ISO 9001:2026 Key Changes Every Malaysian Business Should Know

ISO 9001:2026 was published on 16 September 2026, replacing ISO 9001:2015 as the current version of the standard. Organisations certified to the 2015 version have until 30 September 2029 to complete their transition. This guide explains what changed, across every affected clause, and what your QMS needs to address before the deadline.

What Is ISO 9001:2026 and Why Was the Standard Revised?

ISO 9001 is the international standard for Quality Management Systems. ISO 9001:2026 is the sixth edition and builds on the High Level Structure and process approach introduced in 2015. The revision was driven by the need to incorporate a decade of implementation experience, embed the 2024 climate change amendment into the core text, and sharpen requirements in areas such as quality culture, knowledge management, and change planning.

The changes are moderate compared to the 2015 revision. The familiar Clauses 4 to 10 structure, the PDCA cycle, and the process approach remain unchanged. What has changed is the precision of specific requirements and the explicit addition of new obligations in several clauses. ISO 9001:2026 also introduces a new Annex A, the first formal informative annex in the standard’s history, providing approximately 15 pages of interpretive guidance on quality culture, technology, remote working, and the risk and opportunity process. Annex A does not add new requirements but will influence how auditors interpret the standard.

If you want an overview of what ISO 9001 certification involves before reviewing the changes, see our guide to ISO 9001 certification in Malaysia.

What Changed in Clause 4 for Context and Interested Parties?

Clause 4 has two meaningful changes that go beyond the commonly discussed climate addition.

Clause 4.1 now explicitly requires organisations to determine whether climate change is a relevant external issue affecting their ability to deliver conforming products and services. The climate provisions were originally introduced in a 2024 amendment to ISO 9001:2015; ISO 9001:2026 incorporates them into the core text. If you properly implemented the 2024 amendment, this is not entirely new. If you did not, it is a genuine gap to close. The assessment must be documented; assuming irrelevance is not sufficient.

Clause 4.2 introduces a new requirement at 4.2(c) that is operationally significant: organisations must now explicitly determine which relevant interested-party requirements will be addressed through the QMS. A stakeholder register that lists customers, regulators, and suppliers and summarises their expectations no longer satisfies the standard. You must document which specific requirements each party has, and which of those the QMS is responsible for meeting. For each, identify the QMS process and the person responsible. This is the most operationally impactful change in Clause 4 and the one most likely to produce an audit finding in organisations that carried over a generic stakeholder matrix from the 2015 era.

For organisations also working towards or maintaining ISO 14001 certification, the Clause 4.1 and 4.2 climate requirements align with ISO 14001’s context requirements, making integrated implementation more efficient.

What Changed in Clauses 5 and 6 for Leadership, Risks and Change Planning?

Clause 5.1.1 now lists 12 leadership commitments, up from 10 in the 2015 edition. The two additions are the explicit duty to promote a quality culture and ethical behaviour throughout the organisation, and the separate promotion of opportunity-based thinking alongside risk-based thinking. Auditors will look for evidence of how leadership reinforces quality culture in practice, not just a signed quality policy. Clause 7.3 on Awareness and Clause 7.1.4 on the environment for operation of processes are also updated to reflect that quality culture and ethical behaviour are now named factors.

Clause 6.1 has been restructured into three subclauses: 6.1.1 for general determination, 6.1.2 for actions to address risks, and 6.1.3 for actions to address opportunities. Risks and opportunities now require separate analysis, evaluation, and action planning. If your risk register treats both in a single table without distinction, your process and documentation will need to be updated. A single planning tool can still cover both, but the standard now requires the two to be addressed through distinct cycles.

Clause 6.3 on Planning of Changes has been expanded from four considerations to seven. In addition to the 2015 requirements to consider the purpose, consequences, QMS integrity, and resources, the 2026 version adds: communication of the change to those affected, how effectiveness will be monitored and evaluated, and how the results will be reviewed. Change management now demands a feedback loop, not just a plan.

For a detailed transition planning guide, see our article on how to transition from ISO 9001:2015 to ISO 9001:2026 in Malaysia.

What Changed in Clause 7 for Knowledge, Support and Awareness?

Clause 7.1.6 on Organisational Knowledge has been broadened in ISO 9001:2026. Under the 2015 edition, the knowledge requirement focused on the knowledge needed to operate processes and achieve product conformity. The 2026 version extends this: organisations must now maintain the knowledge needed to achieve the results of the whole QMS, not just operational outputs. Keeping, using, and sharing that knowledge are explicit requirements. This matters practically when experienced staff leave, when responsibilities shift, or when processes change. Before a key person leaves, their knowledge of how to interpret unusual customer requirements, manage a critical supplier, or run an internal audit effectively must be transferred and made usable. In our work with Malaysian businesses, knowledge loss at staff transitions is a recurring gap that often goes undocumented.

Clause 7.3 on Awareness adds a fifth item: personnel must now be aware of the organisational quality culture and ethical behaviour expected of them, in addition to the four 2015 requirements covering the quality policy, objectives, contribution to QMS effectiveness, and consequences of nonconformity. Clause 7.5 on Documented Information introduces a terminology cleanup throughout the standard: the 2015 phrasing of “maintain” and “retain” documented information is replaced with unified “available as documented information” language. The underlying obligation to keep and control records is unchanged, but your documented procedures and training materials referencing the old terminology will need updating.

