What is ISO 9001?
ISO 9001 sets out the requirements a quality management system (QMS) must meet. It does not prescribe what your products or services should look like; it describes how to run your organisation so that you consistently meet customer requirements and applicable statutory and regulatory requirements, and keep improving. The standard applies to organisations of every size and sector – from a small trades business or service provider to a large industrial group.
According to ISO, ISO 9001 is the most widely used quality management standard in the world, with more than one million certificates issued to organisations in 189 countries. Within the ISO 9000 family it is the only standard you can be certified to, and certification itself is voluntary.
The standard rests on seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management. In practice, processes are planned, controlled, measured and improved in a Plan-Do-Check-Act cycle, and risks and opportunities are considered deliberately before they turn into problems or missed chances.
Who is ISO 9001 certification for?
ISO 9001 certification makes sense for any organisation that wants to demonstrate its quality to others. The trigger is often external: large customers require it from their suppliers, public and private tenders ask for it, or a company wants to show it is a dependable link in a supply chain. Just as often the reason is internal – growth, new sites or recurring errors call for clear, shared ways of working.
The standard expressly applies to organisations of any size, including small and medium-sized businesses. It sets no minimum size, prescribes no software and requires no fixed volume of documents. A business with ten employees can implement it in a lean way; what matters is that the system fits your own processes and is actually used.
ISO 9001 requirements: clauses 4 to 10
The auditable requirements are found in clauses 4 to 10. They follow the Harmonized Structure shared by all ISO management system standards, which is why ISO 14001, ISO 45001 and ISO 27001 use the same outline.
- Clause 4 – Context of the organisation: internal and external issues, interested parties and their requirements, the scope of the QMS and the processes it needs.
- Clause 5 – Leadership: top management commitment, quality policy, roles, responsibilities and authorities.
- Clause 6 – Planning: actions to address risks and opportunities, quality objectives and planning of changes.
- Clause 7 – Support: resources, competence, awareness, communication and documented information.
- Clause 8 – Operation: requirements for products and services, design and development, externally provided processes, production and service provision, release of products and services, and control of nonconforming outputs.
- Clause 9 – Performance evaluation: monitoring and measurement, customer satisfaction, internal audit and management review.
- Clause 10 – Improvement: nonconformity, corrective action and continual improvement.
ISO 9001:2026: what changes for existing certificates?
ISO published the sixth edition on 16 September 2026 and withdrew ISO 9001:2015 on the same day. The revision is an evolution rather than a fresh start: the clause structure stays the same, and customer focus, the process approach, risk-based thinking and continual improvement remain at its core. The 2024 amendment, which asks organisations to consider whether climate change is a relevant issue, has been carried into the new edition.
Transition periods are not set by ISO itself; they are determined internationally. According to ISO, organisations certified to ISO 9001:2015 have three years to move to the new edition – with publication in September 2026, that means until 2029. There is no need to go through the certification process again from scratch. You agree the exact timing of the transition with your certification body; if you are starting now, it is best to clarify in your enquiry which edition the audit will be based on.
Your existing QMS therefore remains the foundation. It is worth comparing it with the changes ISO itself highlights as the most significant:
- Leadership (5.1): greater emphasis on quality culture and ethical behaviour.
- Quality policy (5.2): a clearer link to the organisation’s context and strategic direction.
- Risks and opportunities (6.1): a clearer distinction between addressing risks and pursuing opportunities.
- Awareness (7.3): people should understand quality culture and ethical behaviour.
- New Annex A: explains key concepts, terminology and the intent behind the requirements.
Requirements and documentation for certification
A certification audit only makes sense once your QMS has been implemented and has been running for a while. Auditors want to see not just rules but evidence that they are applied – in particular a complete internal audit and a management review carried out by top management.
Since the 2015 edition, the standard no longer requires a quality manual. It requires ‘documented information’, and you decide the format – process descriptions, an intranet wiki or forms. Auditors typically ask for:
- The scope of the QMS, with a justification for any requirement you consider not applicable
- Quality policy and measurable quality objectives
- A traceable assessment of risks and opportunities with the planned actions
- Evidence of staff competence and training
- Evaluation and selection of external providers
- Monitoring and measurement results, for example on customer satisfaction
- The internal audit programme and its results
- Management review results
- Nonconformities and the corrective actions taken
What is checked in an ISO 9001 audit?
During the certification audit, auditors compare your arrangements with the requirements of the standard and use samples to check that day-to-day practice matches them. They review records, interview top management and the people working in the processes, and follow individual orders from receipt to delivery. Depending on the situation, the audit takes place on site or remotely.
Two questions matter: is a topic controlled, and is there evidence that the control works? A polished procedure without records is as unconvincing as good practice that nobody can describe. The auditors record the outcome in an audit report that identifies nonconformities and opportunities for improvement. The certificate is issued once the audit has been passed.
How long does ISO 9001 certification take and what does it cost?
With CERTUNION, the certification process – from your enquiry to the certificate – usually takes 4 to 8 weeks. How long it takes in your case depends on the size and complexity of your organisation: the number of employees and sites, the nature of your processes and the scope you want certified. Building the QMS itself is a separate matter; if you are starting from scratch, plan in months rather than weeks.
With CERTUNION, ISO 9001 certification comes as an annual package together with the platform for your management system. There are three annual packages, priced per year: €789 for one standard (up to 25 employees), €1,499 for up to three standards (up to 100 employees) and €1,949 for all five standards (any number of employees).
