What Documents Does ISO 9001:2026 Require?

ISO 9001 has not required a fixed list of procedures since the 2008 edition. The 2026 edition, published on September 16, 2026, continues that approach. It requires specific documented information and leaves the rest to you.

That flexibility is useful, but it raises a fair question from quality managers: what do we actually have to have?

This post lists the documented information ISO 9001:2026 requires, grouped by clause, and then covers what is optional but useful.

Documents and records: the two kinds of documented information

ISO 9001 uses one term, documented information, for two different things:

• Documents you keep current. Policies, objectives, scope, procedures and work instructions. These are controlled: reviewed, approved, versioned and available where needed.

• Records you keep as evidence. Results of activities, such as audit reports, training records and inspection results. These are protected from unintended change and kept for a defined retention period.

The 2015 edition expressed this as "maintain" for documents and "retain" for records. The 2026 edition follows ISO's latest Harmonized Structure, and some published summaries report that this phrasing has been simplified in places. The practical split still applies, and your document control procedure should handle both.

A note on clause numbers: the references below are at the level used in both the 2015 and 2026 editions. Check sub-clause numbering against your licensed copy of ISO 9001:2026.

Documents to keep current

Clause 4: Context of the organization

• Scope of the QMS (4.3). State the products and services covered, and justify any requirement you determine does not apply.

• Information to support the operation of processes (4.4). The extent is up to you. This is where most organizations place procedures, process maps and work instructions.

Clause 5: Leadership

• Quality policy (5.2). Available, communicated and understood within the organization, and available to relevant interested parties as appropriate. Under the 2026 edition, check that the policy and leadership commitments reflect quality culture and ethical behavior.

Clause 6: Planning

• Quality objectives (6.2). Measurable, monitored and updated as appropriate.

Clause 8: Operation

• Operational planning and control (8.1). Documented information to the extent needed to have confidence that processes are carried out as planned and to show that products and services conform.

Records to keep as evidence

Clause 7: Support

• Monitoring and measuring resources (7.1.5). Evidence that equipment is fit for purpose, and the basis used for calibration or verification where no national or international standard exists.

• Competence (7.2). Evidence of the competence of people doing work that affects quality, such as training, education and experience records.

Clause 7.1.6 on organizational knowledge does not name a specific record. The 2026 edition does expect knowledge to be retained, applied and shared, which is hard to show without some form of documentation.

Clause 8: Operation

• Review of requirements (8.2.3). Results of the review of customer requirements and any new requirements.

• Design and development (8.3). Where design applies: planning evidence, inputs, controls (reviews, verification and validation), outputs and changes.

• Externally provided processes, products and services (8.4). Results of evaluation, selection, performance monitoring and re-evaluation of external providers, and any actions arising.

• Production and service provision (8.5). Characteristics of the products and services and the results to be achieved (8.5.1), traceability where it is a requirement (8.5.2), customer or external provider property that is lost, damaged or found unsuitable (8.5.3), and review of production or service changes (8.5.6).

• Release of products and services (8.6). Evidence of conformity with acceptance criteria and traceability to the person authorizing release.

• Nonconforming outputs (8.7). Description of the nonconformity, actions taken, concessions obtained and the authority deciding the action.

Clause 9: Performance evaluation

• Monitoring, measurement, analysis and evaluation (9.1). Evidence of the results.

• Internal audit (9.2). The audit program and audit results. Under the 2026 edition, each audit should have defined objectives in addition to scope and criteria, so your audit plans should record them.

• Management review (9.3). Results of management reviews. Check that inputs now include changes in the needs and expectations of interested parties.

Clause 10: Improvement

• Nonconformity and corrective action (10.2). The nature of nonconformities, actions taken and results of corrective action.

What is optional but useful

The standard does not require the items below, but most certified manufacturers keep them. They make the system easier to run, train on and audit.

Quality manual

Not required. A short manual gives staff and auditors a map of the system: scope, process interactions and where each clause is addressed. A clause cross-reference is especially helpful during an audit.

Core procedures

Even without a mandate, written procedures reduce variation. Most manufacturers document at least:

• Document and record control

• Training and competence

• Contract review

• Purchasing and supplier management

• Receiving and inspection

• Calibration

• Control of nonconforming product

• Corrective action

• Internal audit

• Management review

Risk and opportunity register

Clause 6.1 does not require a documented risk register. The 2026 edition separates risks from opportunities and expects them to be determined, analyzed and evaluated. A register with evaluation criteria is the simplest way to show that.

Change control form

Clause 6.3 now asks you to consider how a change will be communicated, monitored for effectiveness and reviewed. A change control form with those fields gives you evidence without extra effort.

Context and interested parties analysis

Not explicitly required, but auditors will ask how you determined internal and external issues, whether climate change is relevant, and which interested party requirements the QMS addresses. A short worksheet answers those questions.

Forms and templates

Standard forms make records consistent: training records, supplier evaluations, inspection reports, nonconformance reports, corrective action forms, audit checklists and management review minutes.

Keep it proportionate

The right amount of documentation depends on your size, the complexity of your processes and the competence of your people. A ten-person machine shop and a multi-site manufacturer will not need the same set.

Document what you need for consistency and evidence, and no more. Every document you add is one you must keep current.

Get the documents in place

A.P. Lyon's ISO 9001 QMS packages are current to ISO 9001:2026 and include a quality manual structured on clauses 4 to 10, a master list with a clause cross-reference, editable procedures and form templates. Base ($595) has 20 procedures, Standard ($995) has 38 and Complete ($1,295) has 54. All are editable Word and Excel files that work on paper or in an eQMS, with one year of free updates.

Need only a few documents? Choose from 58 individual ISO 9001 procedures in Build Your QMS, with automatic discounts from 20% off at five procedures to 60% off at 40 or more. Compare all options on Compare QMS Packages.

For help with a gap assessment against the 2026 edition, internal audits or certification audit preparation, see Consulting.

For the bigger picture, including transition timing and how to choose a package, see our ISO 9001:2026 Guide.