At a glance
- Purpose
- Deliver products and services that meet customer and legal requirements, time after time
- How it works
- Set processes, internal audits, management review, corrective action
- Governing standard
- ISO 9001:2026; in Germany DIN EN ISO 9001:2026-11; 2015 certificates end on 30 September 2029 (as of November 2026)
- Who is responsible
- Top management (clause 5)
- Who certifies
- Certification bodies; ISO does not certify
- Not to be confused with
- ISO 9000 (concepts and terms); a test of a single product
What does ISO 9001 mean, and who needs it?
An ISO 9001 quality management system is how you plan, run, check and improve the work that reaches your customers. ISO 9001 is one kind of management system standard. It fits any organization, whatever its size or sector.
ISO names supplier approval, public tenders and international partnerships as typical reasons to seek a certificate. You need the certificate when a customer contract or tender asks for it, so check those first.
Some sectors have their own version built on ISO 9001. Examples are ISO 13485 for medical devices, ISO 22163 for rail and ISO/IEC/IEEE 90003 for software.
In Germany, the name is DIN EN ISO 9001. Europe adopted the ISO text as EN ISO 9001, and DIN then adopted that. The content is identical. "DIN ISO 9001" is a common short form for the same document. The November 2026 German edition is DIN EN ISO 9001:2026-11.
What are the ISO 9001 requirements?
The ISO 9001 requirements sit in clauses 4 to 10. The records are our examples, not text from the standard.
| Clause | Topic | Example record |
|---|---|---|
| 4 Context | Internal and external factors, scope of the QMS | Scope statement with sites and services |
| 5 Leadership | Commitment from the top, quality policy | Signed quality policy |
| 6 Planning | Risks, opportunities, quality objectives, changes | Objective with a target, such as on-time delivery |
| 7 Support | Resources, competence, awareness, documented information | Training records |
| 8 Operation | Planning and control of the work that serves customers | Order and supplier records |
| 9 Performance evaluation | Monitoring, internal audit, management review | Audit report, review minutes |
| 10 Improvement | Nonconformities, corrective action | Corrective action log |
The seven principles from ISO 9000 stand behind these clauses: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management.
What changed from ISO 9001:2015 to ISO 9001:2026?
ISO 9001:2026 keeps the clause structure and updates selected requirements. ISO says organizations build on their existing system and make targeted changes where needed. If you already hold a certificate, review these points first:
- Leadership: quality culture and ethical behavior now get more weight.
- Risks and opportunities: actions on each now sit in separate subclauses.
- Changes to the QMS: you now also set how you will monitor a change's effectiveness, communicate it and review its results.
- Annex A: this informative annex now explains the intent of the requirements and key terms.
ISO 9001:2015 and DIN EN ISO 9001:2015 are withdrawn as standards. Certificates issued against them stay valid during the transition.
How do you get ISO 9001 certification?
You get ISO 9001 certification by building the system, then passing an audit by a certification body.
- Buy the standard and set the scope: which sites, products and services count.
- Build the system and run it, so that records exist.
- Run one internal audit and one management review. The certifier DQS reviews both results in stage 1.
- Compare certification bodies. According to DQS, audit days follow accreditation rules, so quotes from accredited bodies can be compared.
- Stage 1 audit: the auditor checks your documents and whether you are ready.
- Stage 2 audit: the auditor tests whether your processes work, on site or remotely.
- Keep it: the certificate lasts three years, with a surveillance audit each year and then recertification.
DQS puts the process at three to six months for mid-sized firms. The count starts once the system is fully in place.
Which edition should you certify to?
The transition requirements of Global ACI decide which edition to choose (as of November 2026). Global ACI is the international association of accreditation bodies. Its dates bind accreditation bodies such as DAkkS and the certification bodies they accredit.
| Your situation | What to do | Last date |
|---|---|---|
| You hold a 2015 certificate | Move at a surveillance audit, at recertification or in a separate transition audit | 30 September 2029 |
| First certificate, your body is accredited for 2026 | Certify to ISO 9001:2026 | Not applicable |
| First certificate, your body is not yet accredited for 2026 | Ask when it will be; if you cannot wait, certify to 2015 and plan the move | 31 March 2028 for a new 2015 certificate |
Accreditation bodies must be ready by 31 March 2027. Their decisions on certification bodies are due by 30 September 2027. Your body may not hold 2026 accreditation until then. A new 2015 certificate must be issued by 31 March 2028. Plan your stage 1 and stage 2 audits around that.
Fictional example, with invented figures: a machine builder with 120 staff plans its first audit for April 2027. A 2015 certificate issued then runs only to 30 September 2029, about 29 months, and needs a transition audit. A 2026 certificate runs the full 36 months and needs none. So the firm asks its body whether it will be accredited for the 2026 edition by April. If yes, it picks 2026. If no, and a tender needs the certificate by April, it picks 2015 and plans the move.
Does an ISO 9001 certificate prove product quality?
An ISO 9001 certificate covers the management system, not a single product. So read the scope printed on a supplier's certificate. It names the products, services and sites the audit covered.
Check who issued it as well. A certificate from an accredited body carries an extra check, because an accreditation body has assessed the certifier. In Germany that body is the DAkkS. Check the edition too. An accredited 2015 certificate is no longer valid after 30 September 2029, even if it shows a later expiry date.
ISO/IEC 27001 is a different standard, on information security. Both use the harmonized structure, which according to ISO makes them easier to integrate.
In Rizzqo
ISO 9001 in Rizzqo: process, systems, proof
ISO 9001 is supported in Rizzqo. You record a core process such as order handling and rate its confidentiality, integrity and availability. In asset management, you link it to the systems it depends on, such as the ERP system. Requirements attach to each relevant system. The right person implements a requirement and uploads evidence, such as an internal audit report. The ERP system then shows which of its requirements are met or still open. If ISO 14001 runs alongside, a requirement linked to controls of both takes one answer, and its evidence counts for both.