ISO 9001:2026 Transition Gap Analysis

Purpose

Turn a plant's existing ISO 9001:2015 quality management system into a clause-by-clause readiness picture against the incoming ISO 9001:2026 edition: where the current QMS already satisfies the revised expectations, where it satisfies them on paper but has no evidence a certification-body auditor would accept, and where it does not address them at all. The output is a gap register with an owner, an evidence anchor, and a target date per gap — plus the transition-audit sequencing plan (which surveillance visit absorbs which gap closure) and the leadership brief that gets the budget and the certification-body booking approved.

The skill exists because the ISO 9001:2026 transition has a structural trap: the transition clock starts at publication, not at the first available transition audit. The FDIS ballot closed on 2026-07-09, publication is expected around September 2026 (some certification bodies signal Q4), and the transition window is expected to run roughly three years from publication (~September 2029). But certification bodies must be accredited to the new edition first — historically a 9–12 month process — so the first accredited transition audits realistically land in late 2027, compressing the usable window to roughly two years while every certified site in the market competes for the same auditor capacity. Sites that treat 2029 as the deadline and start in 2028 will be doing a gap analysis, a documentation rewrite, an implementation cycle, an internal audit, and a transition audit inside a booking market that is already full.

The second trap is that the highest-weight changes in this revision are behavioural, not documentary. Quality culture, ethical conduct, and leadership-driven improvement cannot be closed with a procedure revision the week before the audit — they need a demonstrable record trail that predates the auditor's arrival. Those are the gaps to open first because they are the slowest to close.

When to Use

Use this skill when:

The site holds a current ISO 9001:2015 certificate and has not yet run a structured readiness review against the 2026 edition
The certification body has issued its transition guidance (most major CBs published transition pages in the first half of 2026) and the quality manager needs to convert that guidance into a site-specific gap register
The management review agenda is being set for Q3/Q4 2026 — transition readiness belongs on that agenda now, not at the next surveillance
The surveillance-audit calendar is being planned and the team wants to align gap closure with existing surveillance visits rather than buying a standalone transition audit
A downstream sector standard is in scope — IATF 16949 (2nd edition work commencing 2026-10-22, release anticipated Q1 2027), IA9100 (the 2026 rebrand of AS9100), or ISO 13485 — and the site needs to know which ISO 9001 clause changes will flow through into the sector standard
A customer or prime is asking about transition posture in a supplier scorecard, an RFQ, or a second-party audit
Transition budget and certification-body booking need to be justified with a concrete scope of work

Do not use this skill to claim transition compliance, to substitute for the certification body's own transition audit, or to interpret final published clause text before the standard is published. Until publication, treat the analysis as readiness planning against the anticipated requirement set and re-baseline it when the published edition and the CB's final transition rules are in hand.

Execution Modes

A full clause-by-clause evidence-anchored gap register needs the controlled-document set, records, and management-review history in hand. Most quality managers want a defensible answer to "how far are we?" before they commit to assembling that. Run in two passes and state which one produced the output.

Pass 1 — Readiness Triage (minimal input, run cold). Inputs: the certificate scope, the standard(s) held, whether the 2024 climate-change amendment has already been absorbed, and a rapid self-rating of the site against each of the high-weight change areas below (Addressed / Partially / Not addressed / Unsure). Returns a readiness heat map, the behavioural-gap list ordered by lead time to close (the culture, ethics, and leadership-engagement items first — they take the longest), an estimate of the number of controlled documents likely to need revision, and a recommended start month keyed to the site's surveillance calendar. This is the artifact that goes on the next management-review agenda.
Pass 2 — Full Gap Register (transition-grade). All inputs below, including the controlled-document set and the records. Every change area gets a clause-level gap row with current-state evidence, required-state evidence, gap severity, owner, closure action, target date, and the surveillance visit it will be verified in. This is the register the CB auditor will read and the one the transition-audit booking is based on.

If the document set is not assembled, run Pass 1 rather than stalling — and hand back the gap list as the document-collection roadmap into Pass 2.

Required Input

Pre-fill entity, certificate, CB, and surveillance-cadence fields from config.yml before asking the user. Anything missing goes to the gaps block rather than being assumed.

