Transition to ISO 9001:2026: gap analysis, action plan, transition audit

16 modules · about 87 minutes · final test with 47 questions, 38 correct to pass · certificate of participation as PDF

What this course is about

On 16 September 2026 ISO 9001:2026 was published – the first revision since 2015. Under the transition rules of Global ACI, certified companies have three years (until 30 September 2029) to convert their system; from 31 March 2028 new and initial certifications under accreditation are issued only to the 2026 edition.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 16

Timeline and deadlines: publication, transition period, transition audit — and the deadline trap

ISO 9001:2026 was published internationally on 16 September 2026. National adoptions (such as EN ISO 9001:2026 in Europe) follow in the months afterwards. For certified companies the transition period applies that Global ACI (Global Accreditation Cooperation, since 2026 the successor of IAF and ILAC) laid down in the document Global ACI-TECH-3-TR 2029-09-30 (M) (version 1.1 of 4 September 2026): three years. From 31 March 2028 new and initial certifications under accreditation are issued only to ISO 9001:2026; by 30 September 2029 companies certified to 2015 must have made the transition. Accredited bodies certify to 2026 only after their accreditation decision (at the latest 30 September 2027). The date of your transition audit is set by your certification body; non-accredited bodies set their own dates.

Recommendation of the Academy: recertifications from 2027 are carried out to ISO 9001:2026. At QM-Dienstleistungen Holger Grosser and OnlineCert this is binding from 1 January 2027. The Global ACI rules above remain the frame: accredited bodies can recertify to 2026 as soon as their accreditation decision is in place — ask there early from when.

The transition takes place in the regular audit. No additional audit, no special date: at the next surveillance or recertification audit of your choice the auditor audits to 2026 instead of 2015 (a separate transition audit is also permissible, but not necessary). Global ACI does not prescribe a fixed time supplement; many bodies plan some extra time, often half a day. The certificate is rewritten to 2026 — with the old expiry date, because the cycle continues.

The deadline trap: whoever still recertifies to ISO 9001:2015 after 16 September 2026 receives a certificate that is not valid for three years but expires at the end of the transition period — and then has to make the transition in the running cycle, usually with an additional audit. Example: recertification in March 2027 at an accredited body that has no accreditation decision for 2026 yet, i.e. to 2015 → certificate valid only until 30 September 2029 instead of March 2030. Therefore: recertifications from 2027 are carried out to ISO 9001:2026. If the certificate at an accredited body expires before it may certify to 2026, the only option is recertification to 2015 with transition in the first surveillance audit; at QM-Dienstleistungen Holger Grosser and OnlineCert this case does not arise.

In parallel: ISO 14001:2026 was already published in April 2026 (transition under Global ACI until 30 April 2029). Whoever holds both standards makes the transition for both in the same audit — the new requirements (climate change, quality or environmental culture, risks and opportunities separated, planning of changes) are structured the same in both.

📄 Timeline of the transition in three variants by audit cycle, deadline trap, milestones with lead time (German – English version to follow)

Four dates for the calendar: date of the next audit · minus 8 weeks: implementation completed · minus 16 weeks: gap analysis and action plan finished · today: ask the certification body whether and how it will carry out the next audit to 2026 (many need a written registration of the transition).

Module 2 of 16

What stays, what changes: the revision at a glance — 90 percent stays

The 2026 edition is a maintenance revision, not a rebuild like 2015. The ten clauses stay, the process-oriented logic stays, the PDCA cycle stays, almost all terms stay. The basis is now the Harmonized Structure (the further developed Annex SL basic structure shared by all ISO management system standards) — which is why 9001:2026 and 14001:2026 look the same in the same places.

Unchanged: 5.2 policy (content), 5.3 roles, 7.1.5 measuring equipment, 7.2 competence, 7.4 communication, 8.1, 8.3 design, 8.4 suppliers, 8.5 production and service provision, 8.6 release, 8.7 nonconforming outputs, 9.1.1/9.1.2 KPIs and customer satisfaction, clause 10 improvement in content (in the structure 10.3 “continual improvement” has merged into 10.1; there are only 10.1 and 10.2 now). These are the processes with which your company earns money — they stay as they are.

