ISO 9001 requirements form the foundation of any quality management system. This guide covers every clause from 4 through 10, explaining what the standard demands, what evidence satisfies each requirement, and what the ISO 9001:2026 revision changes.
What Are the ISO 9001 Requirements?
ISO 9001 requirements are the mandatory clauses that an organization's quality management system must satisfy to achieve and maintain certification. The standard is organized into ten clauses, with Clauses 4 through 10 containing the actual requirements.
ISO 9001 uses the word "shall" to indicate requirements. Every "shall" statement is a requirement that auditors will verify during certification and surveillance audits.
Key Insight
ISO 9001:2026 Update:: The 2026 revision adds three new "shall" requirements: quality culture promotion (Clause 5.1.1), an opportunities register (Clause 6.1.3), and climate change consideration (Clause 4.1). All other requirements from ISO 9001:2015 remain in force.
Clause 4: Context of the Organization
Clause 4.1 — Understanding the Organization and Its Context
Organizations shall determine external and internal issues relevant to their purpose and that affect their ability to achieve the intended results of the QMS. ISO 9001:2026 explicitly adds climate change as an external issue that must be considered.
Evidence auditors check: SWOT analysis, PESTLE analysis, context register, management review records showing context issues are monitored.
Clause 4.2 — Understanding the Needs and Expectations of Interested Parties
Organizations shall determine relevant interested parties and their requirements. Interested parties include customers, regulatory bodies, suppliers, employees, and owners.
Evidence: Stakeholder register, customer requirements documentation, regulatory compliance records.
Clause 4.3 — Determining the Scope of the QMS
The scope shall be documented and available. It must state which products and services are covered and justify any exclusions from Clause 8.
Evidence: Scope statement in the quality manual or standalone document, justification for any exclusions.
Clause 4.4 — Quality Management System and Its Processes
Organizations shall establish, implement, maintain, and continually improve the QMS, including the processes needed and their interactions.
Evidence: Process map or turtle diagrams, documented process interactions, process performance metrics.
Clause 5: Leadership
Stay Current
ISO 9001:2026 publishes September 16, 2026. Get weekly briefings.
Clause 5.1 — Leadership and Commitment
Top management shall demonstrate leadership and commitment by taking accountability for the QMS, ensuring quality policy and objectives are established, and promoting a customer focus.
ISO 9001:2026 Clause 5.1.1 adds an explicit requirement for top management to promote quality culture and ethical behaviour throughout the organization.
Evidence: Management review minutes, quality policy signed by top management, evidence of leadership participation in QMS activities.
Clause 5.2 — Quality Policy
Top management shall establish, implement, and maintain a quality policy that is appropriate to the organization's purpose, provides a framework for quality objectives, and includes commitments to satisfy requirements and continually improve.
Evidence: Documented quality policy, evidence it has been communicated and is understood by personnel.
Clause 5.3 — Organizational Roles, Responsibilities, and Authorities
Top management shall ensure roles, responsibilities, and authorities are assigned, communicated, and understood.
Evidence: Organizational chart, job descriptions, documented responsibilities for QMS roles.
Clause 6: Planning
Clause 6.1 — Actions to Address Risks and Opportunities
Organizations shall determine risks and opportunities that need to be addressed. ISO 9001:2026 introduces a three-part structure: risks (6.1.1), opportunities (6.1.2), and a new opportunities register requirement (6.1.3).
Evidence: Risk register, opportunities register (new in 2026), documented actions taken to address significant risks.
Clause 6.2 — Quality Objectives and Planning to Achieve Them
Quality objectives shall be established at relevant functions and levels, be measurable, and be monitored. Plans to achieve objectives must include what will be done, resources required, responsible persons, completion dates, and how results will be evaluated.
Evidence: Quality objectives register, action plans, monitoring records showing progress.
Clause 6.3 — Planning of Changes
When changes to the QMS are needed, they shall be carried out in a planned manner, considering the purpose of the change, potential consequences, resource availability, and responsibility allocation.
Evidence: Change management records, documented change approvals.
Clause 7: Support
Clause 7.1 — Resources
Organizations shall determine and provide the resources needed for the QMS, including people, infrastructure, environment, monitoring and measuring resources, and organizational knowledge.
