At a glance
ISO 9001 requirements explained clause by clause. What each clause demands, what evidence auditors check, and what changes in the 2026 revision.
- Focus: ISO 9001 requirements · clause by clause
- Read time: 14 minutes
- Updated: August 10, 2026
ISO 9001 requirements are the QMS foundation. They cover Clauses 4 through 10. They explain the standard's demands and evidence needs. They note ISO 9001:2026 revision changes.
What Are the ISO 9001 Requirements?
ISO 9001 requirements are mandatory clauses. A QMS must meet them. This earns and keeps certification. The standard has ten clauses. Clauses 4 through 10 contain the requirements.
ISO 9001 uses "shall" for requirements. Auditors verify each "shall" in certification and surveillance audits.
Key Insight
ISO 9001:2026 Update:: ISO/FDIS 9001:2026 remains in pre-publication status. Public commentary covers quality culture, risks and opportunities, and climate-related context. The final published edition will set enforceable wording and clause requirements. Track status on ISO.orgISO.orghttps://www.iso.org/standard/88464.html.
Clause 4: Context of the Organization
Clause 4.1 — Understanding the Organization and Its Context
ISO 9001:2015 requires companies to identify external and internal issues. These must relate to their purpose. They must relate to intended QMS results. Public pre-publication commentary covers climate-related context. It applies to the forthcoming revision. Confirm final wording against the published edition.
Evidence auditors check: SWOT analysis, PESTLE analysis, context register, and management review records that show context issues are monitored.
Clause 4.2 — Understanding the Needs and Expectations of Interested Parties
Organizations shall identify relevant interested parties and their requirements. Examples include customers, regulators, suppliers, employees, and owners.
Evidence: Stakeholder register, customer requirements documentation, regulatory compliance records.
Clause 4.3 — Determining the Scope of the QMS
The scope shall be documented and readily available. It shall state the covered products and services. It shall justify any Clause 8 exclusions.
Evidence: Scope statement in the quality manual or standalone document, and justification for any exclusions.
Clause 4.4 — Quality Management System and Its Processes
Organizations shall establish, implement, maintain, and continually improve the QMS. This includes needed processes and their interactions.
Evidence: Process map or turtle diagrams, documented process interactions, process performance metrics.
Clause 5: Leadership
Stay Current
ISO expects the next edition in September 2026. Get source-checked weekly briefings.
Clause 5.1 — Leadership and Commitment
Top management shall show leadership and commitment through accountability for the QMS. They shall ensure the quality policy and objectives exist and promote customer focus.
ISO 9001:2026 Clause 5.1.1 adds a top management requirement. They must promote quality culture and ethical behaviour throughout the company.
Evidence: Management review minutes, quality policy signed by top management, and evidence of leadership participation in QMS activities.
Clause 5.2 — Quality Policy
Top management shall establish, implement, and maintain a quality policy appropriate to the organization's purpose. The policy must provide a framework for objectives and commit to meeting requirements and continual improvement.
Evidence: Documented quality policy, and evidence it has been communicated and is understood by personnel.
Clause 5.3 — Organizational Roles, Responsibilities, and Authorities
Top management shall ensure roles, responsibilities, and authorities are assigned, communicated, and understood.
Evidence: Organizational chart, job descriptions, documented responsibilities for QMS roles.
Clause 6: Planning
Clause 6.1 — Actions to Address Risks and Opportunities
Organizations shall identify risks and opportunities that need action. ISO 9001:2026 adds three parts: risks (6.1.1), opportunities (6.1.2), and a new opportunities register requirement (6.1.3).
Evidence: Risk register, opportunities register (new in 2026), and documented actions taken to address significant risks.
Clause 6.2 — Quality Objectives and Planning to Achieve Them
Quality objectives shall be established at relevant functions and levels. They shall be measurable and monitored. Plans must state actions, required resources, responsible persons, completion dates, and evaluation methods.
Evidence: Quality objectives register, action plans, monitoring records showing progress.
Clause 6.3 — Planning of Changes
When changes to the QMS are needed, they shall be carried out in a planned manner, considering the purpose, potential consequences, resource availability, and responsibilities.
Evidence: Change management records, documented change approvals.
Clause 7: Support
Clause 7.1 — Resources
Organizations shall determine the resources needed for the QMS. These include people, infrastructure, environment, monitoring and measuring resources, and organizational knowledge.
