ISO 9001:2026 Clause 8: Operation
Published October 23, 2026
Clause 8 of ISO 9001:2026 covers the work that turns customer requirements into delivered products and services. It connects operational planning, customer communication, design, external providers, production or service delivery, release and the control of nonconforming outputs.
8.1 Plan and control operational processes
Determine product and service requirements, acceptance criteria, process criteria and the resources needed. Put appropriate controls in place and make documented information available to the extent needed to show that work followed the plan and outputs conformed.
Control planned changes and assess unintended changes so that adverse effects can be addressed. Externally provided processes, products and services relevant to the QMS also need control.
8.2 Understand requirements before committing
Communicate with customers about what you supply, enquiries and orders, changes, feedback and complaints, customer property and relevant contingency actions. The 2026 text explicitly addresses communication about relevant disruptions to provision.
Determine the applicable customer, statutory and regulatory requirements and any other requirements necessary for what you offer. Review your ability to meet them before making the commitment. Resolve differences and confirm customer requirements when no documented statement is provided.
For online sales, reviewing the published product information may be more appropriate than a separate formal review of every order. Whatever method you use, claims about the product or service need to be supportable. Communicate changes in requirements to the relevant interested parties and update the affected information.
8.3 Control design and development where applicable
If you design products or services, establish an appropriate design process. Plan the stages, responsibilities, resources, interfaces and controls; establish adequate inputs; and produce outputs suitable for subsequent delivery.
Reviews assess the design’s ability to meet requirements. Verification checks outputs against inputs. Validation checks suitability for the intended use or application. These purposes differ even when activities are combined. Keep the required evidence and control design changes.
Iterative development is compatible with the standard. It still needs appropriate control: repeated design cycles do not remove the need to address requirements or evaluate results. Any claim that design is not applicable must meet the conditions in your QMS scope under Clause 4.3.
8.4 Control external providers
Set criteria to evaluate, select, monitor and re-evaluate external providers. Choose controls for the provider and for the resulting output according to the potential effect on conformity and the effectiveness of existing controls.
Communicate adequate requirements before work begins, including relevant competence, approval, interaction and verification arrangements. Keep documented evidence of provider evaluations and any necessary resulting actions. Purchasing from an approved supplier is not, by itself, assurance that every delivery meets requirements. Outsourcing a process does not outsource your responsibility for its effect on your products and services.
8.5 Control production and service provision
Use the information, capable people, suitable resources, checks and other controls needed for the work. Where the resulting output cannot be verified by subsequent monitoring or measurement, validate and periodically revalidate the process’s ability to achieve the planned result.
Identify outputs and their inspection status as required. Where traceability is a requirement, control unique identification and keep the necessary evidence. Protect customer and external-provider property, including information where relevant, and report loss, damage or unsuitability to the customer or external provider. Keep evidence of what occurred.
Preserve outputs through handling, storage, delivery or transmission. Meet applicable post-delivery requirements and control changes to production or service provision. The appropriate controls will differ between, for example, a warehouse and a consultancy.
8.6 Authorize release on the basis of evidence
Complete the planned checks before releasing products or services, unless the relevant authority and, where applicable, the customer approve otherwise. Keep evidence of conformity to acceptance criteria and traceability to the people authorizing release.
8.7 Control outputs that do not meet requirements
Identify and control nonconforming outputs to prevent unintended use or delivery, including problems found after delivery. Suitable responses may include correction, containment, suspension, informing the customer or obtaining authorized acceptance under concession.
Verify conformity after correction and keep the required evidence of the problem, action, concessions and decision authority. Then evaluate the need to address the cause under Clause 10.2. Fixing one faulty output and preventing the problem from recurring are related but different activities.
For the bigger picture, return to the ISO 9001:2026 requirements overview. For structured learning, explore our ISO 9001 online training. Check the standard edition shown on each course page before enrolling.
Based on ISO 9001:2026, Quality management systems — Requirements. Clause 8 explained in practical terms. Use the standard itself for the complete requirements. Examples illustrate possible approaches, not additional ISO requirements.