Evidence: Resource plans, equipment calibration records, maintenance records, knowledge management documentation.
Clause 7.2 — Competence
Organizations shall determine the competence required for persons doing work that affects QMS performance, ensure persons are competent, and retain documented information as evidence.
Evidence: Competence matrix, training records, effectiveness evaluation records, qualifications documentation.
Clause 7.3 — Awareness
Persons doing work under the organization's control shall be aware of the quality policy, relevant quality objectives, their contribution to QMS effectiveness, and the implications of not conforming.
Evidence: Training records, awareness communications, onboarding documentation.
Clause 7.4 — Communication
Organizations shall determine internal and external communications relevant to the QMS, including what to communicate, when, with whom, how, and who communicates.
Evidence: Communication plan, meeting records, customer communication logs.
Clause 7.5 — Documented Information
The QMS shall include documented information required by ISO 9001 and determined necessary by the organization. Organizations shall control documented information including creation, updating, and distribution.
Evidence: Document control procedure, document register, version-controlled documents, access control records.
Clause 8: Operation
Clause 8.1 — Operational Planning and Control
Organizations shall plan, implement, control, and maintain processes needed to meet product and service requirements. This includes establishing criteria for processes and acceptance of products and services.
Evidence: Work instructions, process procedures, acceptance criteria documentation.
Clause 8.2 — Requirements for Products and Services
Organizations shall communicate with customers, determine requirements for products and services, review requirements before committing to supply, and handle changes to requirements.
Evidence: Customer contracts, order review records, change management records.
Clause 8.3 — Design and Development
Where applicable, organizations shall plan and control the design and development of products and services. This clause can be excluded if the organization does not perform design and development.
Evidence: Design plans, design review records, verification and validation records, design outputs.
Clause 8.4 — Control of Externally Provided Processes, Products, and Services
Organizations shall ensure externally provided processes, products, and services conform to requirements. This includes supplier evaluation, selection, monitoring, and re-evaluation.
Evidence: Approved supplier list, supplier evaluation records, purchase orders with requirements, incoming inspection records.
Clause 8.5 — Production and Service Provision
Organizations shall implement production and service provision under controlled conditions, including availability of documented information, suitable monitoring and measuring resources, and implementation of actions to prevent human error.
Evidence: Work instructions, production records, equipment maintenance records, traceability records.
Clause 8.6 — Release of Products and Services
Organizations shall implement planned arrangements to verify that product and service requirements have been met before release. Documented information shall provide evidence of conformity and traceability to the authorizing person.
Evidence: Inspection records, test reports, release authorizations, certificates of conformance.
Clause 8.7 — Control of Nonconforming Outputs
Organizations shall ensure outputs that do not conform to requirements are identified and controlled to prevent unintended use or delivery. This includes documenting nonconformities, actions taken, concessions obtained, and identifying the authority deciding the action.
Evidence: Nonconformance reports, disposition records, concession approvals.
Clause 9: Performance Evaluation
Clause 9.1 — Monitoring, Measurement, Analysis, and Evaluation
Organizations shall determine what needs to be monitored and measured, the methods to be used, when analysis and evaluation shall be performed, and when results shall be reported.
Customer satisfaction shall be monitored. Organizations shall determine methods for obtaining, monitoring, and reviewing this information.
Evidence: KPI dashboards, customer satisfaction surveys, internal audit reports, process performance data.
Clause 9.2 — Internal Audit
Organizations shall conduct internal audits at planned intervals to provide information on whether the QMS conforms to requirements and is effectively implemented and maintained.
Evidence: Audit programme, audit plans, audit reports, corrective action records from audits.
Clause 9.3 — Management Review
Top management shall review the QMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with the strategic direction.
Management review inputs must include: status of actions from previous reviews, changes in external and internal issues, QMS performance information, resource adequacy, and opportunities for improvement.
Evidence: Management review agenda, meeting minutes, action items with owners and due dates.
Clause 10: Improvement
Clause 10.1 — General
Organizations shall determine and select opportunities for improvement and implement necessary actions to meet customer requirements and enhance customer satisfaction.
