Getting certified starts with an operating QMS
To get ISO 9001 certified, define the activities to be covered, implement a quality management system that meets the applicable edition, and apply to an independent certification body. The body assesses the system and decides whether certification can be granted. ISO itself does not issue your certificate.
ISO 9001:2026 is the current edition, published on 16 September 2026. Ask prospective bodies which edition they can assess and what accreditation supports the proposed certificate. Current publication and a provider’s accreditation transition are separate matters. Do not assume that every advertised 2026 certificate already carries the accreditation your customer requires.
The certification guide explains the wider commercial and accreditation context. The steps below are practical suggestions for organising your own work, rather than additional ISO requirements.
Define what the certificate must cover
Start by reading the customer’s actual request. Does it concern a legal entity, a particular service, a production facility or all supplying sites? A company-wide ambition may be sensible, but it can create unnecessary work if the immediate commercial need concerns one clearly bounded activity. Equally, a narrow certificate may fail to cover the work being offered.
Prepare a scope discussion sheet for the certification body. Include the organisation’s name, activities, addresses, headcount information, shifts, outsourced processes and interfaces with other companies. Explain unusual arrangements, such as technicians working at customer premises. Accurate application information helps the body plan an appropriate assessment.
For a fictional equipment maintenance company, a useful boundary might cover contract acceptance, service planning, maintenance delivery and related purchasing. If equipment design belongs to a separate manufacturer, explain the relationship instead of casually claiming that design is irrelevant to every part of the business.
Compare existing work with applicable requirements
Obtain legitimate access to the standard and evaluate the current system. Trace actual work from customer need to completed delivery. Identify existing controls, missing arrangements and weak evidence. Record the requirement being considered, the observed gap, an owner and what would demonstrate completion.
Prioritise gaps that affect dependable delivery. A missing approval route for changed customer requirements may deserve attention before a cosmetic revision to a process diagram. Use ordinary operational language so supervisors can recognise their responsibilities. The objective is a system people can run, not a library that only the quality coordinator understands.
Keep interpretation separate from preference. A consultant’s preferred form, software package or filing structure does not become mandatory simply because it is familiar. Where a requirement permits flexibility, choose arrangements proportionate to the activity, risk and complexity.
Operate, evaluate and improve the arrangements
Introduce the controls and give people the competence and information needed to use them. Retain the records that the standard and your processes require. Build evidence through real activity, rather than filling forms retrospectively to make a project chart look complete.
Conduct internal audits that examine relevant requirements and operating evidence. Bring performance, problems and improvement needs into management review. Where a weakness is identified, address both the immediate consequences and its cause as appropriate. Check whether the action works before declaring the matter closed.
Suppose the maintenance company discovers that replacement parts are sometimes fitted without confirming the customer’s specification. Correcting one job does not resolve the purchasing handover. A revised approval trigger, staff briefing and later checks of changed orders provide a more convincing response than a rewritten policy alone.
Select and contract with a suitable body
Request comparable proposals using the same scope information. Check accreditation through the accreditation body’s own information, including relevant activity coverage and edition status. Ask about auditor experience, access arrangements, audit methods, fees, cancellation terms and the continuing surveillance programme.
Do not select a body solely because its proposed date matches a sales promise. Ask what must be ready before that date and what happens if Stage 1 identifies concerns. In the UKAS route, the published 2026 bulletin explicitly links accredited representation of 2026 certification to the body’s successful accreditation transition decision.
Keep consultancy and certification roles clear. Your organisation owns implementation. The certification body must reach an impartial assessment and decision; it cannot promise a favourable outcome because you purchased preparation support.
Complete both audit stages and respond to findings
Stage 1 assesses readiness and helps plan Stage 2. Provide access to relevant documentation, staff and information about operating conditions. Read the conclusions carefully and agree how any readiness concerns will be addressed. A Stage 1 visit is part of the initial assessment, not proof that certification has been achieved.
Stage 2 evaluates implementation and effectiveness through sampling across the agreed scope. Help auditors locate evidence and speak to the people doing the work. Employees should explain normal activities honestly. Scripted answers that conflict with actual practice make understanding the system harder.
Respond to findings according to the body’s process. Preserve the evidence, analyse causes where appropriate, implement actions and submit the requested response. The step-by-step certification process explains these handovers in more detail, including the separate certification decision.
Check the issued certificate and keep the system active
Wait for the formal decision before claiming certification. Check the legal name, sites, scope, standard edition and dates against the agreed outcome. Confirm the accreditation status and the permitted wording and marks. Report an error promptly rather than circulating a certificate with ambiguous coverage.
Assign responsibility for surveillance bookings, scope changes and continuing QMS evaluation. Certification is a continuing commitment to operate the system. Close the project only when those responsibilities have a home in normal management, with time and resources allocated to them.