ISO 9001:2026: what to do with suppliers’ ISO 9001:2015 certificates

Keep accepting your suppliers’ ISO 9001:2015 certificates for now, but stop trusting the expiry date printed on them. Under the transition rules for the new edition, accredited ISO 9001:2015 certifications end on 30 September 2029, whatever date the certificate shows. This guide covers what changed, which dates matter to a buyer, and what to record and ask.

What changed in ISO 9001:2026?

ISO published ISO 9001:2026 on 16 September 2026. ISO says the edition places greater emphasis on leadership, a culture of quality and ethical behaviour, and gives greater clarity on the consideration of risks and opportunities. It also adopts the latest Harmonized Structure shared by ISO management system standards.

The transition requirements_ISO_9001_2026_Transition_v1_03.pdf) from Global ACI (Global Accreditation Cooperation Incorporated) list the changes in more detail. Clause 5.1.1 adds promoting quality culture and ethical behaviour. Clause 6.1 is split into determining risks and opportunities, actions to address risk and actions to address opportunities. A new Annex A clarifies key terms and the intent of the requirements. Global ACI’s own assessment is that “the overall changes to the document are minimal”.

Which transition dates matter to a buyer?

Suppliers can transition at a scheduled surveillance or recertification audit, or at a separate transition audit, and the certification body may run it remotely if it can show the audit’s objectives are met.

Why can a certificate’s printed expiry date be wrong?

Because the transition rules don’t require certification bodies to reissue existing certificates. The Global ACI document_ISO_9001_2026_Transition_v1_03.pdf) says accredited ISO 9001:2015 certifications are “no longer valid” after 30 September 2029. In a note, it adds that “it is not necessary to modify current / existing ISO 9001:2015 certificates to reflect an expiry prior to the certification cycle”. A certification body may shorten the date to reduce confusion, but it doesn’t have to.

Certification cycles typically last three years; Bureau Veritas, for example, describes its cycle that way. So a supplier recertified to ISO 9001:2015 in 2027 can hold a certificate showing an expiry in 2030. Unless the supplier transitions first, that certificate stops counting on 30 September 2029, and the PDF in your files won’t say so.

The same applies when a supplier chooses not to transition. Global ACI requires the certification body to tell that supplier its certification will expire at the end of the transition period, even where that is before the end of its current cycle.

What should buyers do now?

• Keep accepting ISO 9001:2015 certificates that are otherwise current; they stay valid until 30 September 2029.
• For each 2015 certificate whose printed expiry is after 30 September 2029, record 30 September 2029 as the date it stops counting.
• Ask key suppliers when their transition audit is planned, and whether their certification body is transitioning.
• Update requirement wording: either edition until 30 September 2029, ISO 9001:2026 after that.
• When the 2026 certificate arrives, look it up in IAF CertSearch or the certification body’s register, and compare the company, sites, scope and dates again.
• Treat a supplier certified for the first time after 31 March 2028 on ISO 9001:2015 as a question for its certification body.

The full register check, from the certification body to the scope, is in our guide on how to check an ISO 9001 certificate.

How does Vendarity handle the transition date?

When you accept a certificate, record its Next review date beside the expiry date. Vendarity treats an accepted document as current until its expiry date or its review date, whichever comes first. A 2015 certificate given a review date of 30 September 2029 then shows Review overdue after that date, not current until its printed expiry. Once an Owner or Admin turns on automatic reminders, the standard schedule asks the supplier contact for the replacement 30, 14, 7 and 1 days before that date. Vendarity doesn’t check certificates with the certification body or a register; the review records that a person did.