Quality management system
ISO 9001: implementing and certifying your quality management system
ISO 9001 is the most widely applied management standard in the world, and in most markets it is the condition without which a company does not enter a public tender or a large customer’s supply chain. We build a system your team actually uses — not a folder opened only before an audit.
1M+certificates worldwide
3–6 mo.typical implementation
3 yearscertificate validity
16.09.2026new version published
In short
What ISO 9001 is
Short answer
ISO 9001 is the international standard that sets the requirements for an organisation’s quality management system. It does not describe what your product should be; it describes how to manage your processes so the result is consistent and what you promised the customer is delivered every time.
That distinction matters and is often misread. An ISO 9001 certificate is not a mark that your product is of high quality in absolute terms — it is evidence that you have a working mechanism: defined processes, measurable objectives, supplier control, management of nonconformity, and a regular check that all of it produces results.
The standard is built on the process approach and the Plan–Do–Check–Act cycle, with requirements spread across seven applicable clauses. That is precisely why the same standard works for an engineering plant, an accountancy firm and a municipal administration.
A word on terminology. “ISO 9001 certification” means an accredited certification body has assessed your system. Companies selling a “certificate in three days” without an on-site audit issue a document with no standing — the difference is explained in our article on accreditation versus certification.
Current
ISO 9001:2026 has been published
The new edition of the standard was released on 16 September 2026 and the three-year transition period has started. If a first certification is ahead of you, this changes your plan.
Transition into late 2029
ISO 9001:2015 certificates stay valid through the transition period. The exact end dates are confirmed by the accreditation body.
Climate and quality culture
Climate change enters the context analysis, while quality culture and ethical behaviour become explicit requirements.
Not a rewrite from scratch
The ten-clause structure is retained. For most organisations the transition is an addition to the existing system, not a new project.
Practical recommendation: if you are starting now, we build the system directly against the new edition, so you do not pay twice for the same work. A detailed breakdown is in ISO 9001:2026: what changes and how to plan the transition.
Why it pays
What you actually get
The certificate is the visible part. The benefits that remain after the audit are in how the organisation works.
Access to public tenders
ISO 9001 is among the most frequently required selection criteria. Without it a bid fails at the document check — see which certificates tenders require.
Approval by large customers
Corporate buyers require a certificate before approving you as a supplier, and it is often the precondition for a supplier audit.
Fewer repeat failures
Nonconformity management and root cause analysis break the cycle of the same problems returning every year.
Less dependence on individuals
Described processes and a competence matrix make the company less fragile when a key person is away or leaves.
Access to funding
Some European programmes recognise or require a certified system — see which standards funding calls expect.
International recognition
A certificate from an accredited body within the international mutual recognition framework is accepted abroad without further checks.
Applicability
Who the standard suits
ISO 9001 is not sector-specific — its requirements are written so they apply to any activity, whatever the size of the organisation.
Manufacturing
Process control and product characteristics, batch traceability, management of measuring equipment.
Services and construction
Standardised delivery, clear acceptance criteria and documented customer communication.
Small and medium firms
A system proportionate to the company’s size. What that looks like for a team under 20 — see here.
Public sector
Transparent administrative processes, measurable satisfaction and clear responsibility by role.
What the standard contains
What ISO 9001 actually requires
The requirements sit in clauses 4 to 10. The table shows what stands behind each and what the auditor will ask to see.
| Clause | What it requires | What you show at the audit |
|---|---|---|
| 4. Context | External and internal issues, interested parties, scope, processes | Context analysis, process map, defined scope |
| 5. Leadership | Management commitment, quality policy, assigned responsibilities | Policy, assignment of roles, participation in the review |
| 6. Planning | Risks and opportunities, measurable objectives, planning of changes | Risk register, objectives with indicators and deadlines |
| 7. Support | Resources, competence, awareness, communication, documented information | Competence matrix, training records, document control |
| 8. Operation | Control of production or service, customer requirements, suppliers, nonconforming output | Contracts and reviews, supplier criteria, inspection records |
| 9. Evaluation | Monitoring, satisfaction, internal audit, management review | Indicators, audit reports, review record |
| 10. Improvement | Nonconformity, corrective action, continual improvement | Nonconformity register with demonstrated effectiveness |
What is not mandatory: since 2015 the standard requires neither a quality manual nor six documented procedures. It requires documented information where it is needed to control the process. Companies still maintaining a hundred-page manual are usually maintaining a document nobody reads.