📄 Gap checklist: all changed sub-clauses with requirement 2015 → 2026, location in your own system, rating (fulfilled / adapt / new), action, responsible, date, traffic light (German – English version to follow)

Effort: a small company with a working system needs one working day for gap analysis, text changes and a meeting with management; plus 20 minutes of briefing per employee. Whoever rewrites the manual has not read the revision.

Module 3 of 16

4.1 and 4.2: climate change in the context and the requirements of interested parties

4.1 Climate change: since February 2024 (amendment) the same sentence stands in every ISO management system standard: The organization shall determine whether climate change is a relevant issue. In 2026 it is firmly integrated. What is required is a reasoned decision — yes or no, with one sentence why. No climate programme, no carbon footprint, no environmental policy.

Both answers conform to the standard. The auditor asks for the reasoning, not for the answer.

4.2 Interested parties: new is the three-step: (a) determine the parties, (b) determine their relevant requirements, (c) define which of these requirements the QMS addresses — and monitor changes. In practice the table of interested parties gets a column “Addressed in the QMS by” (process, document) and a column “Reviewed on”.

Text module for the context table (small company, example service provider):

Climate change (4.1): following review in the meeting of [date], climate change is currently not relevant for the quality of our services; no climate-related influences on our processes or customer requirements are identifiable. The assessment is reviewed annually in the management review.

Interested parties (4.2): the relevant requirements and their assignment to processes are in the table “Interested parties” (manual ch. 1). Changes are evaluated in the management review (ch. 9.3.2).

📄 Text modules for every new requirement (4.1, 4.2, 5.1.1, 6.1, 6.3, 7.1.3, 7.1.4, 7.3, 7.5, 8.2.1, 9.1.3, 9.2.2, 9.3.2) to insert into the manual — each with a short version for companies under 10 employees (German – English version to follow)

Module 4 of 16

5.1.1 and 7.3: quality culture, integrity and ethical behaviour — what management must demonstrate

The most striking new feature: top management must promote a quality culture, including integrity and ethical behaviour, and lead by example in risk- and opportunity-based thinking. Annex A explains: quality culture shows in how quality is talked about in the company, how errors are handled and how decisions are made — not in a document.

What the auditor can make verifiable (and what he will ask about):

The ethics and quality culture check (download) has twelve questions in four groups — errors, customers, integrity, role model — with three levels each (practised and verifiable / practised, no evidence / not regulated). Below 18 of 24 points: a manual paragraph and a briefing are not enough; first define rules.

Text module for the manual (5.1.1):

Management promotes a quality culture in which errors are reported openly and treated as an occasion for improvement, customers are informed in good time and honestly, and integrity applies in dealings with customers, suppliers and colleagues. Rules: no blame for reported errors; customer information before the date in case of foreseeable delay; gifts and invitations above [amount] are reported to management; conflicts of interest in inspection and release are avoided by the four-eyes rule; the contact person for reports is [name/function]. Management discusses these points annually in the management review and in the briefing.

7.3 Awareness: employees must additionally know the importance of quality culture and ethical behaviour. In practice: extend the annual briefing by ten minutes (or use the free online briefing of the Academy — certificate of participation as evidence).

Not required: a code of ethics as a document, a compliance officer, a whistleblowing system (required by law only above a size threshold — in Germany 50 employees; check the law of your country), training certificates on ethics. Whoever offers that is selling something.

📄 Ethics and quality culture check: twelve questions in four groups with levels, evidence column and evaluation (German – English version to follow)

Module 5 of 16

6.1: risks and opportunities separated — 6.1.2 and 6.1.3 with their own evaluation

In 2015 risks and opportunities stood in one sentence, and most companies treated opportunities as a by-product of the risk table (“risk: supplier fails — opportunity: second supplier”). In 2026 opportunities get their own sub-clause 6.1.3 with their own evaluation and their own actions, and effectiveness is evaluated separately in 9.1.3 and 9.3.2.

