ISO 9001 — Quality management systems
What is ISO 9001?
ISO 9001 is the international standard that sets out the requirements for a quality management system. It doesn’t tell you what your product should be like; it tells you how your company should run its processes so that the result is predictable and repeatable.
Many people assume otherwise, but the standard itself is clear: ISO 9001 is about the quality of management, not the quality of the product. A certificate doesn’t mean your product is the best on the market; it means your company has an organised way of working — defined processes, responsibilities, records and a way of correcting mistakes when they happen.
The standard applies to any sector and any size of company, from a two-person business to a large organisation. The certificate is not issued by the consultant but by an accredited certification body, after an on-site audit; the consultant prepares the company for that audit.
The seven principles behind the standard
ISO 9001 is built on seven quality management principles. They aren’t requirements that are audited point by point, but they explain why the standard asks for what it does:
- Customer focus — the starting point is what the customer was promised and whether it was delivered.
- Leadership — top management sets the direction and is accountable for the system, rather than leaving it to one person.
- Engagement of people — the system only works if the people running it know why they do what they do.
- Process approach — work is seen as a chain of processes with inputs, outputs and an owner, not as a set of departments.
- Improvement — the system has to keep changing, or it falls behind the work it describes.
- Evidence-based decision making — measurements and data instead of impressions.
- Relationship management — suppliers and partners affect your quality, so those relationships are managed too.
ISO 9001:2015 and the new ISO 9001:2026
ISO 9001:2026 was published on 16 September 2026. Certificates to ISO 9001:2015 remain valid until the end of the transition period on 30 September 2029. From 31 March 2028, new certifications are issued only against the 2026 edition. These dates are set by Global ACI (Global Accreditation Cooperation), which took over the work of the International Accreditation Forum (IAF) in January 2026. A certification body can certify to the 2026 edition once its own accreditation has been extended to cover it.
The new edition keeps the existing framework — the process approach, the structure and the core requirements — and builds on it in several ways: quality culture and ethical behaviour, which top management must now actively promote rather than take for granted; a clearer separation between risks and opportunities, with clause 6.1 split into sub-clauses; and climate change, added by amendment in 2024 and now written into the text of the standard itself. Quality culture doesn’t stop with management: staff must also be aware of it and of ethical behaviour, which in practice usually means training, with evidence that it took place.
If you are implementing ISO 9001 now, nothing is lost: the changes add to an existing system rather than replace it, and until 31 March 2028 you can still be certified to the 2015 edition and move across later. We contact existing clients with an assessment of what needs to be updated.
Who implements it and why
ISO 9001 is the most widely used management system standard and applies to organisations of any size and sector — manufacturing, services or the public sector. The standard doesn’t prescribe what a product or service should be like, but how you manage things so that they are what you promised.
The reasons for implementing it usually fall into three groups:
- A requirement in a tender or supply chain — the most common, and usually with a deadline.
- A request from a customer or parent company, especially when exporting.
- An internal need — when a company has grown so much that work can no longer be run on informal, on-the-spot agreements.
When the need is internal, the system is built around the real work rather than around the audit, so the documentation needs rewriting less often after the audit.
How it is implemented, step by step
- Understanding your context and interested parties — who your customers, partners and regulators are, and what they expect from you.
- Defining the scope — which activities, sites and processes the system covers.
- Mapping processes — which processes exist, how they connect, who is responsible for each and how each is measured.
- Quality policy and objectives, with measures and deadlines.
- Risks and opportunities for each significant process, with actions.
- Documented information — only what the standard requires and what your work can’t run reliably without.
- Control of delivery, nonconformities and complaints, including measuring customer satisfaction.
- Internal audit and management review, followed by the certification audit if a certificate is the goal.
What actually changes
If ISO 9001 is implemented just for the paperwork, very little changes. If it is implemented properly, what changes is who is responsible for what.
