Market Watch

Loading metals, manufacturing indicators, and industrial stocks...

MANUFACTURINGMAG
What a Machine Shop Has to Rewrite for ISO 9001:2026
Quality & Compliance

What a Machine Shop Has to Rewrite for ISO 9001:2026

Manufacturing Mag Staff·September 3, 2026

This article may contain AI-assisted content. Verify details with primary sources before acting on them.

Share:
Share

Why It Matters

The sixth edition of ISO 9001 publishes 16 September 2026, and the committee that owns the standard has confirmed it. Almost everything else you have been told about the transition — including the deadline — is anticipated rather than published. For a machine shop, the real work is three procedures deep.

The date is real. ISO/TC 176/SC 2 — the subcommittee that actually owns ISO 9001 — has confirmed that ISO/FDIS 9001 "has been approved with overwhelming international support" and that the sixth edition is scheduled for publication on 16 September 2026. If you have seen "fall 2026" or "October" on a certification body's website, that page is stale. Go to the committee.

The deadline is not real yet. The three-year transition ending around September 2029 that appears in most vendor emails is an expectation, not a published requirement. IAF issues formal transition rules after publication, and DNV's own guidance notes that IAF typically grants "2 or 3 years." LRQA is careful about it too, describing a three-year window as "anticipated, consistent with recent ISO management system revisions." Plan against three years. Do not put it in your quality manual as a fact.

The third thing worth saying before anyone quotes you for a gap assessment: your ISO 9001:2015 certificate stays fully valid for the entire transition period. Nobody loses certification on publication day. There is no early re-certification requirement. A shop that gets a transition proposal priced like a fresh certification project is being sold scope it does not have.

What changed, and what did not

The revision is evolutionary, and that is the whole basis for the strategy in this article. LRQA states plainly that "the process approach, Plan-Do-Check-Act cycle and risk-based thinking remain central." The Harmonized Structure survives. Clause numbering 4 through 10 survives. That means the overwhelming majority of a machine shop's documented system does not need new text — it needs a pointer showing where it lands in the new clause set.

ChangeClauseWhat it means on the floorQuality culture and ethical behaviour become leadership requirements5.1.1Real work. Needs sampleable evidence, not a poster.Risks and opportunities separated into distinct requirements6.1.1 / 6.1.2 / 6.1.3Real work. The single most common rework item.Change management strengthened toward structured oversight6.3Records usually exist. They are not linked to the QMS.Awareness extended to culture and ethical decision-making7.3Training deck and onboarding content update.Core QMS terms carried in-standard rather than only in ISO 90003Low priority unless your procedures quote definitions.Continual improvement consolidated, with digitalization and reliable data as inputs10.1Relevant if you collect machine data you never feed into improvement.Annex A substantially expandedAnnex AInformative. No "shall." Not auditable on its own.What did not change: the process approach, PDCA, risk-based thinking, the Harmonized Structure, and clause numbering. Your calibration system, control plans, first-article process, nonconforming material flow, corrective action loop, internal audit program, and supplier controls are, in substance, untouched.

The rewrite list — the short one

1. Split the risk register

Clause 6.1 splits into 6.1.1 (general determination), 6.1.2 (actions to address risks), and 6.1.3 (actions to address opportunities). If you run one combined risk-and-opportunity spreadsheet — and most shops that certified after 2015 do — you now need to demonstrate two distinct methodologies. Not two tabs of the same severity-times-occurrence math with the sign flipped. A risk method that ranks by consequence and likelihood, and an opportunity method that ranks by something an operations person would recognize: throughput gain, scrap reduction, a capability you do not have today and a customer keeps asking for.

Practically: keep your existing risk lines. Pull the opportunity lines into a second register with its own scoring basis and its own review cadence, and reference both from your management review agenda. Budget half a day.

2. Carry quality culture and ethics into the leadership procedure

Clause 5.1.1 makes promoting quality culture and ethical behaviour a leadership requirement rather than an implied expectation, and DQS rates it a high-priority change. This is the item most likely to be handled badly, because the instinct is to buy signage. See the section below on what a registrar can actually sample.

3. Update awareness training content for 7.3

ERM CVS flags the extension of clause 7 competence and awareness to ethical decision-making. Today your awareness training tells an operator the quality policy exists and what their contribution to the QMS is. It now needs to cover how to make a call when quality and something else disagree. That is one slide added to an onboarding deck, plus a re-signature cycle for existing staff at your next all-hands. Budget two hours of prep and one training session.