The annual price includes the platform with all its modules and that year’s audit: the initial certification in the first year – we issue the certificate once the audit has been passed – and the surveillance audits in the second and third years. The contract runs for three years; in the fourth year, recertification follows at a 20% discount. All prices are exclusive of VAT and apply exclusively to business customers, not to consumers. Travel and accommodation costs for on-site audits are charged as incurred.
Which package fits depends on the number of standards and employees. Also allow for internal effort: your team’s time for preparation, the internal audit and accompanying the auditors.
Benefits of ISO 9001 certification
The obvious benefit is the certificate itself: it opens doors with customers and in tenders that expect certified quality management. What you build along the way matters at least as much.
- Clear responsibilities and documented processes that do not depend on individual knowledge
- Fewer errors and less rework, because causes are tackled systematically
- Decisions based on data rather than gut feeling
- Greater trust among customers, partners and employees
- A regular outside view through annual surveillance audits
- A foundation for further management systems
ISO 9001 in an integrated management system
Because ISO 9001, ISO 14001 (environment), ISO 45001 (occupational health and safety), ISO 27001 (information security) and ISO 50001 (energy) share the same Harmonized Structure, they can be combined into an integrated management system. Context, leadership, risks and opportunities, internal audit and management review are then organised once for all standards instead of several times side by side.
Some sectors have standards that build on ISO 9001 and add sector-specific requirements, such as ISO 13485 for medical devices. If you are aiming for more than one standard, mention it in your enquiry.
The Certification Process
Enquiry
In a no-obligation initial conversation, you tell us about your organisation, your sites and the scope you want covered by ISO 9001 certification.
Analysis and package choice
We clarify your requirements – size, processes, sites –, you choose the right annual package, and we agree the audit scope for your ISO 9001 certification.
Optional pre-audit
If you wish, a pre-audit shows where your QMS still has room for improvement against the standard before the certification audit.
Certification audit
Our auditors check on site or remotely whether your quality management system meets the requirements of ISO 9001 and works in practice.
Certificate
Once the audit has been passed, we issue your ISO 9001 certificate. It is usually valid for three years.
Surveillance audits
Annual surveillance audits maintain the certificate and show that your QMS keeps developing. After three years, recertification follows.
Frequently asked questions
What is ISO 9001 certification?
ISO 9001 certification means that an independent certification body has audited your quality management system and confirmed that it meets the requirements of the standard. Once the audit has been passed, you receive a certificate you can show to customers and partners.
Is ISO 9001 certification mandatory?
No. ISO 9001 certification is voluntary and generally not required by law. In practice, however, many customers require it from their suppliers, and some tenders make it a condition of participation or give it additional weight in the evaluation.
How long does ISO 9001 certification take?
With CERTUNION, the certification process from enquiry to certificate usually takes 4 to 8 weeks, depending on the size and complexity of your organisation. Building the QMS beforehand takes additional time – usually several months, depending on your starting point.
How much does ISO 9001 certification cost?
With CERTUNION, ISO 9001 certification is part of an annual package with the platform. There are three annual packages, priced per year: €789 for one standard (up to 25 employees), €1,499 for up to three standards (up to 100 employees) and €1,949 for all five standards (any number of employees). The annual price covers the platform with all its modules and that year’s audit – the initial certification in year one, then two surveillance audits. The contract runs for three years; recertification in the fourth year comes at a 20% discount. Prices exclude VAT and apply to business customers only; travel and accommodation costs for on-site audits are charged as incurred.
What are the requirements for ISO 9001 certification?
Your quality management system must be in place and demonstrably used. That includes a quality policy, measurable objectives, defined processes, records from daily operations, and at least one internal audit and one management review before the certification audit.
How long is an ISO 9001 certificate valid?
An ISO 9001 certificate is usually valid for three years. During this period, annual surveillance audits confirm that the system remains effective. Before the three years are up, a recertification audit starts a new certification cycle.
What is checked during an ISO 9001 audit?
Auditors check whether your QMS meets all requirements of clauses 4 to 10 and works in practice. They review documents and records, talk to management and staff, and trace samples of real orders through your processes from start to finish.
What changes in ISO 9001:2026?
The new edition places more emphasis on leadership, quality culture and ethical behaviour, distinguishes more clearly between risks and opportunities, links the quality policy more closely to strategy and adds an explanatory Annex A. The structure and core principles stay the same.
Do I have to transition my ISO 9001:2015 certificate now?
No. According to ISO, organisations certified to ISO 9001:2015 have three years to move to ISO 9001:2026, in other words until 2029; the detailed deadlines are set internationally. You do not need to start the certification process again. Plan the timing early with your certification body.
Is ISO 9001 worth it for small businesses?
Yes, if your customers expect the certificate or your processes lack clear rules. The standard sets no minimum size and no fixed amount of documentation, so small businesses can keep their QMS lean. The audit effort also scales with the size of the organisation.
Do I need a quality manual for ISO 9001?
No. A quality manual has not been mandatory since the 2015 edition. The standard requires documented information such as the quality policy, objectives and records. Whether you keep it in a manual, a wiki or individual process descriptions is up to you.
Can I certify my company to ISO 9001 myself?
You can build a QMS to ISO 9001 yourself and even declare its conformity on your own. A certificate, however, requires an audit by an independent certification body. Be wary of offers to buy a certificate without an audit.