What is ISO 9001?
ISO 9001 is the international ISO standard that sets requirements for a quality management system (QMS), allowing an organisation to demonstrate that it consistently delivers products and services meeting customer and regulatory requirements and that it continually improves its processes. The standard is sector-independent and applies equally to a factory, a system integrator, a software company or a water utility. ISO 9001 certifies the management system, not the product. The current edition is ISO 9001:2026, published in September 2026 as the successor to ISO 9001:2015.
ISO 9001 = working on quality, improvement and customer satisfaction in a structured and demonstrable way.
🧠 Where does ISO 9001 come from and which edition applies?
ISO 9001 first appeared in 1987 and was based on the British standard BS 5750. It has been revised several times since. Subcommittee ISO/TC 176/SC 2 maintains the standard; in the Netherlands, NEN publishes it as NEN-EN-ISO 9001. With more than one million accredited certificates, ISO 9001 is the most widely used management system standard in the world.
| Edition | Main change |
|---|---|
| 1987 | First edition, with three variants: 9001, 9002 and 9003 |
| 1994 | Emphasis on preventive quality assurance instead of final inspection |
| 2000 | Three variants merged; process approach and continual improvement at the core |
| 2008 | Clarifications, no new requirements |
| 2015 | High Level Structure, risk-based thinking, no mandatory quality manual |
| 2015/Amd 1:2024 | Organisations must determine whether climate change is a relevant issue |
| 2026 | Quality culture and ethical behaviour, sharper clauses on risk and change |
The changes in the 2026 edition are deliberately limited. Top management must now explicitly promote a quality culture and ethical behaviour (5.1.1), and staff must be aware of it (7.3). Clause 6.1 is split into determining risks and opportunities, actions to address risks and actions to address opportunities. When planning changes (6.3), you must now also define how you will monitor effectiveness, communicate the change and review the result. Management review (9.3.2) now takes changing expectations of interested parties into account. Annex A provides more explanation, and Annex B has been removed.
🎯 Which principles and requirements does ISO 9001 contain?
ISO 9001 rests on seven quality management principles from ISO 9000: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management. The requirements are in clauses 4 to 10, which follow the common structure of ISO management system standards and the PDCA cycle, with leadership at the centre:
| Clause | Topic | PDCA | Example requirement |
|---|---|---|---|
| 4 | Context of the organisation | Input | Determine interested parties, scope and processes |
| 5 | Leadership | Centre | Quality policy, roles and responsibilities |
| 6 | Planning | Plan | Risks and opportunities, quality objectives, planning of changes |
| 7 | Support | Do | Resources, competence, measuring equipment, documented information |
| 8 | Operation | Do | Design, purchasing, production, traceability, nonconforming outputs |
| 9 | Performance evaluation | Check | Measurement, customer satisfaction, internal audit, management review |
| 10 | Improvement | Act | Nonconformities, corrective action, continual improvement |
Risk-based thinking runs through the whole standard. ISO 9001 does not prescribe a method, so a simple risk matrix is acceptable, but so is an FMEA or the approach of ISO 31000 and your wider risk management.
🏭 How does ISO 9001 affect the OT environment?
In a production environment, many ISO 9001 requirements land directly in OT: the systems that produce, measure and record provide the evidence for the auditor.
| Requirement (clause) | What the standard asks | How OT delivers it |
|---|---|---|
| Measuring resources (7.1.5) | Calibration or verification traceable to international or national standards | Calibration management for transmitters, scales and analysers |
| Documented information (7.5) | Controlled versions, protection against unintended change | Version control of PLC code, recipes and work instructions |
| Externally provided processes (8.4) | Control of external suppliers | Requirements for system integrators and OEMs, including supplier security |
| Identification and traceability (8.5.2) | Outputs identifiable and traceable | Batch and serial numbers via MES, LIMS or WMS |
| Control of changes (8.5.6) | Review and record changes to production | Change management for setpoints and software |
| Nonconforming outputs (8.7) | Identify and control rejects | Automatic hold of a batch after an out-of-spec measurement |
| Monitoring and analysis (9.1) | Analyse data to support decisions | SPC, OEE and trends from the historian |
| Corrective action (10.2) | Eliminate the cause | Root cause analysis after failures and complaints |
This makes the quality of your production data a quality requirement in its own right. If a historian has gaps, or an operator can overwrite measured values by hand, the record loses its value as evidence. In batch systems based on ISA-88, the electronic batch record is often the most important quality record.
