Holding an ISO 9001 certificate through the transition to ISO 9001:2026

ISO published ISO 9001:2026, the sixth edition of the standard, on 16 September 2026, and the 2015 edition was withdrawn the same day. If you hold a certificate to the 2015 edition, that certificate did not lapse. The scope is the same, and your next audit is still booked against the system you run today.

The date that decides what happens next has now been published. Organisations certified to the 2015 edition have until 30 September 2029 to complete the transition. Arrangements of that kind are set on the accreditation side rather than by ISO, in a mandatory document telling accreditation bodies and their certification bodies what to do about certificates already in issue. This one is Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, from Global Accreditation Cooperation Incorporated (Global ACI).

What was published on 16 September 2026

ISO/TC 176/SC 2, the subcommittee responsible for ISO 9001, published a revision update on 7 August 2026: "ISO/FDIS 9001 has been approved with overwhelming international support. The sixth edition of ISO 9001 is scheduled for publication on 16 September 2026."

The date held. ISO announced the launch on 16 September 2026, and its catalogue now lists ISO 9001:2026 as published, edition 6. The same catalogue lists ISO 9001:2015 and its 2024 amendment as withdrawn, with the 2015 edition's withdrawal dated 16 September 2026.

Withdrawal is a status in ISO's catalogue, and it applies to the text of the standard. ISO's guidance for certified organisations is that they have three years to move to the 2026 edition and do not need to start the certification process again.

What moved between the two editions is a separate question from the status of your certificate. UKAS describes the revision as targeted updates rather than fundamental change, and places the most significant changes in interested parties, quality culture and ethical behaviour, risks and opportunities, planning of changes and management review.

What happens to your ISO 9001 certificate now

Your certificate names an edition of the standard and carries an expiry date. Publication of a new edition altered neither field.

What changes is the audit. Your certification body moves you to the 2026 edition through a transition audit, which can run alongside a surveillance audit or a recertification audit, or as a separate special audit. It reviews the changed requirements, changes to your organisation's context and any other changes your management system needs. The certification body also has to consider whether extra audit time is needed, based on how far your system has changed and which kind of audit the transition sits in.

The expiry date does now have a ceiling. Accredited certification to the 2015 edition ends on 30 September 2029, so a certificate printed with a later expiry date does not carry past it. A certification body does not have to reissue a certificate to show this, though it may shorten the printed validity. The deadline covers the issue of the new certificate as well as the audit, so the audit has to fall early enough for both to be finished.

An organisation that chooses not to transition can still be audited against the 2015 edition, and its certification ends with the transition period.

Your certificate carries on under its normal audit cycle until a transition audit moves it to the 2026 edition, and 30 September 2029 is the deadline for that move.

If you do not hold ISO 9001 yet, getting ISO 9001 certified sets out the route in. The edition open to you has a cut-off. UKAS's timetable has certification bodies stop accepting new applications against the previous version on 16 March 2028, and after 31 March 2028 new and initial accredited certifications can only be to ISO 9001:2026.

The ISO 9001 transition period comes from the accreditation side

IAF MD 26:2023, Issue 2, sets out why such a document exists. Clause 1: "All documents that provide information on transitions of normative documents will be mandatory documents to be followed by IAF MLA Accreditation Body (AB) signatories and accredited Conformity Assessment Bodies (CABs), with the scope as detailed in this document."

The Global ACI document for ISO 9001 opens with the same provision in Global ACI's own terms, and it is mandatory for Global ACI's accreditation body signatories and their accredited certification bodies.

ISO publishes the standard. A separate mandatory document decides what happens to certificates already in issue, which is why the transition dates sit with Global ACI.

The International Accreditation Forum ceased operations on 1 January 2026, and Global ACI has confirmed that specified IAF documents stay valid until it adopts equivalents of its own. Its ISO 9001 document took effect on 16 September 2026.

