The short answer
ISO 9001 is the international standard for a quality management system (QMS). It sets requirements, in clauses 4 to 10, for consistently delivering products and services that meet customer and legal requirements and for improving over time. It is the only standard in the ISO 9000 family you can be certified against, and certificates last three years.
On this page
- What is ISO 9001 in simple terms?
- What does ISO 9001 stand for?
- What are the 7 quality management principles?
- What are the ISO 9001 requirements?
- Is a quality manual required for ISO 9001?
- ISO 9000 vs ISO 9001: what is the difference?
- ISO 9001:2015 vs ISO 9001:2026
- Who needs ISO 9001?
- What are the benefits of ISO 9001?
- ISO 9001, 14001 and 45001 together
- What is ISO 9001 certification, and how do you get it?
- Why Sovereign Secure
- Next step
ISO 9001 is the international standard for a quality management system (QMS). It sets out what an organisation must do to deliver products and services that consistently meet customer and legal requirements, and to keep improving. The current edition, ISO 9001:2026, was published by ISO on 16 September 2026 and replaces ISO 9001:2015.
ISO 9001 applies to any organisation, of any size, in any sector, and it is the one standard in the ISO 9000 family that you can be certified against. That is why customers and tenders ask for it: an ISO 9001 certificate is independent evidence that you run your work in a controlled, consistent way.
What is ISO 9001 in simple terms?
ISO 9001 is a framework for running your work so that customers consistently get what they asked for, and for proving that you do. It does not tell you how to make your product or deliver your service. Instead it asks you to:
- Understand your customers, your context and the processes that deliver your products or services.
- Set a quality policy and measurable quality objectives.
- Plan and control those processes, including suppliers, design and changes.
- Measure the results, such as customer satisfaction, complaints, nonconformities and progress against objectives.
- Check the whole system through internal audit and management review.
- Fix the causes of problems and keep improving.
This is the plan, do, check, act cycle that runs through the standard. Because it is about how you work rather than what you make, a five-person training provider and a large manufacturer meet the same requirements, each in proportion to its own processes and risks.
What does ISO 9001 stand for?
Each part of the name has a meaning:
| Part | Meaning |
|---|---|
| ISO | The International Organization for Standardization, which writes and publishes the standard. ISO is a short name rather than an initialism, so it reads the same in every language |
| 9001 | Its number in the ISO 9000 family of quality management standards |
| 2026 (or 2015) | The edition year |
| QMS | Quality management system: the policies, processes, records and responsibilities ISO 9001 asks you to put in place |
So “ISO 9001:2026” means the 2026 edition of the quality management system requirements standard. A quality management system is not software: it is the way your organisation plans, runs, checks and improves its work.
What are the 7 quality management principles?
ISO 9001 is built on seven quality management principles, set out in ISO 9000. They are not requirements you are audited against, but every clause traces back to them.
| Principle | What it means in practice |
|---|---|
| Customer focus | Understand what customers need, meet those requirements and try to exceed their expectations |
| Leadership | Top management sets direction and creates the conditions for people to achieve quality objectives |
| Engagement of people | Competent, empowered people at every level, who know how their work affects quality |
| Process approach | Manage activities as connected processes that produce predictable results |
| Improvement | Keep improving performance, not just fixing problems as they occur |
| Evidence-based decision making | Base decisions on data and analysis rather than assumption |
| Relationship management | Manage relationships with suppliers and other interested parties for mutual benefit |
ISO 9001:2026 adds a further leadership emphasis: top management must now promote a quality culture and ethical behaviour, and staff must be aware of it.
What are the ISO 9001 requirements?
The requirements sit in clauses 4 to 10. Clauses 0 to 3 introduce the standard and its terms. Clauses 4 to 10 follow the harmonised structure that ISO uses for its management system standards, including ISO 14001, ISO 45001 and ISO 27001.
| Clause | Title | What it asks for, in one line |
|---|---|---|
| 4 | Context of the organisation | Understand your issues and interested parties, set the QMS scope and define your processes |
| 5 | Leadership | Top management accountability, customer focus, a quality policy and clear roles |
| 6 | Planning | Actions on risks and opportunities, measurable quality objectives and planned changes |
| 7 | Support | Resources, competence, awareness, communication and documented information |
| 8 | Operation | Customer requirements, design, control of suppliers, delivery, release and nonconforming outputs |
| 9 | Performance evaluation | Monitoring and measurement, customer satisfaction, internal audit and management review |
| 10 | Improvement | Nonconformity, corrective action and continual improvement |
What is required for ISO 9001 certification is evidence that all of this runs in practice: records of customer requirements reviewed, suppliers evaluated, objectives tracked, complaints and nonconformities corrected, an internal audit and a management review. Our ISO 9001 certification page lists the common gaps against each clause.
Is a quality manual required for ISO 9001?
No. ISO 9001:2015 removed the requirement for a quality manual and replaced it with “documented information”, and the 2026 edition keeps that approach, updating the wording to say documented information “shall be available”. You must document the QMS scope, the quality policy and quality objectives, plus whatever you need to run your processes consistently, and keep the records the standard lists.