That is the rewrite list. Three items.

The mapping list — the long one

Everything else is a cross-reference exercise. Because the clause structure is retained, a one-page table from your existing document numbers to 2026 clause numbers is sufficient evidence that your system addresses the standard. It looks like this:

Your document2015 clause2026 clauseActionQP-07 Calibration and Measurement Traceability7.1.57.1.5Map onlyQP-12 Control Plans and Process Monitoring8.5.18.5.1Map onlyQP-14 First Article Inspection8.3.4 / 8.68.3.4 / 8.6Map onlyQP-18 Control of Nonconforming Output8.78.7Map onlyQP-19 Corrective Action10.210.2Map onlyQP-21 Internal Audit9.29.2Map only; update audit checklist wordingQP-05 Purchasing and Supplier Control8.48.4Map onlyQP-02 Context and Interested Parties4.1 / 4.24.1 / 4.2Confirm climate determination is recordedQP-03 Risk and Opportunity6.16.1.1 / 6.1.2 / 6.1.3Rewrite — splitQP-01 Management Responsibility and Review5.15.1.1Rewrite — culture and ethics evidenceQP-09 Training and Awareness7.2 / 7.37.2 / 7.3Rewrite — content updateECN log / process change requests / machine move records—6.3Link — see belowPrint that. It is the first document you hand an auditor at the transition audit, and in most shops it is the majority of the deliverable.

Clause 6.3 is where the paperwork is already sitting

Planning of changes has been strengthened toward structured oversight of planned changes — with communication, monitoring and review of the change, per ERM CVS's FDIS analysis. Read that as a machine shop and it describes what you already do: an engineering change notice when a customer revises a print, a process change request when you move an operation from the Haas to the Mazak, a relocation record when a machine gets rigged to a different bay and requalified.

The failure mode is not that the records are missing. It is that they live in engineering, maintenance, and production systems that were never referenced from the QMS, so when the auditor samples clause 6.3 the quality manager has nothing to open. Fix it by adding a single clause to your change procedure that names those record types as 6.3 evidence, and by adding a change-review line to the management review agenda so there is a documented monitoring-and-review step. Do not create a new change form. A new form is a second, worse copy of records you already keep, and it will drift.

Quality culture without the poster campaign

An auditor cannot sample a slogan. Here is what they can sample in a 40-person shop:

  • Documented stop-work authority. A one-paragraph statement, signed by the owner or GM, that any operator may stop production on a suspected quality issue without seeking approval, and the record of at least one instance where someone used it.
  • An escalation path for the schedule-versus-dimension conflict. Written down: who decides when a feature is at the low limit and the truck leaves at four. Name the roles. Then keep the emails from the last time it happened.
  • Management review minutes that show the conflict was discussed. Not "quality objectives reviewed — on target." A minute that records a real tension, what was decided, and who owned the follow-up. This is the single highest-value artifact for 5.1.1 and it costs nothing but honest minute-taking.
  • An anonymous or low-friction route to raise a concern, and evidence it has been used or at least communicated.

Four items, all of which a shop with a functioning quality culture already has in substance. The transition work is writing them down.

Annex A is a defense, not a burden

Annex A is significantly expanded, with guidance mapped across clauses 4 through 10. It is also informative. It contains no "shall" statements, which means no registrar can raise a nonconformity against Annex A alone. Nimonik's clause walkthrough is correct on this point — the annex runs roughly fifteen pages of interpretation, not requirement.

Its practical effect is to reduce auditor-to-auditor variance. If an auditor pushes an interpretation of a requirement that goes beyond what the clause says, Annex A is the text you open to establish intent. Read it once, know where it sits, and treat it as leverage rather than as a to-do list.

Climate change: you probably did this in 2024

ISO 9001:2015/Amd 1:2024, published February 2024, already added to clause 4.1 that "the organization shall determine whether climate change is a relevant issue," plus a note at 4.2 that relevant interested parties can have requirements related to climate change. No transition period was granted and no re-certification was required; certification bodies have been auditing it since 2024. The 2026 edition folds the same text into 4.1 and 4.2.

So for most shops this is finished work. And to be clear about what it requires: there is no carbon footprint obligation, no climate action plan, and no new clause. A documented determination satisfies it — including a determination that climate change is not a relevant issue for your context, provided you say why. "Single leased facility, no site-specific climate exposure identified, no customer or regulatory climate requirements received; reviewed annually at management review" is a complete and acceptable answer. If your customers are automotive OEMs or large primes with supplier climate questionnaires, your answer is different, and you already know it.

