ISO 9001:2026 was published on 16 September 2026. What changed and which transition period applies is set out in ISO 9001:2026 is published: what is confirmed and what is not. This page addresses one question: what does that edition mean when you already run an ISO 27001 ISMS?
The short answer is that your head start is larger than you expect on method, and smaller than you hope on evidence.
Share workflows without merging the scopes
A single review meeting can discuss both systems, but its decisions must still address each system’s objectives separately. A security risk register does not become a complete quality analysis by changing its title. Keep it visible in the minutes which decision belongs to which system; that is exactly what an auditor checks in a combined management system.
Where your ISMS has already done the work
The direction of the 2026 revision runs parallel to what ISO 27001 already requires. On these points you need no new process, only a wider scope: from information security to quality.
| Shift in 9001:2026 | What your ISMS already provides |
|---|---|
| Assessing risks and opportunities separately | A risk method with criteria, weighting and treatment decisions. |
| Change management as an explicit requirement | Controlled implementation of changes, including fallback. |
| Demonstrable competence | Awareness and competence records per role. |
| Structured supplier monitoring | Supplier assessment and performance arrangements. |
| Climate change in context | The same provision entered both standards together in 2024. |
| Document control and internal audit | One audit programme and one document control suffice. |
Where your ISMS gives you no evidence
This is where the overlap ends. These subjects sit outside an ISMS however mature it is, because they concern the customer and the product rather than information.
- Customer satisfaction. Your ISMS measures incidents and availability, not customer judgement. The 2026 edition also widens where that judgement may come from.
- Post-delivery activities. Maintenance, reuse and disposal of what you supply, with the responsibility attached.
- Quality culture and ethical conduct. Named as a management responsibility and tied to strategy. This is new work for almost everyone.
- Operation and product realisation. Clause 8 as a whole has no counterpart in an ISMS.
The trap: the same method is not the same evidence
An existing ISMS is a usable starting point for method and not evidence that quality management requirements are met. The objectives and scopes differ. Reference the ISMS process from your quality system where that is accurate, but state the quality objective separately and demonstrate separately that you meet it.
What to tackle first
- Mark, for each changed requirement, whether your ISMS covers it, partly covers it or does not touch it.
- Work the “not touched” rows first; that is where your real work sits.
- Check that shared processes actually name the quality objectives and not only the security objectives.
- Split your management review into agenda items per system, even if it remains one meeting.
The project approach for the transition itself, including sequence and comparison register, is in ISO 9001:2026: what you can do now.