Many organisations still keep a short manual because it gives staff and auditors one place to start. That is a choice, not a requirement. What auditors look for is a system that is controlled and used, not a thick binder.
ISO 9000 vs ISO 9001: what is the difference?
ISO 9000 explains the fundamentals and vocabulary of quality management, including the seven principles; ISO 9001 sets the requirements you can be certified against. People often say “ISO 9000” when they mean the whole family.
| Standard | What it is | Certifiable? |
|---|---|---|
| ISO 9000 | Fundamentals and vocabulary: the concepts, principles and definitions ISO 9001 relies on | No |
| ISO 9001 | Quality management system requirements | Yes |
| ISO 9004 | Guidance on achieving sustained success, beyond the requirements of ISO 9001 | No |
| ISO 19011 | Guidance on auditing management systems, used for internal audits | No |
ISO 9001:2015 vs ISO 9001:2026
ISO 9001:2026 is the sixth edition and replaces ISO 9001:2015, including its 2024 climate change amendment. The changes are modest: the clause 4 to 10 structure stays, and the main additions are quality culture and ethical behaviour, separate actions for risks and opportunities, tighter planning of changes and new management review inputs.
| Aspect | ISO 9001:2015 | ISO 9001:2026 |
|---|---|---|
| Published | September 2015 (climate amendment 2024) | 16 September 2026 |
| Structure | Clauses 4 to 10 | Clauses 4 to 10, unchanged |
| New certifications | Possible until 31 March 2028 | The only edition for new certifications after 31 March 2028 |
| Certificate validity | Ends on 30 September 2029 at the latest | Current edition |
If you are starting now, build to the 2026 edition. Our guide to ISO 9001:2026 sets out the changes clause by clause and every transition deadline, which come from Global ACI’s mandatory transition requirements; ISO’s own ISO 9001:2026 overview summarises what changed.
Who needs ISO 9001?
No UK law requires it in general, so the real question is who your customers are. ISO 9001 is asked for most often by:
| Organisation type | Why ISO 9001 is asked for |
|---|---|
| Manufacturers and engineering firms | Customers’ supplier approval and supply chain requirements |
| Construction and facilities management | Main contractors, frameworks and public sector tenders |
| Suppliers to the public sector | Tenders often ask for it or score it |
| Logistics, distribution and service providers | Contracts with defined service levels and complaint handling |
| Software and IT service providers | Larger customers want evidence of controlled delivery and change |
| Organisations exporting or selling internationally | The certificate is recognised worldwide |
What are the benefits of ISO 9001?
The main reasons to get ISO 9001 certification are commercial and operational:
- Access to contracts and tenders that require or score the certificate.
- Fewer errors and less rework, because processes are defined, owned and checked.
- Customer confidence, backed by an independent audit rather than your own claims.
- Better supplier control, through evaluation and monitoring of the suppliers that affect quality.
- Decisions based on data, from customer feedback, complaints, nonconformities and objectives.
- A base for other standards, because ISO 14001, 45001, 27001 and ISO 22000 share the same structure, and ISO 13485 for medical devices builds on the same quality management principles.
ISO 9001, 14001 and 45001 together
Because ISO 9001, ISO 14001 (environmental management) and ISO 45001 (occupational health and safety) share clauses 4 to 10, many organisations run them as one integrated management system: one context and risk process, one document control system, one internal audit programme and one management review. Our ISO certification page explains how an integrated system is built and certified. If you also handle sensitive data, what ISO 27001 is explains the information security equivalent.
What is ISO 9001 certification, and how do you get it?
ISO 9001 certification is confirmation by an independent certification body that your quality management system meets the standard. To get it, you build and run a QMS, then pass a two-stage audit by that certification body. For most small and medium-sized organisations that takes three to six months.
- Agree the scope: the sites, products and services the certificate must cover.
- Run a gap analysis against clauses 4 to 10.
- Design and document the QMS, keeping documents proportionate.
- Run it and build up the records auditors will sample.
- Complete an internal audit and a management review.
- Stage 1 audit: the certification body reviews your documentation and readiness.
- Stage 2 audit: the certification body tests that the QMS works and decides on certification. The certificate lasts three years, with surveillance audits in years two and three.
Our ISO 9001 consultancy and certification service takes you through each step. Certificates are issued by our partner certification body, MQA International, which audits you independently of the consultancy.
Why Sovereign Secure
- ISO 27001 certified ourselves, so we know management system audits from the certified side.
- ISO consultancy across standards, including ISO 9001, 14001, 45001, 22301 and 27001, so an integrated system is handled in one plan.
- Independent certification. We prepare you; our partner certification body, MQA International, audits you and makes its own certification decision.
- A UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453), and an IASME-licensed Cyber Essentials certification body.
Next step
If a customer or tender has asked for ISO 9001, a gap analysis shows how far you are from certification and what it will take. Use the form below, which is already set to ISO certification, or call +44 161 523 5276.
Free tools and services
Last reviewed October 2026 by the Sovereign Secure assessment team.