What to put in front of the registrar

At the first surveillance audit after transition, the folder contains five things:

  • The cross-reference table from your document numbers to 2026 clauses.
  • The split risk register and opportunity register, with two visibly different methods.
  • Minutes from one full management review cycle run under the new leadership language.
  • Updated awareness training records covering culture and ethical decision-making.
  • The climate relevance determination with its reasoning.

Nothing else. If a proposal you have been sent implies substantially more than this, ask which clause drives each additional item.

Sequencing against AS9100 and IATF 16949

Aerospace. AS9100 is being rebranded IA9100 — "International Aerospace" — merging the AS9100, EN 9100 and JISQ 9100 variants into a single internationally released document. IAQG has confirmed IA9100 remains ISO 9001 based; there is no decoupling. Oxebridge reports the aerospace release trails the ISO 9001 release by roughly six months, which puts mid-2027 at the earliest before an aerospace shop can transition to IA9100. The sequencing conclusion is unambiguous: do the ISO 9001 work now. Waiting for IA9100 buys you nothing and compresses your window.

Automotive. The IATF 16949 second edition is still in development. Amtivo cites anticipated publication late 2026 or early 2027, subject to IATF confirmation; a Smithers report on an IATF planning communiqué points instead to drafting through 2026, validation in 2027, publication around mid-2027, and an IATF transition end date aligned with the end of the ISO 9001 transition. Treat every one of those dates as unconfirmed. Reported revision priority areas are simplification, software quality assurance, supply chain management, launch management, and customer-specific requirements. Separately, the IATF Rules 6th Edition has been in force since 1 January 2025 and governs audit procedure rather than requirements — if you have not read it, that is a more urgent gap than the second edition.

Do not hold your ISO 9001 transition hostage to either scheme.

What you will read that is not in the standard

At least one vendor summary circulating now asserts that the FDIS introduces AI and machine-learning model validation, "model drift management," cryptographic signatures and immutable change histories for documented information, multi-factor authentication, and a new clause 7.1.4 on the social and psychological work environment. None of these are corroborated by LRQA, DNV, ERM CVS or DQS, and none appear in the committee's own framing of the revision. They read as extrapolation.

Do not scope work against them and do not let a consultant scope work against them. Verify against the published text on 16 September before treating any of it as a requirement. Clause 10.1 does consolidate continual improvement with language on emerging technologies, digitalization and reliable data as improvement inputs — which is a genuine and useful change if you have machine-monitoring or MES data you have never fed into a corrective action or improvement record — but that is a long way from a validation regime for models.

A calendar for one quality manager and no consultant budget

  • Now through September 2026. Nothing. Do not buy the FDIS. Do not commission a gap assessment against a draft.
  • September 2026. Buy the published standard. Read clauses 5.1, 6.1, 6.3, 7.3 and 10.1, and skim Annex A. Half a day.
  • October 2026. Build the cross-reference table. Split the risk register. Update the awareness deck. One to two days total.
  • Q4 2026 / Q1 2027. Run one management review under the new leadership language, with a real minute on a quality-versus-schedule conflict. Run one internal audit cycle against the 2026 clause set — same audit program, updated checklist wording.
  • Once IAF publishes formal transition requirements. Confirm the actual end date, then ask your registrar to add the transition audit onto a scheduled surveillance visit rather than booking it standalone. Ask early; the back end of any transition window gets crowded.

The honest bottom line

For a machine shop with a working ISO 9001:2015 system, this is a two-to-four-day internal effort plus whatever incremental registrar time the transition audit adds to an existing surveillance visit. The standard's own authors kept the structure, the process approach, PDCA and risk-based thinking intact precisely so that the installed base would not have to rebuild. Three procedures get edited. One table gets written. Everything else gets mapped.

Price any quote against that scope. If the number implies a rebuild, ask which clause requires it — and remember that Annex A, whatever it says, cannot be one of the answers.

Sources

Share

More Articles

Workforce Development

25,000 Steelworkers Are on a 30-Day Clock. Boeing's 17,000 Engineers Come Back to the Table Sept. 8.

September 2, 2026

Semiconductors

The First American HBM Plant Won't Make a Single Wafer — and Won't Ship Until 2029

September 1, 2026

Automation & Robotics

Bill Gates Wants to Tax Every Token and Every Robot Arm. One Country Tried It — and Quietly Called It Something Else.

August 31, 2026