Clause 10.2 — Nonconformity and Corrective Action
When a nonconformity occurs, organizations shall react to it, evaluate the need for action to eliminate the cause, implement any action needed, review the effectiveness of corrective action, and update risks and opportunities if necessary.
Evidence: Corrective action register, root cause analysis records, effectiveness verification records.
Clause 10.3 — Continual Improvement
Organizations shall continually improve the suitability, adequacy, and effectiveness of the QMS. ISO 9001:2026 adds explicit requirements to consider analysis and evaluation results, management review outputs, and the results of audits when determining improvement needs.
Evidence: Improvement register, trend analysis, management review outputs showing improvement decisions.
ISO 9001 Requirements vs. ISO 9001:2026 Changes
| Clause | ISO 9001:2015 | ISO 9001:2026 Change |
|---|---|---|
| 4.1 | Context issues | + Climate change explicitly required |
| 5.1.1 | Leadership commitment | + Quality culture and ethical behaviour |
| 6.1.3 | Risks and opportunities | + Opportunities register (new clause) |
| All others | Unchanged | No new requirements |
The 2026 revision is deliberately minimal — three new requirements added to a framework that has proven effective for over 1 million certified organizations worldwide.
How to Demonstrate Compliance with ISO 9001 Requirements
For each clause, auditors look for three things:
- Documentation — evidence that the requirement has been planned and defined
- Implementation — evidence that the documented approach is being followed
- Effectiveness — evidence that the approach is achieving its intended results
The standard does not prescribe specific documents. Organizations have flexibility in how they demonstrate compliance, as long as they can provide objective evidence for each "shall" statement.
Frequently Asked Questions
What are the mandatory documents required by ISO 9001?
ISO 9001 requires documented information for: scope (4.3), quality policy (5.2), quality objectives (6.2), competence evidence (7.2), operational planning (8.1), customer requirements review (8.2.3), design outputs (8.3.5 if applicable), supplier evaluation (8.4.1), product/service release (8.6), nonconforming outputs (8.7), monitoring results (9.1), internal audit programme and results (9.2), and management review outputs (9.3).
How long does it take to implement ISO 9001 requirements?
For a small organization (under 50 employees), implementation typically takes 3–6 months. Medium organizations (50–500 employees) typically need 6–12 months. Large or complex organizations may need 12–24 months. The ISO 9001:2026 transition guideISO 9001:2026 transition guide/article/how-to-transition-iso-9001-2015-to-2026 provides a detailed implementation timeline.
Can any ISO 9001 requirements be excluded?
Only Clause 8.3 (Design and Development) can be excluded, and only when the organization does not perform design and development activities. All other clauses are mandatory. The scope statement must justify any exclusions.
What is the difference between ISO 9001 requirements and guidelines?
ISO 9001 uses "shall" for requirements (mandatory) and "should" for recommendations (optional but advisable). ISO 9004 provides guidance for sustained success but is not a certification standard. Only ISO 9001 is used for third-party certification.
Related Resources
- ISO 9001:2026 Key ChangesISO 9001:2026 Key Changes/article/iso-9001-2026-key-changes — the three new requirements explained
- ISO 9001:2026 Transition GuideISO 9001:2026 Transition Guide/article/how-to-transition-iso-9001-2015-to-2026 — step-by-step implementation
- ISO 9001:2026 Compliance ChecklistISO 9001:2026 Compliance Checklist/resources/compliance-checklist — clause-by-clause verification tool
- ISO 9001:2026 Gap Analysis TemplateISO 9001:2026 Gap Analysis Template/resources/gap-analysis-template — assess your current compliance
- ISO 9001 Certification ProcessISO 9001 Certification Process/article/iso-9001-certification-process-guide — from gap analysis to certificate
- ISO 9001 Audit ChecklistISO 9001 Audit Checklist/article/iso-9001-audit-checklist-2026 — internal audit preparation
- ISO 9001:2026 FAQISO 9001:2026 FAQ/article/iso-9001-2026-faq — 20 most important questions answered
- ISO.org ISO 9001 OverviewISO.org ISO 9001 Overviewhttps://www.iso.org/iso-9001-quality-management.html — official standard information