Transition without rebuilding: the existing risk and opportunity table (course 3) gets a second sheet “Opportunities” with the columns opportunity · source (context, party, objective) · benefit (1–3) · achievability (1–3) · product · decision (pursue / examine / defer) · action · responsible · date · effectiveness. The opportunities that so far stood as counterparts to risks are transferred; three to six lines are enough. Opportunities with a product of 6 or 9 become objectives (6.2) or projects.

Text module for the manual (6.1):

Risks (6.1.2) and opportunities (6.1.3) are kept separately in the risk and opportunity analysis. Risks are evaluated by probability and impact (traffic light), opportunities by benefit and achievability; for both, actions with a responsible person and date are defined. The effectiveness of the actions is evaluated separately in the management review.

📄 Opportunities table under 6.1.3 with evaluation benefit × achievability, decision field, actions and effectiveness — as a supplementary sheet to the risk analysis, with four examples (German – English version to follow)

Module 6 of 16

6.2 and 6.3: quality objectives “where practicable” and the planning of changes with seven points

6.2 Quality objectives: objectives must be measurable “where practicable” — otherwise it must be possible to evaluate whether they have been achieved. That is a relief for service providers with qualitative objectives (“improve consulting quality”), but no invitation to vagueness: the auditor then asks “How will you recognise at year end that you have achieved it?” Whoever has a KPI keeps it. Whoever has none writes a criterion (“feedback of the three largest customers in the annual meeting at least ‘good’”).

6.3 Planning of changes: so far four points, now seven. The three new ones are in bold.

What a change under 6.3 is (and needs a change sheet): new software for order processing, new site or relocation, change in a key role (foreman, quality manager, accounting), new product or new service, outsourcing of a process, change of certification body — and the transition to ISO 9001:2026 itself. The first completed change sheet of the course is therefore the transition: purpose (keep the certificate, 2026 requirements), affected (manual ch. 1, 2, 4, 5, 7; risk analysis; management review; audit plan), resources (one day quality manager, two hours MD, 20 minutes per employee), communication (team, certification body), effectiveness (transition audit without nonconformity on 2026 points), review (management review after the audit).

Not under 6.3: everyday changes — new price list, new supplier of a B class, holiday cover, software update. The boundary: does it affect how a process runs or who is responsible for it? Then 6.3.

📄 Change sheet under 6.3 with seven points, completed for the example “Transition to ISO 9001:2026” and as a blank form (German – English version to follow)

Module 7 of 16

7.1.3, 7.1.4 and 7.5: infrastructure for hybrid work, psychological factors, “available as documented information”

7.1.3 Infrastructure now states explicitly that the infrastructure for on-site, remote and hybrid work must be determined and provided: equipment, connections, access to documents and data, data security. For a craft business without home office nothing changes — it writes one sentence that all activities take place on the premises or on sites and that the infrastructure for this is in the maintenance list. For a service provider with home office it means: who works where with which device, how does he get to the manual, templates and customer data, how is data secured (VPN, cloud with access rights, backup).

7.1.4 Work environment mentions in the note, besides physical factors, social and psychological factors — that was already there in 2015; new is the note that quality culture and ethical behaviour influence these factors. In the home office that means: workload, availability, isolation, tone. This coincides with the occupational risk assessment of psychological strain that every company must have anyway under the occupational safety law of its country (in Germany § 5 ArbSchG). The evidence is the same risk assessment plus a reference in the manual. Nobody has to measure a working climate.

7.5 Documented information: the distinction between “maintain” (specifications) and “retain” (records) is unified in wording: information must be “available as documented information”. In content nothing changes — specification documents are maintained, records are retained. New are notes on digital media: access rights, versioning, backup, legibility over the retention period. Whoever has the manual in the cloud writes three sentences on it.

Text modules:

Infrastructure (7.1.3): our activities take place [on the premises / on the premises and on sites / on the premises and in the home office]. For the home office the company provides a notebook, VPN access and access to [cloud storage]; the rules are in the home-office agreement. Infrastructure and maintenance: maintenance list.

Work environment (7.1.4): physical, social and psychological factors are evaluated in the occupational risk assessment (last on [date]); availability rules for the home office: [core time].