What Changed in Clauses 8, 9 and 10 for Operations, Audits and Improvement?

Clause 8.2.1 on Customer Communication has been expanded to explicitly cover how your organisation will communicate with customers about contingency actions when a disruption to product or service delivery occurs. If a supplier failure affects an order, your QMS must now address how and when you communicate alternative arrangements to customers. Clause 8.2.4 adds a requirement to communicate changes to requirements to all relevant interested parties and retain evidence that the updated requirements have been transmitted.

Clause 9.2.2 on Internal Audits introduces a new explicit requirement: each internal audit must now have a documented objective, alongside its existing scope and criteria. Previously, the standard required audits to be planned and conducted but did not mandate a stated objective for each. Under ISO 9001:2026, your audit plan must state what each audit is intended to assess or verify, and the audit report should answer that objective. In our work with Malaysian companies, internal audits frequently operate as compliance checklists without a clear purpose; the new requirement pushes that practice toward more useful, outcome-oriented auditing.

Clause 9.3.2 on Management Review Inputs now adds two separate items covering the effectiveness of actions on risks and the effectiveness of actions on opportunities, which must now be reported and reviewed independently. Clause 10 has been renumbered: Continual Improvement moves from 10.3 to 10.1 (absorbing the former General clause), and Nonconformity and Corrective Action moves from 10.2, where it stays. Update any internal references to the former clause numbers in your QMS documentation.

When Must Malaysian Organisations Transition to ISO 9001:2026?

The transition period is three years from the publication date of 16 September 2026. All ISO 9001:2015 certificates become invalid after 30 September 2029. Certification bodies operating in Malaysia, including SIRIM QAS International, SGS Malaysia, Bureau Veritas Malaysia, TUV SUD Malaysia, and LRQA Malaysia, will offer transition audits within this window, typically integrated into scheduled surveillance or recertification audits.

The transition does not require a full recertification from scratch. A transition audit focuses on the gap between your current documented system and the ISO 9001:2026 requirements. For most organisations, the gap analysis should concentrate on Clause 4.2(c) (interested-party requirements linked to the QMS), Clause 6.1 (separated risk and opportunity registers), Clause 6.3 (updated change management procedure), Clause 7.1.6 (knowledge management), Clause 7.3 (updated awareness training), and Clause 9.2.2 (internal audit objectives). Malaysian organisations should begin their gap assessment well in advance of the 2029 deadline. A six to twelve month lead time for documentation review, internal audit, and transition audit scheduling is a reasonable planning window.

For a full clause-by-clause breakdown of what ISO 9001 requires, see our guide to ISO 9001 requirements explained.

ISO 9001:2026 is an evolution, not a revolution. Organisations with a well-maintained QMS will find the transition manageable. The areas that require the most attention are Clause 4.2(c) (linking interested-party requirements to specific QMS processes), quality culture documentation in leadership and awareness, organisational knowledge management, the restructured risk and opportunity process, and the expanded change management procedure. Getting your gap analysis done early gives you time to address these systematically rather than under deadline pressure.

If your organisation is currently certified to ISO 9001:2015 or planning to pursue ISO 9001 certification for the first time, contact Connext to discuss what ISO 9001:2026 means for your QMS and how to plan your transition.

Frequently Asked Questions

Is ISO 9001:2026 mandatory or can we stay on ISO 9001:2015?

ISO 9001:2015 certificates remain valid until 30 September 2029. After that date, all certified organisations must hold a valid ISO 9001:2026 certificate. Staying on the 2015 version beyond 2029 means losing certification status.

What is the biggest practical change that will affect our day-to-day QMS?

Clause 4.2(c) is the most operationally impactful new requirement: you must now explicitly document which interested-party requirements your QMS will address and which process owns each. Most organisations carry over a generic stakeholder matrix from 2015 that does not go this far. Close behind it is Clause 7.1.6 on knowledge retention and Clause 6.3 on change management, which now requires communication planning and post-implementation effectiveness review.

Does ISO 9001:2026 require us to set carbon reduction targets?

No. ISO 9001:2026 requires you to assess whether climate change is relevant to your context and document that assessment. It does not require a decarbonisation plan, carbon targets, or environmental reporting. The climate requirement was first introduced in the 2024 amendment to ISO 9001:2015 and is now embedded in the 2026 core text.

What is the new requirement for internal audits?

Clause 9.2.2 now requires each internal audit to have a documented objective, in addition to its existing scope and criteria. Your audit plan must state what each audit is intended to verify or assess, and the audit report should answer that objective. This moves internal audits from compliance checklists toward outcome-oriented assessments.

What is Annex A and do we have to comply with it?

Annex A is informative, not mandatory. It provides approximately 15 pages of guidance on quality culture, technology, remote working, and the risk and opportunity process. You are not required to follow it, but auditors will use it to interpret requirements. Understanding its content will help you anticipate auditor expectations, particularly around quality culture and the separated risk and opportunity subclauses.