- Every process has an owner, so problems don’t get stuck between two departments.
- Complaints are recorded and analysed, so the cause is removed instead of the customer being compensated every time.
- New employees have something to work from, because procedures don’t live only in colleagues’ heads.
- Suppliers are selected and evaluated against criteria, not out of habit.
- Decisions are based on data that is collected regularly.
- For tenders and exports, you have the evidence that is asked for.
A quality manual is no longer required
Thinking you still need one is a misconception the standard explicitly clears up. The 2015 edition removed the requirement for a quality manual and for a management representative for quality. Both were mandatory in earlier editions and are still produced out of habit.
Instead of a prescribed list of documents, the standard asks for ‘documented information’ — the information it explicitly names, plus whatever the organisation needs for its processes to run reliably. What exactly that means is up to the organisation, but it must be able to justify its decision.
The practical consequence: five useful documents that people actually work by are worth more than fifty sitting in a folder. The audit looks at whether people work by them, not at how many there are.
Process approach and risk-based thinking
The standard treats these as two separate concepts, but they are easily confused.
The process approach means describing work as a series of processes that pass their results on to one another — each with a clear input, output, responsible person and measure. A typical mistake is to draw the processes from the organisation chart, which gives you a picture of departments instead of a picture of the work.
Risk-based thinking doesn’t mean you have to keep a risk register. The standard prescribes no method or form — it asks that risks and opportunities are considered in planning, and that you can show your actions follow from that. A register is one way of doing it, not an obligation.
Climate change in the organisation’s context
Climate change became part of the context review through an amendment in February 2024, and the 2026 edition builds it into the text of the standard itself. The organisation must determine whether climate change is a relevant issue for it; a note adds that interested parties can have requirements related to it.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your quality management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 9001 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. In companies that already have documented working procedures, most of the work is aligning them with the requirements and starting to measure. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Do we need a quality manual?
No. The standard hasn’t required one since the 2015 edition. If it helps people understand the system, you can have one — but not having a manual is not a nonconformity.
Do we have to certify the whole company?
No. The organisation defines the scope, and it is stated on the certificate. A requirement that doesn’t apply to your work can be treated as not applicable, but this must be justified and must not affect your ability to deliver what you have promised.
Does ISO 9001 mean a better product?
The standard doesn’t set a level of product quality. It requires a system that ensures the product or service is what you promised, consistently and repeatably, and that deviations are corrected.
Can it be combined with other standards?
Yes, and that is the most cost-effective approach. ISO 9001, 14001, 45001, 50001, 22301 and 27001 share the same harmonised structure, so the context, policy, internal audits and management review are done once for all the systems.
Does ISO 9001 require a management representative?
No. The 2015 edition removed that requirement — it existed in the 2008 edition. Responsibilities and authorities must still be assigned and communicated, but the standard doesn’t require one named person to hold them.
Does the standard require a risk register?
No. ISO 9001 requires that risks and opportunities are identified and addressed, but it prescribes no format or document. A register is one possible solution. The audit looks for evidence that risks were considered and that actions were built into planning — not for a spreadsheet.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 14001 — environmental management; shares its structure and most of its documentation with ISO 9001.
- ISO 45001 — occupational health and safety; with ISO 9001 and ISO 14001 it makes up the most common integrated management system.
- ISO 13485 — quality management for medical devices; derived from ISO 9001, but with a different aim and structure.
- HACCP — a legal requirement for food businesses in Serbia; the starting point in the food industry.
- ISO 22000 — food safety, for production and the whole food chain.
- ISO 37001 — anti-bribery; shares its structure and documentation with ISO 9001.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
- ISO 21001 — derived from ISO 9001 for educational organisations, with the focus on learners’ needs.
- ISO implementation — what the implementation work itself involves.
How STANDARDISO can help
We guide you through the whole process — from mapping your processes and defining the scope, through the policy, objectives and documented information, to the internal audit and management review. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.