Documented information (7.5): specification documents and records are available as documented information in [storage]; access by role, versioning by status date in the file name, daily backup, retention according to the retention list (manual ch. 7).

Hybrid check (six questions) for service providers: does every home-office employee have a company device? · Does he get to the current version of manual and templates? · Is customer data reachable only via secured access? · Is there an availability rule? · Has the risk assessment been extended to the home office? · Does the employee know whom to turn to in case of overload?

Module 8 of 16

8.2.1: informing customers about disruptions, interruptions and delivery problems

8.2.1 Communication with the customer gets one more item: the company must define how customers are informed about disruptions, interruptions and problems in service provision. This is the operational side of the quality culture from 5.1.1 — the auditor will check both together: “Take your last delivery delay. When did the customer learn of it — before or after the date?”

The rule for the order process (one line in the process sheet, step “execution”):

As soon as it is foreseeable that a confirmed date, scope or price cannot be kept (material shortage, illness, disruption), the person responsible for the order informs the customer before the date in writing (e-mail) with reason, new date and contact person; the note goes into the order file (tab 2). In case of disruptions in ongoing operations (IT failure, supply interruption) management informs affected customers the same day.

Three text modules for the customer e-mail: (1) “We regret to inform you that … Reason: … New date: … Your contact person: …” (2) “During final inspection we found that … We propose: …” (3) “Since … o'clock … has been disrupted. We are working on the fix; next information at … o'clock.” — All three are in the text modules (download 03).

For the auditor the finding in the file counts: an e-mail before the date is the evidence. If it is missing although the delay is visible on the invoice, there is a finding on 8.2.1 and a question on 5.1.1.

Module 9 of 16

9.1.3, 9.2.2 and 9.3.2: evaluating effectiveness separately, audit objectives per audit, new inputs to the management review

Three small changes that together are an hour of work — if management review and audit programme are built on the pattern of the series.

9.1.3 Analysis and evaluation: the effectiveness of actions on risks and on opportunities is evaluated separately (consequence of 6.1.2/6.1.3). In practice: in the risk and opportunity analysis each sheet gets a column “effectiveness”, and in the management review there is one paragraph each.

9.2.2 Audit programme: for every internal audit audit objectives are to be defined — not only criteria (the standard) and scope (the processes), but: What do we want to find out with this audit? Examples the auditor likes to see:

9.3.2 Inputs to the management review: new as an input: changes in the needs and expectations of interested parties (so far only “changes in external and internal issues”), effectiveness of actions on risks and opportunities separately, and — sensible, though not literally required — a paragraph on quality culture (5.1.1). In the ten-chapter template of the series that means:

📄 Adaptation sheet: changed chapters of the management review template, audit plan line “audit objective” with ten examples, effectiveness columns for risks and opportunities (German – English version to follow)

The most frequent mistake: writing the management review of the transition year in the old structure and saying at the transition audit “we'll do that next year”. The auditor audits to 2026 — the review before the audit must have the new inputs, even if the system has only been converted for two months.

Module 10 of 16

Step 1 — the gap analysis: clause by clause against your own system, in three hours

The gap analysis is a table with 14 rows — one sub-clause per row — and six columns. With the manual and the annual folder on the table it takes three hours (quality manager, plus one hour of management for 5.1.1 and 4.1).

Have ready: manual with context table and table of interested parties · risk and opportunity analysis · last management review · audit programme and last audit plan · briefing record · process sheet order processing · occupational risk assessment · home-office rule (if any).

Rating rules per row:

Typical results (from transition projects, small companies with a working system):

The four points almost everyone does anew: 5.1.1 (quality culture paragraph with rules), 8.2.1 (disruption rule), 9.2.2 (audit objectives), 6.1.3 (opportunities sheet). Everything else is wording.

The result of the gap analysis is the completed checklist with traffic light — it is filed in the annual folder as evidence of the transition (the auditor asks for it first in the transition audit) and is at the same time the action plan (step 2).