🔗 How does ISO 9001 relate to other standards and regulations?
| Standard or regulation | Relationship with ISO 9001 |
|---|---|
| ISO 27001 | Information security; same structure, so easy to combine in one management system |
| ISO 14001 | Environmental management; often combined with ISO 9001 in an integrated system |
| ISO 45001 and ISO 50001 | Occupational health and safety and energy management with the same clause layout |
| GMP | Legally required for medicine manufacturing; ISO 9001 is voluntary, but document control overlaps heavily |
| GAMP and 21 CFR Part 11 | Validation of computerised systems and electronic records in pharma; stricter than ISO 9001 on data integrity |
| NIS2 | Concerns cybersecurity risk, not quality; a working ISO 9001 system does help with policy, audits and supplier management |
| IATF 16949, AS9100, ISO 22163 | Sector standards for automotive, aerospace and rail that build on ISO 9001 |
📄 How does ISO 9001 certification work?
ISO itself does not certify. A certification body performs the audit; in the Netherlands, the Dutch Accreditation Council (RvA) accredits those bodies against ISO/IEC 17021-1. A certificate without accreditation carries little weight with customers and in public tenders.
- Gap analysis - compare your existing processes with the requirements of ISO 9001:2026.
- Implementation - define scope, policy, objectives and processes, and document what is genuinely needed.
- Internal audit and management review - both must have taken place at least once.
- Stage 1 audit - the auditor reviews documentation and readiness.
- Stage 2 audit - the auditor tests how the system works in practice; the certificate follows.
- Surveillance - a surveillance audit in years 1 and 2, followed by recertification in year 3.
Transition to 2026: the transition period runs for three years, until 30 September 2029. From 31 March 2028, new clients can only be certified to ISO 9001:2026. Existing certificate holders transition during a regular audit or a separate transition audit.
❓ Frequently asked questions
Is ISO 9001 mandatory?
ISO 9001 is not a legal requirement in the Netherlands or the EU. Many customers, public procurers and supply chain partners do require the certificate, so in practice it is often a condition for doing business.
What is the current version of ISO 9001?
The current version is ISO 9001:2026, published in September 2026. Certificates to ISO 9001:2015 remain valid until 30 September 2029 at the latest. From 31 March 2028, new certificates are only issued against ISO 9001:2026.
How long is an ISO 9001 certificate valid?
An ISO 9001 certificate is valid for three years. During that period the certification body carries out an annual surveillance audit, and in the third year a recertification audit renews the certificate.
Does ISO 9001 certify product quality?
ISO 9001 certifies an organisation’s quality management system, not an individual product. Product conformity is covered by other rules, such as CE marking under the Machinery Directive, replaced by the Machinery Regulation from 20 January 2027.
What is the difference between ISO 9001 and ISO 27001?
ISO 9001 is about quality: meeting customer requirements and improving continually. ISO 27001 is about information security. Both use the same clause structure, which is why many organisations combine them in one integrated management system.
Is ISO 9001 related to OT security?
ISO 9001 sets no cybersecurity requirements, but it does require controlled changes, reliable records and supplier management. An unauthorised change to a PLC or a recipe is therefore also a quality problem. For the security controls themselves, use IEC 62443.
📌 In summary
ISO 9001 helps organisations work in a structured, reliable and customer-focused way, with demonstrable quality. In industrial environments, OT systems such as MES, LIMS and the historian provide the evidence: calibrated measurements, controlled changes and full traceability. ISO 9001:2026 adds quality culture and ethical behaviour, and existing certificates must transition before 30 September 2029.