How we work
The route to the certificate, step by step
The timings below are realistic for an organisation with one site and up to around 50 employees.
- 1
Gap analysis
We review how you work today against the requirements. The output is a list of concrete gaps and a plan — no generalities.
2–5 working days - 2
Building the system
We describe the processes, set objectives and indicators and produce only the documents that will actually be used, starting from your existing practice.
4–8 weeks - 3
Implementation and training
We train the team on the new rules and train your internal auditors. From here the system starts producing the records the auditor will want.
2–4 weeks - 4
Internal audit and management review
We run a full internal audit and prepare the management review. Both are mandatory before the external audit.
1–2 weeks - 5
Certification body and audit
We help select an accredited body and prepare for the two-stage audit, and we attend it. What to expect is in our audit preparation guide.
4–8 weeks to certificate - 6
Maintaining the certificate
The certificate is valid for three years subject to successful surveillance audits. We support the internal audits and reviews throughout the cycle.
annually
Further reading
More on the topic
New versionISO 9001:2026 — what changes and how to plan the transition
ProcessHow to get an ISO certificate: a complete guide
PreparationPreparing for the certification audit
Small firmsISO 9001 for companies under 20 people
Clause 9.3Management review without the formality
Clause 10.2Corrective actions and root cause analysis
TrainingInternal auditor training to ISO 19011:2026
Clause 6.1Risk management to ISO 31000
IntegrationIntegrated management system
Questions and answers
Frequently asked questions
How long does ISO 9001 certification take?
For an organisation with one site and up to 50 employees the typical timeline is three to six months from project start to certificate. The longest part is implementation — the system has to run long enough to produce the records the auditor checks. With several sites or complex manufacturing it reaches eight months.
How much does ISO 9001 certification cost?
The cost has two independent parts: the consultancy work to build the system and the fee of the accredited certification body. The body’s fee depends on the mandatory number of audit days set by accreditation rules against your headcount and scope. For a specific quote we need the number of employees, the number of sites and the desired scope.
Do we have to change the way we work entirely?
No. The standard requires processes to be defined, controlled and measured, but does not prescribe what they should look like. The right approach is to describe your existing practice, add what is missing and remove what does not work. A system that contradicts the real work is abandoned after the first audit.
Is the certificate valid abroad?
Yes, provided it was issued by a certification body holding valid accreditation. Accreditation is recognised internationally through mutual recognition arrangements, so a certificate from an accredited body is accepted in other countries. A document from a non-accredited provider does not carry that recognition.
Is a quality manual mandatory?
No. The requirement for a manual and for six documented procedures was dropped in the 2015 revision. The standard requires documented information only where it is necessary to control processes. In practice most organisations need a policy, objectives, a description of the processes and a limited set of procedures and records.
Should we wait for ISO 9001:2026 if we are starting now?
There is no need to wait. The new version was published on 16 September 2026 and the system can be built directly against its requirements, avoiding duplicated work later. If you already hold a 2015 certificate it stays valid through the transition period, and the transition is planned at the next surveillance or recertification audit.
How many internal auditors do we need?
In practice the minimum is two, because an auditor cannot audit their own work and with one trained person some processes stay uncovered. For most small and medium organisations two to three trained auditors from different departments are enough, provided they actually conduct audits at least once a year.
What happens after the certificate is issued?
The certificate is valid for three years. In years one and two the certification body conducts a surveillance audit with a smaller scope, and at the end of year three a recertification audit of the whole system. Throughout, you must keep running internal audits, management reviews and records, or the certificate can be suspended.
Can ISO 9001 be combined with other standards?
Yes, and it is usually more economical. ISO 9001, ISO 14001 and ISO 45001 share a common ten-clause structure, so context, leadership, competence, internal audit and management review are done once for all of them. A combined certification audit is shorter than three separate ones and reduces the total fee.
Let’s start with a gap analysis
About an hour of conversation is enough to say what you are missing against the standard, how long it will realistically take and in what order to proceed. No commitment and no template offers.