Evidence: Resource plans, equipment calibration records, maintenance records, knowledge management documentation.
Clause 7.2 — Competence
Organizations shall determine required competence for persons doing work affecting QMS performance. They shall ensure competence and keep documented information as evidence.
Evidence: Competence matrix, training records, effectiveness evaluation records, qualifications documentation.
Clause 7.3 — Awareness
Persons doing work under the organization's control shall be aware of the quality policy and relevant quality objectives. They shall know their contribution to QMS effectiveness and the implications of not conforming.
Evidence: Training records, awareness communications, onboarding documentation.
Clause 7.4 — Communication
Organizations shall determine internal and external communications relevant to the QMS. They must define what to communicate and when. They must define to whom, how, and who communicates.
Evidence: Communication plan, meeting records, customer communication logs.
Clause 7.5 — Documented Information
The QMS shall include documented information required by ISO 9001 and any information the organization deems necessary. Organizations shall control documented information, including creation, updating, and distribution.
Evidence: Document control procedure, document register, version-controlled documents, access control records.
Clause 8: Operation
Clause 8.1 — Operational Planning and Control
Organizations shall plan, implement, control, and maintain processes to meet product and service requirements. This includes setting process and acceptance criteria for products and services.
Evidence: Work instructions, process procedures, acceptance criteria documentation.
Clause 8.2 — Requirements for Products and Services
Organizations shall communicate with customers and determine product and service requirements. They shall review requirements before committing to supply and manage changes.
Evidence: Customer contracts, order review records, change management records.
Clause 8.3 — Design and Development
Where applicable, organizations shall plan and control design and development for products and services. This clause may be excluded when the company does not perform design and development.
Evidence: Design plans, design review records, verification and validation records, design outputs.
Clause 8.4 — Control of Externally Provided Processes, Products, and Services
Organizations shall ensure externally provided processes, products, and services meet requirements. This includes supplier evaluation, selection, monitoring, and periodic re-evaluation.
Evidence: Approved supplier list, supplier evaluation records, purchase orders with requirements, and incoming inspection records.
Clause 8.5 — Production and Service Provision
Organizations shall implement production and service provision under controlled conditions. Controls must include documented information, suitable monitoring and measuring resources, and actions to prevent human error.
Evidence: Work instructions, production records, equipment maintenance records, traceability records.
Clause 8.6 — Release of Products and Services
Organizations shall implement planned arrangements to verify product and service requirements before release. Documented information shall show conformity and traceability to the authorizing person.
Evidence: Inspection records, test reports, release authorizations, certificates of conformance.
Clause 8.7 — Control of Nonconforming Outputs
Organizations shall ensure nonconforming outputs are identified and controlled to prevent unintended use or delivery. This includes documenting nonconformities, actions taken, concessions obtained, and naming the deciding authority.
Evidence: Nonconformance reports, disposition records, concession approvals.
Clause 9: Performance Evaluation
Clause 9.1 — Monitoring, Measurement, Analysis, and Evaluation
Organizations shall determine what to monitor and measure. They shall define the methods to use. They shall set when to analyze, evaluate, and report results.
Customer satisfaction shall be monitored. Organizations shall determine methods to obtain, monitor, and review this information.
Evidence: KPI dashboards, customer satisfaction surveys, internal audit reports, process performance data.
Clause 9.2 — Internal Audit
Organizations shall conduct internal audits at planned intervals to determine whether the QMS conforms to requirements and is effectively implemented and maintained.
Evidence: Audit programme, audit plans, audit reports, corrective action records from audits.
Clause 9.3 — Management Review
Top management shall review the QMS at planned intervals. Reviews ensure continuing suitability, adequacy, effectiveness, and strategic alignment.
Management review inputs must include the status of actions from previous reviews and changes in external and internal issues. They must also include QMS performance information, resource adequacy, and improvement opportunities.
Evidence: Management review agenda, meeting minutes, and action items with owners and due dates.
Clause 10: Improvement
Clause 10.1 — General
Organizations shall determine and select opportunities for improvement. They shall implement actions to meet customer requirements and enhance customer satisfaction.
