Blog · ISO 9001 Made Simple

Do I Have to Re-Do My ISO 9001 Documents for the 2026 Version?

Published 16 September 2026 · 7 min read

Short answer: no. You do not re-do your documents. You revise a specific and fairly short list of them, and you leave the rest alone.

That is worth saying up front, because the emails going around at the moment are not designed to make you feel calm about this. If you are running a certified business without a dedicated quality manager, the realistic scope of a transition to ISO 9001:2026 is somewhere between half a day and a couple of weeks of actual work, depending on how much you wrote down in the first place and how honest it was.

This article goes through which documents change, which do not, the one everybody forgets, and the three ways to actually get it done. For the background on what changed in the standard itself, start with our plain-English guide to ISO 9001:2026.

Start with what does not change

This is most of your document set, and knowing that up front makes the rest of the job feel manageable.

• Your procedures. How you quote, how you order materials, how you check work before it leaves, how you handle a complaint. The operational clause was largely a terminology update, so the way you actually run the business is not in scope.
• Your work instructions. Same reasoning. If it tells someone how to do a task, it is almost certainly fine.
• Your forms and records. Job cards, inspection sheets, checklists, delivery dockets. The evidence you generate day to day does not change.
• Your supplier records, calibration records and job files. Untouched.
• Your nonconformance and corrective action process. The mechanism is the same. What you record and how you close it out is unchanged.

If most of your quality system is procedures, forms and records, which is normal for a small business, then most of your quality system is already compliant with the 2026 version.

What actually needs to change

Six things, and for a small business several of them are a paragraph each.

1. Your context and interested parties documentation. This needs to show that you have genuinely considered whether climate change is relevant to your business. The trap here is assuming it demands a carbon footprint. It does not. It asks whether climate is a factor in what affects your ability to deliver, and it accepts a reasoned no. A transport business on a flood-prone route has a real answer. A city accounting practice may reasonably conclude the relevance is limited, and recording that conclusion, with the thinking behind it, is a legitimate response. If this document has gone stale, our guide to what context of the organisation actually means is the place to start.

2. Your quality policy. Ethical behaviour and quality culture are now named leadership responsibilities, and the policy is usually where that has to become visible. For most small businesses this is a sentence or two added to a document that is already one page long, not a rewrite.

3. Whatever evidences your leadership commitment. Management review minutes, a leadership commitment statement, toolbox talk records, whatever you already use. The expectation is that the tone you set is demonstrable somewhere other than in your own head. Our piece on what leadership means when you are the owner covers what this looks like when the owner is also the estimator and the person answering the phone.

4. Your risk and opportunity register. Risk and opportunity have been separated more clearly, with more weight on opportunity. Most small businesses have a register that is, in practice, a list of things that could go wrong. The revision makes the other half harder to skip. If you are dreading this, risk-based thinking without a risk register culture explains how to do it without building a bureaucracy.

5. Your awareness and induction material. Awareness now extends beyond understanding the policy and your part in it, to understanding why the work matters and how people are expected to behave. In a ten person business this is usually a change to an induction checklist and a conversation you record, not a training programme. The practical version is in what awareness actually means when everyone is too busy to read a policy.

6. Every document that names the standard by year. This is the boring one and it catches people at audit. Quality manuals, policy headers, procedure footers, audit checklists and certificates of conformance often carry the words ISO 9001:2015 somewhere. Those references need to move to 2026 once you have transitioned. Search your document set for the year, not just for the clause numbers.

The one everybody forgets

Your internal audit checklist and your management review agenda are themselves documents, and they are built around the clauses.

If you do not update them, your next internal audit will faithfully test the 2015 requirements and tell you everything is fine, right up until an external auditor asks how you verified the new ones. The same applies to management review inputs. An agenda written for the old clause set will not prompt the discussion the new one expects.

This is the most common gap we see in transitions, and it is also one of the quickest to close. Update the checklist and the agenda early, then run one internal audit against them before your transition audit. That audit is also your evidence that you checked.

Changing the words is not the whole job

Two things an external auditor will look for that are easy to miss.

First, evidence that you considered the new requirements, not just evidence that the wording changed. For the climate consideration in particular, a single line asserting that climate is not relevant, with no visible reasoning and no date, reads as a box being ticked. A short paragraph explaining what you looked at and what you concluded reads as a business that thought about it. The second one is what the clause is asking for.

Second, your own document control process has to have been followed. Revision numbers updated, the change approved by whoever your system says approves it, and the new version actually issued to the people who use it. Auditors check this, and it is a genuinely common finding: a business updates its documents correctly and then fails on the fact that three people are still working from the old printed copy in the ute. If you are unsure what your system actually commits you to here, what documented information really means for a small business is the relevant background.

Three ways to get it done

Do it yourself. Free, and entirely realistic for a business whose document set is lean and whose owner wrote most of it. The cost is your time and the risk is that you interpret a clause differently from your auditor. Worth knowing: the 2026 version includes a new Annex A, roughly fifteen pages of official guidance on how to read the clauses. That is the first time ISO 9001 has shipped with interpretation help included, and it makes the DIY path meaningfully more viable than it was for the 2015 transition.

Bring in a consultant. The safest option if your document set is large, disorganised, or written by someone who has since left. Expect to pay for a gap analysis first, commonly quoted in Australia somewhere in the two to five thousand dollar range, and then for the document work on top of that. For a business with a genuinely messy system, this is money well spent. For a business with a tidy fifteen document system that needs six paragraphs changed, it is not.

Use software that drafts the revisions for you. This is what the Lead Comply Portal does. You tell it about your business, it drafts the updated documents against the current clauses, you review and approve each one, and the version history is kept for you. A human still signs off every document, because an AI draft is not a compliance record until someone at your business has read it and accepted it. The honest limitation is the same as the DIY path: software will not sit in the room with your auditor and argue an interpretation. What it removes is the blank page and the retyping.

There is no universally right answer here. A business with a complicated multi-site system and a difficult audit history should talk to a consultant. A business with a tidy system and an owner who knows it well should probably just do it. Most small certified businesses sit in between, and the deciding factor is usually how much of the writing they want to do themselves.

How to sequence it

Do it in this order and the work stays contained.

• Email your certification body first. Ask when they can audit against 2026 and whether your next surveillance audit is the right place to do it. Their answer sets your deadline, and it is free to ask.
• List your documents and mark the six. Context, quality policy, leadership evidence, risk and opportunity register, awareness material, and anything naming the standard by year. That list is your scope.
• Revise, approve and issue. Through your normal document control process, not around it.
• Update the internal audit checklist and management review agenda. Then run one internal audit against the new requirements.
• Book the transition audit. Earlier rather than later. Audit slots concentrate toward the end of a transition window and the businesses that wait pay more for less choice.

On timing, the transition window is expected to run about three years from publication, which would put it around September 2029. That date is not formally confirmed yet, because the International Accreditation Forum sets it in a communique issued after publication. Three years is the sensible planning assumption either way, and treating it as eighteen months of comfortable work rather than a deadline sprint is the version of this that costs the least.