ISO 9001:2026 Requirements: Clauses 4–10 Explained
Published October 23, 2026
ISO 9001:2026 requirements define what a quality management system (QMS) must achieve: consistent products and services, compliance with applicable requirements, and enhanced customer satisfaction. Clauses 4–10 contain the QMS requirements. This guide explains what your business needs to do, what documented information it needs, and how the clauses work together, with links to a practical guide for each clause.
What are the ISO 9001:2026 requirements?
Your organization needs to establish, operate, evaluate and continually improve a QMS that fits its work. In practical terms, this means:
Understand your business: define the QMS scope, relevant requirements and connected processes (Clause 4).
Lead and plan: assign responsibility, provide direction, address risks and opportunities, and set measurable quality objectives (Clauses 5–6).
Equip people and control the work: provide resources and competence, manage information, and control how products and services are delivered (Clauses 7–8).
Check the results: evaluate performance and customer satisfaction, conduct internal audits, and carry out management reviews (Clause 9).
Improve: respond to problems, evaluate the need to address their causes, check corrective-action effectiveness and pursue continual improvement (Clause 10).
This is a starting checklist, not a substitute for the standard. Apply all requirements relevant to your QMS scope; the sections below explain how they connect.
How a quality management system goes beyond inspection
Quality control checks whether an output meets its requirements. A QMS also addresses how your organization understands customer needs, plans work, equips people, manages suppliers and learns from results. Finding an error before delivery matters; organizing work so that the same error is less likely to happen matters too.
ISO 9001 applies to businesses of different sizes and to service providers as well as manufacturers. Your system should reflect your own processes and risks. It does not require you to copy the standard’s clause sequence into a quality manual or create a separate procedure for every paragraph.
ISO 9001:2026 requirements by clause
Introductory clauses
Clauses 1–3 explain the standard’s scope, normative reference and terminology. Clause 2 refers to ISO 9000 for quality management fundamentals and vocabulary. This is an undated reference, so the latest edition, including amendments, applies. Clauses 4–10 set the QMS requirements:
Context of the Organization
Understand internal and external issues, relevant interested parties and the requirements your QMS will address. Determine whether climate change is relevant, document the scope, and establish the processes and their interactions. For example, an order-to-delivery process needs clear inputs, responsibilities, controls and expected results; a process map is one useful format, not a mandatory ISO template. Read the Clause 4 guide.
Leadership
Top management is accountable for QMS effectiveness. It must establish and apply the quality policy, ensure objectives and resources support the business, maintain customer focus, assign responsibilities, and promote quality culture and ethical behavior. In practice, a manager supports accurate reporting and appropriate action when a delivery check fails, even when dispatch is urgent. Read the Clause 5 guide.
Planning
Determine, analyze and evaluate risks and opportunities, then plan actions for each and evaluate their effectiveness. Establish measurable quality objectives and plan changes to the QMS. For example, reducing incomplete orders could involve a clearer intake process, an assigned owner, a completion date and a measure of results. ISO 9001 does not set the target for your business. Read the Clause 6 guide.
Support
Provide suitable people, infrastructure, working conditions and monitoring or measuring resources. Retain, apply and share necessary knowledge; establish competence and awareness; plan communication; and control documented information. For example, keep the current work instruction available where it is used and evidence that the people doing the work are competent. A training attendance record alone may not demonstrate competence. Read the Clause 7 guide.
Operation
Plan and control the work from understanding customer requirements through delivery and follow-up. Control design and development where applicable, external providers, production or service provision, release and outputs that do not meet requirements. For example, review an order before accepting it, communicate changes to those doing the work, and keep evidence that the delivered output meets its acceptance criteria. Read the Clause 8 guide.
Performance Evaluation
Determine what needs monitoring and measurement, evaluate the results and monitor customer satisfaction. Conduct objective internal audits and management reviews at planned intervals, keeping the required evidence. For example, review delivery performance alongside customer feedback and audit findings, then make decisions about resources or changes. The standard does not prescribe one universal dashboard or annual review calendar. Read the Clause 9 guide.
Improvement
Continually improve the QMS using performance information and management review results. When a nonconformity occurs, respond to it, evaluate the need to address its causes, implement necessary action and review corrective-action effectiveness. Replacing an incorrect delivery is a correction; changing the order-checking process after identifying the cause can be corrective action. Keep the required evidence of problems, actions and results. Read the Clause 10 guide.
What documents and records does ISO 9001:2026 require?
ISO 9001 uses the term documented information for both information that directs the work and evidence of what happened. Your QMS needs the information explicitly required by the standard and any additional documentation necessary for its effectiveness. Key examples include:
Scope, policy and objectives: the documented QMS scope, quality policy and quality objectives (Clauses 4.3, 5.2 and 6.2).
Competence and measurement evidence: appropriate evidence of competence and of the fitness for purpose of monitoring and measuring resources. Calibration or verification evidence depends on the applicable measurement-traceability requirements (Clauses 7.1.5 and 7.2).
Operational information and evidence: what is needed to support processes and show that work followed the plan. Specific requirements address areas such as design and development, external-provider evaluation, release and nonconforming outputs, where applicable (Clauses 4.4 and 8).