Your certification body has to transition first

In the UK, an accredited certificate to the 2026 edition depends on a UKAS decision about your certification body. Until UKAS has made that decision, certification issued against ISO 9001:2026 must not be represented as accredited.

UKAS set out its timetable in a technical bulletin, revised on 7 October 2026. Transition assessment was due to begin on 1 November 2026, the first tranche of decisions is due by 31 January 2027, and all decisions by 30 September 2027. Global ACI requires certification bodies to submit their transition declarations by 30 June 2027, and one that decides not to transition has to tell affected clients in writing by the same date.

Your certification body may not yet be able to offer an accredited audit to the 2026 edition. That affects when a transition audit can be booked, so ask before you plan around a particular surveillance visit.

What a recent comparable transition looked like

A recent comparable transition was ISO/IEC 27001 moving from its 2013 edition to its 2022 edition. IAF MD 26:2023, Issue 2, "Transition Requirements for ISO/IEC 27001:2022", issued 15 February 2023, set the timescales, and two of its rows are worth separating.

The row everybody quotes is the last one. Certification body transitions of certified clients had to be completed by "36 months from the last day of publication month of ISO/IEC 27001:2022 (i.e. 31 October 2025)". That is three years, and it reads like three years to prepare.

The row that bit first sits above it. Initial certification and recertification by the certification body to the new standard only had to begin no later than "18 months from the last day of publication month of ISO/IEC 27001:2022 (i.e. 30 April 2024)". Past that point, a recertification audit was to the 2022 edition whether the organisation felt ready or not. One whose recertification fell in month twenty had twenty months of preparation rather than thirty-six.

Every figure in the two paragraphs above is an ISO/IEC 27001:2022 figure. The ISO 9001 document uses the same 18-month and 36-month structure, landing on 31 March 2028 and 30 September 2029, with a difference that matters here. Its 18-month row names new and initial certifications and does not name recertification, so that row does not tie a recertification audit after 31 March 2028 to the 2026 edition in the way the ISO/IEC 27001 row did. Your certification body's own transition arrangement decides how that works for you, and 30 September 2029 applies either way.

Four things worth doing now

Check which edition your certificate names and when it expires. Both are printed on it. If the expiry date falls after 30 September 2029, read it as 30 September 2029 for a certificate to the 2015 edition.

Work out which of your scheduled audits could carry the transition. List the surveillance and recertification audits due before 30 September 2029, and pick one that leaves time to close any findings and have the new certificate issued. Surveillance and recertification audits sets out how the two differ for ISO 27001.

Put the question to your certification body. IAF MD 26:2023 clause 4.1 required an accreditation body to establish a transition arrangement for ISO/IEC 27001:2022, and stated: "The transition arrangement shall address what the AB shall do and what the CABs shall do." The ISO 9001 document requires the same arrangement of accreditation bodies, and requires a certification body to set its own and keep certified clients informed of the process, expected actions and timelines. An arrangement with your certification body's name on it is the document you want. Ask for it now, along with the date it expects its UKAS decision and whether your audit will need extra time.

Do the work a transition audit will need anyway. It examines the management system you actually run, and an organisation with a current internal audit programme and closed findings from its last management review has a shorter job than one reassembling both. ISO's own transition steps begin with reviewing the differences between the editions and a gap analysis of your current system.

Where Naq fits

Naq covers ISO 9001. The framework catalogue is versioned. When Naq publishes a new version of a framework, the existing instances of that framework are notified and prompted to migrate, and an instance stays on its current version until the customer explicitly migrates it.

Quality and information security sit in the same workspace, so a control that serves ISO 9001 and ISO 27001 is recorded once. Every meaningful action is written to the record's activity stream, where field edits show the previous value and the new one. Naq gets an organisation audit-ready. The certificate itself comes from a UKAS-accredited certification body.

If you want to see that record before a transition audit is booked, book a fifteen-minute demo and bring your certificate and its expiry date.