Module 11 of 16

Step 2 — the action plan: traffic light, timeline, responsible persons — and implementation in one day

Every yellow and red row of the gap checklist becomes a row in the action plan: action · responsible · date · status (traffic light) · evidence. Red rows (new) first, because they need a decision of management (rules on gifts, disruption information) — without it the quality manager cannot write.

The transition day (quality manager, management present for two hours):

Afterwards until the audit — let evidence come into being (at least eight weeks of lead time):

• Carry out the briefing, list of participants (7.3)
• First customer information before the date under the new rule in an order file (8.2.1)
• First error report from the team without blame documented (5.1.1)
• Carry out the internal audit with the audit objective “2026 requirements” (9.2.2) — before the transition audit
• Management review in the new structure (9.3.2) — before the transition audit
• Opportunities sheet with at least one evaluated action (6.1.3)

📄 Transition action plan with all 14 sub-clauses pre-filled, traffic light by status, due-date colour, responsible/date/evidence, sheet “transition day” as a schedule (German – English version to follow)

Status note: every changed document gets the new status in the file name and in the footer; the handover sheet lists the changes with the reason “Transition ISO 9001:2026”. The auditor sees at a glance what has changed — and does not have to read the whole manual again.

Module 12 of 16

Step 3 — the transition audit: procedure, extra time, the auditor's twelve questions, certificate

Registration: most certification bodies want the transition registered in writing before the audit (form or e-mail) so that they can plan extra time and qualify the auditor for 2026. Rule of thumb: register three months before the audit. Some bodies offer a voluntary preliminary document review — rarely necessary for small companies.

Procedure: the transition audit is the normal surveillance or recertification audit with an additional block “transition” (often half a day). The auditor wants to see three things first: the gap analysis (checklist with traffic light), the change list/handover sheet and the minutes of decisions of management. Then he checks the 2026 points on real cases — by the familiar method “Take your last …”.

Findings on the transition are classified like all others: if a rule is missing entirely (no opportunities sheet, no disruption rule) → minor nonconformity, in recertification with several missing points also a major nonconformity. If only the evidence from practice is missing because the system was converted only six weeks ago → usually an observation (“check effectiveness in the next audit”). Therefore: eight weeks of lead time, so that at least one real case exists per new rule.

The certificate is rewritten to “ISO 9001:2026” (with the national designation where applicable); the expiry date stays (the cycle continues). Only at the next recertification does a new three-year cycle begin. Check on receipt: standard reference 2026, scope unchanged, expiry date as before.

Initial certification from 2027: build to 2026 right away — stage 1 then also checks the 2026 points. Whoever built his system with the courses of the series adds the text modules of this course and is done.

📄 The auditor's twelve questions in the transition audit with evidence, location and who answers — as a preparation sheet to fill in (German – English version to follow)

Module 13 of 16

Costs of the transition and funding: own effort, external support, public funding programmes

The costs of the transition for a small company with a working system:

Support by the course author (QM-Dienstleistungen, as of September 2026): fixed price by number of employees (1–10, 11–30, over 30 employees) — current prices at qm-guru.de. Other consultants typically charge two to five times as much for small companies — compare fixed prices with a description of services.

Public funding for consulting: many countries fund business consulting for small and medium-sized companies through public programmes; the transition counts as general management consulting. Check the programme of your country or region before signing a contract — most programmes require the application before the contract.

Example Germany — BAFA “Förderung unternehmerischen Know-hows”: funding rate 50 % of the consulting costs (western federal states, assessment base capped), 80 % in the eastern federal states and the regions of Lüneburg and Trier. Conditions: application before signing the contract via the BAFA portal, consulting by a consultant listed with BAFA, consulting report and proof of use after completion. The guideline was extended to 31 December 2028 in October 2026; for applications from 1 January 2027 the procedure changes (portal access only via a national e-ID account, declarations in the proof of use, turnover statement as proof of payment). Funding rates and quotas remain. Step by step: course “BAFA funding for QM consulting” in the Academy (German).

Worked example (Germany, western federal states, 12 employees): support plus funding service = consulting costs; BAFA 50 % → the company pays half. Eastern federal states: 80 % → the company pays one fifth.