Clause 10.2 — Nonconformity and Corrective Action
When a nonconformity occurs, organizations shall react and evaluate the need for action to eliminate the cause. They shall implement needed actions, review effectiveness, and update risks and opportunities if needed.
Evidence: Corrective action register, root cause analysis records, effectiveness verification records.
Clause 10.3 — Continual Improvement
Organizations shall continually improve the suitability, adequacy, and effectiveness of the QMS. ISO 9001:2026 adds explicit requirements to consider analysis and evaluation results. It also requires considering management review outputs and audit results when determining improvements.
Evidence: Improvement register, trend analysis, management review outputs showing improvement decisions.
ISO 9001 Requirements vs. ISO 9001:2026 Changes
| Clause | ISO 9001:2015 | ISO 9001:2026 Change |
|---|---|---|
| 4.1 | Context issues | Public commentary discusses climate-related context; confirm final wording |
| 5.1.1 | Leadership commitment | Public commentary discusses quality culture and ethical behaviour; confirm final wording |
| 6.1.3 | Risks and opportunities | Public commentary discusses risk and opportunities; confirm final wording |
| Other clauses | ISO 9001:2015 baseline | Confirm changes against the published edition |
Public pre-publication commentary presents the 2026 revision as evolutionary. The final published edition will determine the requirements and wording. Use ISO’s Survey and IAF CertSearch, not static page copy. Use these for current certification statistics.
How to Demonstrate Compliance with ISO 9001 Requirements
For each clause, auditors look for three things:
- Documentation — evidence that the requirement has been planned and defined.
- Implementation — evidence that the documented approach is being followed.
- Effectiveness — evidence that the approach is achieving its intended results.
The standard does not prescribe specific documents. Companies may choose how to show compliance. They must supply objective evidence for each "shall" statement.
Frequently Asked Questions
What are the mandatory documents required by ISO 9001?
ISO 9001 requires documented information for: scope (4.3), quality policy (5.2), quality objectives (6.2), competence evidence (7.2), operational planning (8.1), customer requirements review (8.2.3), design outputs (8.3.5 if applicable), supplier evaluation (8.4.1), product/service release (8.6), nonconforming outputs (8.7), monitoring results (9.1), internal audit programme and results (9.2), and management review outputs (9.3).
How long does it take to implement ISO 9001 requirements?
Implementation time depends on company size, scope, and QMS maturity. It also depends on resources, regulated-sector requirements, and the certification route. Use a gap analysis to build a project plan. Use it to estimate audit days. The ISO 9001:2026 transition guideISO 9001:2026 transition guide/article/how-to-transition-iso-9001-2015-to-2026 provides a planning framework.
Can any ISO 9001 requirements be excluded?
Only Clause 8.3 (Design and Development) can be excluded. This is allowed only when the company does not perform design and development activities. All other clauses are mandatory. The scope statement must justify any exclusions.
What is the difference between ISO 9001 requirements and guidelines?
ISO 9001 uses "shall" for requirements (mandatory) and "should" for recommendations (optional but advisable). ISO 9004 offers guidance for sustained success but is not a certification standard. Only ISO 9001 is used for third-party certification.
Related Resources
- ISO 9001:2026 Key ChangesISO 9001:2026 Key Changes/article/iso-9001-2026-vs-2015-complete-comparison — reported revision themes and a final-text verification checklist.
- ISO 9001:2026 Transition GuideISO 9001:2026 Transition Guide/article/how-to-transition-iso-9001-2015-to-2026 — step-by-step implementation.
- ISO 9001:2026 Compliance ChecklistISO 9001:2026 Compliance Checklist/resources/compliance-checklist — clause-by-clause verification tool.
- ISO 9001:2026 Gap Analysis TemplateISO 9001:2026 Gap Analysis Template/resources/gap-analysis-template — assess your current compliance.
- ISO 9001 Certification ProcessISO 9001 Certification Process/article/iso-9001-certification-process-guide — from gap analysis to certificate.
- ISO 9001 Audit ChecklistISO 9001 Audit Checklist/article/iso-9001-audit-checklist-2026 — internal audit preparation.
- ISO 9001:2026 FAQISO 9001:2026 FAQ/article/iso-9001-2026-faq — 20 most important questions answered.
- ISO.org ISO 9001 OverviewISO.org ISO 9001 Overviewhttps://www.iso.org/iso-9001-quality-management.html — official standard information.