ISO 9001:2026: What Changed and What Medical Device Teams Should Update
Does ISO 9001:2026 change what a medical device QMS must do?
ISO published ISO 9001:2026, the sixth edition, on 16 September 2026. It is an evolution of the 2015 edition rather than a rewrite: the process approach, risk-based thinking and the ten-clause structure remain. For U.S. device manufacturers, FDA's QMSR incorporates ISO 13485:2016, not ISO 9001, so the new edition does not change those requirements. It matters if your organization holds or is pursuing ISO 9001 certification alongside ISO 13485, or if customers require it.
Transition timeline
Published: 16 September 2026, replacing ISO 9001:2015 and its 2024 climate-change amendment.
Transition: a three-year period is expected, giving certified organizations until approximately September 2029. Confirm exact cut-off dates, including any earlier date for initial certification to the 2015 edition, with your certification body.
Structure: the standard adopts ISO's latest Harmonized Structure, which makes integration with other management system standards easier.
The changes most likely to need action
5.1.1 Leadership: top management must actively promote a culture of quality and ethical behavior.
6.1 Risks and opportunities: actions on risks (6.1.2) and actions on opportunities (6.1.3) are now separate. Risks and opportunities must be determined, analyzed and evaluated, and risk actions proportionate to their potential impact.
6.3 Planning of changes: the considerations expand to include how a change's effectiveness will be monitored and evaluated, how it will be communicated, and how its results will be reviewed.
7.1.6 Organizational knowledge: knowledge must be retained, applied and shared to the extent necessary for the QMS as a whole, not only made available.
7.3 Awareness: people must also be aware of the organization's quality culture and expected ethical behavior.
10.1 Continual improvement: former clauses 10.1 and 10.3 are combined, with monitoring and measurement results named as inputs.
Smaller changes to check
4.1 Context: determining whether climate change is a relevant issue is now part of the standard (carried over from the 2024 amendment).
4.2 Interested parties: decide which of their relevant requirements the QMS will address, without setting aside statutory, regulatory or accepted customer requirements.
8.2.1 Customer communication: give customers relevant information about contingency actions, including during disruptions.
8.2.4 Changed requirements: update the relevant documented information and communicate it to the parties who need it.
8.4.3 External providers: tell suppliers, where relevant, about requirements for their interactions with your customers.
9.2.2 Internal audit: each audit needs defined objectives as well as scope and criteria.
9.3.2 Management review: inputs explicitly include changes in the needs and expectations of interested parties.
Clause 3 and Annex A: core terms now sit in the standard itself, and an expanded Annex A explains the intent of requirements without adding new ones.
Worked example: a fictional planning decision
A fictional contract manufacturer holds ISO 13485 and ISO 9001:2015 certificates and maintains one integrated QMS. Its gap review finds that management review records do not capture changes in interested-party needs, internal audit plans list scope and criteria but no objectives, and the change-control form never asks how a change's effectiveness will be checked. Its ISO 13485 processes stay as they are; the team revises three procedures and their forms, updates awareness training, and schedules the transition audit with its certification body.
Which documents to review first
Quality manual: clause references, the culture-and-ethics commitment, and interested-party scope decisions.
Risk procedure: separate handling of opportunities, and evaluation criteria proportionate to impact.
Change control: effectiveness monitoring, communication and review of results for QMS changes.
Internal audit procedure: defined objectives for each audit.
Management review procedure: the new input and the decisions recorded as results.
Training and awareness: quality culture and ethical behavior added to awareness content.
Review checklist before approving the transition
Confirm your certification body's transition dates.
Run a gap review clause by clause against your current QMS.
Separate genuine gaps from arrangements that already work.
Revise affected procedures and forms through document control, then train the people who use them.
Generate at least one cycle of records (for example, an audit and a management review) under the revised process before the transition audit.
Documentation options
A.P. Lyon's Dual-Standard QMS packages are listed as covering ISO 9001:2026 and ISO 13485:2016; compare their content lists against your gap review. Teams that need only the integrated manual can start with the Dual-Standard Quality Management System Manual. To compare scopes, see Compare QMS Packages.
Primary references and review date
References checked October 20, 2026. Clause summaries above are A.P. Lyon's paraphrase; consult the full licensed standard before approving changes.
Publisher and editorial standards
Published by A.P. Lyon. Aaron Lyon is the company's founder; his professional background is described on the About page. These guides use AI-assisted research and drafting. Each guide is reviewed and approved by Aaron Lyon before publication; that review does not certify applicability to your device.
Comments