Not fundable (typical for most programmes): certification fees and audit time, purchase of the standard, software, training (other funding programme), consulting by your own certification body (incompatible under ISO/IEC 17021-1).

Module 14 of 16

Practice case: Nordlicht IT Service — gap analysis and text modules for a hybrid service provider

Nordlicht IT Service (fictitious; similarities with existing companies are coincidental) in Flensburg, Germany, looks after small companies with IT support, cloud set-up and maintenance contracts. 9 employees: managing director (also sales and quality manager), 5 technicians (lead technician and two teams; 4 of them mostly in the home office with customer visits on site), 1 hotline, 1 administration, 1 apprentice. Certified since 2023, next surveillance audit 12 May 2027, recertification 2029.

Current state (excerpts, complete in download 10):

Task (90 minutes):

1. Complete the gap checklist for Nordlicht (14 rows: fulfilled / adapt / new, location, action).
2. Name the red points and give a one-sentence reason for each.
3. Write three text modules for Nordlicht: 5.1.1 (quality culture with rules, reference to C-2026-04), 8.2.1 (disruption rule for cloud outages with times), 7.1.3/7.1.4 (home office).
4. Formulate the audit objective for the internal audit 2027.
5. Set the timeline up to 12 May 2027 (gap analysis, transition day, briefing, internal audit, management review, registration with the certification body).

📄 Nordlicht IT Service: current state of all eleven documents in excerpts, outage report 14 July 2026, complaint C-2026-04 — working basis for the gap analysis (German – English version to follow)

Model solution (download 11) — short version: red are 5.1.1, 8.2.1, 9.2.2 and 7.1.3 (home office is missing entirely, although four of nine work there); yellow 4.1 (reasoning missing), 4.2, 6.1.3, 6.3, 7.1.4, 7.3, 7.5, 9.1.3, 9.3.2; green 6.2. The outage of 14 July 2026 is the key: it provides the reason for the disruption rule (8.2.1), an example for the quality culture paragraph (5.1.1: “customers learn of outages from us, not the other way round”), an input for the management review — and an audit objective (“check whether the disruption rule has been kept for the outages since 01/2027”). Timeline: gap analysis by 15 December 2026, transition day 19 January 2027, briefing by 15 February, registration with the certification body 12 February, internal audit 17 March, management review 7 April, audit 12 May.

📄 Nordlicht: model solution — completed gap checklist with reasoning, three text modules, audit objective, timeline (German – English version to follow)

Learning point: the transition is not a paper project — at Nordlicht it turned a real weakness (customer information in case of outages) into a rule the company would have needed even without the standard. That is the yardstick for every row of the gap checklist: what changes for the customer?

Module 15 of 16

Evidence: the transition folder for the auditor and the transition readiness grid

The auditor in the transition audit has little extra time and a clear expectation: one tab in which everything on the transition lies. The transition folder (tab 0 or 6 in the annual folder):

📄 Transition readiness grid: 16 criteria with levels ready (2) / almost (1) / not yet (0), evaluation and thresholds for registration with the certification body (German – English version to follow)

Transition readiness grid (16 criteria, 32 points): below 22 points do not register the transition with the certification body yet; from 28 register. The four weightiest criteria: minutes of decisions of management in place · at least one practice evidence per new rule · internal audit with audit objective carried out · management review in the new structure before the audit.

After the audit remains: point 7 of the change sheet — the review after implementation: in the next management review a paragraph “Transition ISO 9001:2026 — retrospective”: what has proven itself (disruption rule, opportunities sheet), what was paper, what will be simplified. That is at the same time the evidence that 6.3 g) is practised.

Retention: transition folder at least until the next recertification to 2026 (i.e. one full cycle); audit report at least 3 years, certificate 10 years.

Calendar until the deadline: transition period until 30 September 2029 (Global ACI) — whoever is still certified to 2015 today enters three dates: registration with the certification body (three months before the audit), transition day (16 weeks before the audit), readiness grid (8 weeks before the audit).

Module 16 of 16

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

47 questions, one correct answer each. You need 38 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result