Evaluation and improvement evidence: monitoring and measurement results, internal audit program implementation and results, management review results, and nonconformities and corrective-action results (Clauses 9–10).
These are examples, not a complete document-and-records list. Check the relevant clauses for the exact information and conditions that apply to your work. Our Clause 7 guide explains how to create, update, protect and control that information.
A quality manual, a particular software platform and a fixed set of procedure templates are not prescribed. You can use existing systems, electronic records or paper where suitable. A shared order system, for example, can hold current requirements and release evidence; it still needs appropriate access, change and retention controls. The format is flexible, but required information and reliable evidence are not optional.
Using the Plan–Do–Check–Act cycle
The Plan–Do–Check–Act (PDCA) cycle connects the requirements. Start with the context of your organization and leadership’s direction. Plan your objectives and actions, put the processes into practice, evaluate results and improve what is not working.
Plan: understand context, establish direction and plan the system (Clauses 4–6).
Do: provide support and run controlled operations (Clauses 7–8).
Check: evaluate performance through data, audits and management review (Clause 9).
Act: improve the system and address nonconformities and their causes (Clause 10).
Use the cycle repeatedly to manage and improve the system. Leadership and risk and opportunity considerations continue throughout the cycle.
How the requirements work together in a service business
Suppose a small maintenance company keeps receiving incomplete customer bookings. It identifies the effect on scheduling and customer requirements (Clause 4), assigns responsibility and sets an objective to reduce incomplete bookings (Clauses 5–6). It updates its booking instructions, coaches staff and checks their competence (Clause 7), then confirms job requirements before accepting the work (Clause 8).
The team monitors booking errors and customer feedback, checks the process through internal audit and reviews the results with management (Clause 9). If errors continue, it investigates the causes, takes the necessary action and checks whether the change worked (Clause 10). This is one connected business process, not seven separate paperwork projects. The example illustrates an approach; ISO 9001 does not prescribe a booking system or a particular improvement target.
What deserves attention in the 2026 edition?
The familiar structure remains, but an existing system needs a substantive review. The 2026 requirements explicitly address quality culture and ethical behavior in leadership and awareness; distinguish actions for risks from actions for opportunities; expand change planning; and strengthen the treatment of organizational knowledge. Audit objectives and management review inputs also deserve attention.
Clause 4 retains the requirement to determine whether climate change is relevant to the QMS. This originated in the 2024 amendment to ISO 9001:2015; it is not a new 2026 requirement. It does not automatically require every organization to establish emissions targets.
For an edition comparison, read our ISO 9001:2026 Changes guide. This requirements guide explains the current requirements, including those retained from the earlier edition.
Which requirements apply to your organization?
Define the scope of your QMS by considering your context, relevant interested-party requirements, and the products and services you provide. Apply every requirement that is applicable within that scope.
A requirement can be treated as not applicable only if this does not compromise your ability or responsibility to provide conforming products and services and enhance customer satisfaction. Explain and justify any non-applicability in your documented scope. Outsourcing a process does not remove your responsibility to control its effect on quality.
For example, design and development may be inapplicable to an organization that only supplies products fully specified by others. Check the actual work and responsibilities first: developing a service or deciding a product’s specifications can involve design even if no department is called “Design.”
Meeting the requirements and becoming certified
ISO 9001 defines requirements for your organization’s QMS. Certification is a separate, independent assessment by a certification body; ISO itself does not certify your business. You can use the standard without seeking certification, although customers or contracts may require it.
If certification is your goal, put the system into operation and gather evidence of its effectiveness, including internal audits, management review and necessary corrective actions. Agree the scope and applicable edition with your chosen certification body. Its audit and certification decision are separate from buying templates, completing training or receiving implementation support. Our ISO 9001 certification process guide explains the broader route from preparation to the external audit.
A practical starting point
1. Map the work: identify how a customer requirement moves from enquiry to delivery and follow-up.
2. Assign responsibility: establish who owns each process, what resources it needs and how results will be evaluated.
3. Check the gaps: compare existing practices and evidence with the applicable requirements, including the 2026 changes.
4. Improve proportionately: prioritize actions that matter to reliable delivery, customer satisfaction and QMS effectiveness.
5. Verify effectiveness: use performance information, internal audits and management review to check whether the changes work.
Use documentation that helps people perform and demonstrate the work. A useful instruction, a reliable record and a clear decision are more valuable than paperwork created solely to fill a folder.
Put the requirements into practice
Building your first QMS? Start with the way your business already works, compare it with the applicable requirements and add or improve controls where needed. Our certification process guide explains the implementation steps and available approaches. Keep effective existing processes and make the system useful to the people who run them.
Updating an existing ISO 9001:2015 system? Use our 2026 Changes guide to focus the review. Our ISO 9001:2026 Upgrade Kit provides structured resources for the changes.
For structured learning, explore our ISO 9001 online training. Choose training that fits your role and check the standard edition shown on the course page before enrolling.
Based on ISO 9001:2026, Quality management systems — Requirements. Clauses 4–10 explained in practical terms. Use the standard itself for the complete requirements. Examples illustrate possible approaches, not additional ISO requirements.
