope, matters as much as asking the price.

How to get ISO 9001 certified: steps, audit stages and surveillance

You get ISO 9001 certified by passing a two-stage audit run by a certification body. Stage 1 reviews the design and documentation of your system, and Stage 2 checks how it works in practice. The certificate is valid for 3 years. During that time you go through a surveillance audit at least once a calendar year, except in recertification years (ISO/IEC 17021-1 Q&A). The typical route:

1. Set up your system and complete an internal audit and a management review before the certification audit (İstanbul Sertifika Ofisi, ISO 9001 Kalite Yönetim Sistemi).

2. Stage 1 audit: the auditor reviews the design and documentation of your management system and plans the audit. In most cases this step is remote.

3. Stage 2 audit: the auditor assesses whether your quality management system is actually implemented and how effective it is. With no nonconformities (points where the auditor finds you do not meet the standard's requirements), you receive the certificate.

After certification: surveillance and renewal

After certification, surveillance audits are planned under clause 9.1.3.3 of ISO/IEC 17021-1. Under that clause, surveillance audits take place at least once a calendar year, except in recertification years. The first surveillance audit must fall no more than 12 months after the certification decision date. Recertification is planned in time for the certificate to be renewed before it expires.

How the process works when you work with us

An ISO 9001 project with Istanbul Certificate Office starts with understanding your company's activities and ends with certification:

1. Defining your organization and the scope of its activities

2. Assessing your current situation and processes

3. Planning the quality management system requirements

4. Creating or updating the necessary documentation

5. Putting the processes into practice and building up records

6. Internal audit and management review

7. Certification audit

8. Conformity assessment and certification

Istanbul Certificate Office has worked in international certification and conformity assessment since 2005 and has built its experience especially in product conformity processes for Russia and the Eurasian Economic Union (EAEU) markets (İstanbul Sertifika Ofisi, Hakkımızda).

How long does ISO 9001 certification take?

There is no single standard duration for ISO 9001 certification. The timeline depends on your organization's scope, how ready your documentation is and the certification body's processing times. An approximate process plan is drawn up at the quote stage, once your organization's details have been reviewed (İstanbul Sertifika Ofisi, Sıkça Sorulan Sorular).

The number of audit days is also calculated for each organization. Under IAF MD 5, audit time is based on the organization's effective number of personnel, which includes part-time staff and those working on shifts (IAS IAF MD 5:2019 Determination of Audit Time). The certification body starts from tables that give average audit days. It can reduce that time by no more than 30% of the table value. The same basis also applies to surveillance and recertification audits.

What determines the price of ISO 9001 certification?

The price of ISO 9001 certification comes from your scope, not from a fixed price list. For ISO work, the cost is shaped by your organization's scope, number of employees, locations and certification program. The number of employees also sets the audit time, because IAF MD 5 calculates audit days from the effective number of personnel. The scope is defined first so the price can be right. You can send these details through our quote page.

Can ISO 9001 replace CE marking or an EAC certificate for exports?

No. ISO 9001 does not replace CE marking or an EAC certificate. Türk Loydu's Management System Certification Rules (UBK-01) state plainly that system certification is not an indicator of product quality or conformity and relates only to the system it is based on. With CE marking, the manufacturer declares that the product meets the legal requirements. EAC schemes also require a separate certificate or declaration of conformity for the product.

CE: the product declaration for the European market

When you affix CE marking to a product, you declare that it meets all legal requirements for CE marking and can be sold throughout the European Economic Area (EEA). The same applies to a product you make in Turkey and sell in the EEA. The marking is compulsory for most products covered by the New Approach Directives, and putting it on other products is forbidden. CE marking does not mean the EU or any other authority has approved the product as safe, and it does not indicate where the product was made.

Where a management system certificate fits in EAC schemes

In the document that defines the standard conformity assessment schemes (О типовых схемах оценки соответствия, On Standard Conformity Assessment Schemes), a certified management system is a precondition in some schemes. For series production, certification scheme 2c and declaration scheme 6d require the manufacturer to have a management system that a certification body has certified and that is in use. In 6d, evidence is also gathered with the involvement of the system certification body and an accredited test laboratory.

If you run series production and choose route 2c, you, the manufacturer, are the applicant, and a product certificate is still issued. Your certified management system opens this route, but the need for a product certificate remains.

What the certificate does for you in export

ISO 9001's value in export shows up on the buyer's side. Many companies require suppliers to hold independent ISO 9001 certification before they can bid. Even where a contract does not require it, the certificate can put your bid ahead of uncertified competitors.

How ISO 9001 differs from ISO 14001, ISO 13485 and ISO 22000

ISO 9001 differs from ISO 14001, ISO 13485 and ISO 22000 in what it manages. ISO 9001 manages quality and can be used in any sector and at any size. ISO 14001 covers environmental management, and ISO 13485 is designed for the medical devices industry and focuses on regulatory compliance. ISO 22000 manages food safety (ISO 22000:2018).

Shared structure and integrated systems

ISO 9001, ISO 14001 and ISO 22000 share the same skeleton. ISO 9001 and ISO 14001 both follow Annex SL, the high-level structure that gives modern ISO management system standards a consistent, compatible layout. ISO 22000 follows the same High-Level Structure as ISO 9001, so you can plug it into the management processes you already run or use it on its own. For a company that already holds ISO 9001, a second standard extends the system you have instead of starting a new one.

If you export packaged food and need both ISO 9001 and ISO 22000, you can run the two standards as one integrated management system.

Sector schemes

If you are in the automotive, railway, aviation or defense supply chain, ISO 9001 is also used within sector schemes such as IATF 16949, ISO 22163 and AS/EN/JISQ/IA 91XX. If your customer works in one of these sectors, first ask which scheme it expects.

How do you check that a certificate is valid and accredited?

The quickest way to find out whether a management system certificate is valid and accredited is to search for it in IAF CertSearch. This is the International Accreditation Forum's global database, and it lists only accredited certificates. If the certificate you are looking for does not appear there, you can ask the certification body, the accreditation body or the IAF directly. National accreditation bodies also keep records.

Steps to verify your supplier's certificate

1. Create an account at www.iafcertsearch.org.

2. Type the company name or certificate number into the search bar.

3. On the certificate page, check the validity status, the standard, the scope, the certified locations, the body that issued the certificate and the body that accredited it.

4. Put an important supplier's certificate on your watch list. You get an alert if its status changes.

If you skip this check, you may choose a supplier on the strength of a fake or non-accredited certificate. According to IAF CertSearch, some companies falsely claim to hold accredited certification, present a non-accredited certificate as equivalent to an accredited one or show an expired certificate as still valid.

When is a certificate suspended?

A certificate can be suspended under the rules of the certification body that issued it, and those rules set out when and for how long. The certificate page in IAF CertSearch shows its current validity status.

Checklist before you start certification

Before you request a quote, answer these five questions:

1. Does your buyer expect only ISO 9001, or a sector scheme such as IATF 16949 or ISO 22163?

2. Does your product need a separate product certificate such as CE or EAC?

3. Which accreditation body accredited the certification body quoting you, and for which scope?

4. Are you building your system to ISO 9001:2026 from the start?

5. Are your quote details ready? A quote needs your field of activity, number of employees, certification scope, existing ISO certificates, the intended use of the certificate and any customer or tender requirements. Location details also go into the preliminary assessment.

Once you have the certificate, search for it in IAF CertSearch and check that the record appears.