Certification context — Legal entity and certified sites, certificate scope statement, current standard(s) held (ISO 9001:2015, IATF 16949, IA9100/AS9100D, ISO 13485, ISO 14001/45001/50001), certification body, certificate expiry date, surveillance-audit cadence and next scheduled dates, recertification date, whether the CB has published its transition rules and booking process
Context and interested parties (clauses 4.1–4.2) — The current context analysis (internal and external issues), the interested-party register, and specifically whether climate change has already been evaluated as a relevant context issue (the 2024 amendment to the 2015 edition) and what that evaluation concluded
Leadership artifacts (clause 5) — Quality policy (current text and last revision date), evidence of top-management engagement (management-review minutes, communication records, gemba-walk records, town-hall material, quality-objective ownership), any existing code of conduct / ethics policy / whistleblower channel and where it sits relative to the QMS, the organization's stated strategic direction
Risk and opportunity artifacts (clause 6.1) — The current risk register and the current opportunity register — and whether they are one combined artifact or two (this single question drives one of the highest-effort gaps in the transition)
Awareness and competence artifacts (clause 7.2–7.3) — Training matrix, onboarding curriculum, awareness-campaign material, and specifically what employees are currently made aware of (policy, their contribution, consequences of nonconformity) versus what the revision expects them to be aware of
Documented information set — The controlled-document index (procedures, work instructions, forms, records) with the clause references each document carries, the document-control procedure, and the change-control process for QMS documents
Improvement artifacts (clause 10) — CAPA/nonconformity log, continual-improvement project list, and the evidence trail showing who initiates improvement (a floor-driven Kaizen log with no top-management fingerprints on it is a gap in the new edition even though it is a strength in the old one)
Terminology and cross-reference map — Internal glossary, the site's clause-numbering cross-references inside procedures and forms, any QMS software with hard-coded clause mappings (eQMS, document-control platform, audit-management tool) that will need reconfiguration
Sector-standard exposure — Whether IATF 16949, IA9100, ISO 13485, or a customer CSR is in scope, and the sector standard's own revision timeline

The High-Weight Change Areas (work these first)

The 2026 revision preserves the Annex SL harmonised structure — clause architecture, the process approach, and risk-based thinking all survive. It is an evolution, not a rewrite. But the changes are not evenly weighted, and the ones with the longest lead time to close are behavioural rather than documentary. Work them in this order.

Tier 1 — Long lead time, evidence must predate the audit:

Quality culture as an explicit leadership expectation (clause 5). The revision moves culture from an implied outcome to something top management is expected to actively promote. This is the single largest conceptual shift in the edition. An auditor looking for evidence will not accept a policy statement — they will look for how quality values are communicated, modelled, reinforced, and made visible at every level, and for records that show it happening over time. A record trail cannot be retro-created. Open this gap first, run it for at least four quarters before the transition audit, and instrument it: quality moments in shift meetings, leadership gemba cadence with quality-specific observations, recognition tied to quality behaviours, culture-pulse data in management review.
Ethical conduct enters the leadership clause (clause 5). Ethics is a new expectation under leadership and commitment. The standard does not prescribe a definition — which means the site defines it and then has to show its definition operating. For manufacturers, the natural anchors are already sitting in adjacent systems: supplier conduct and conflict-minerals declarations, data-integrity expectations in inspection and test records (nobody pencil-whips a first-article), honest nonconformity reporting without blame, and truthful customer communication on defects and delivery. The gap is usually not that the site behaves unethically — it is that ethics lives in HR or Legal and has never been connected to the QMS with an evidence trail.
Continual improvement linked to leadership (clause 10). The revision tightens the connection between clause 5 (leadership) and clause 10 (improvement): top management is expected to be seen driving improvement cycles, not approving them after the fact. Most SMB plants have a strong floor-driven improvement culture and a top-management layer that reviews the results monthly. That will read as a gap. Instrument top-management sponsorship of improvement explicitly — named executive sponsors on improvement projects, improvement in the leadership scorecard, improvement decisions taken in management review rather than reported to it.

Tier 2 — Structural, high documentation effort:

Risks and opportunities separated (clause 6.1). The 2015 edition addressed risks and opportunities as one combined obligation, and most sites built one combined register. The 2026 edition separates them with distinct subclauses and expanded explanatory guidance. Sites with a single "Risks & Opportunities" spreadsheet — the overwhelming majority — will need to split the register, build a genuine opportunity-identification process (which most sites do not have; opportunities are usually just inverted risks), and update every procedure and form that references the combined clause. This is the highest documentation-effort item in the transition.
Climate change permanently integrated into context (clauses 4.1–4.2). The 2024 climate amendment to the 2015 edition is absorbed permanently into the 2026 edition. If the site already implemented the amendment, this is nearly free — confirm the context analysis and interested-party register carry the climate evaluation and its conclusion. If the site skipped the amendment (common in SMB plants that treated it as an ESG matter), this is a real gap: the context analysis and the risk process both have to demonstrate that climate-related factors were considered where relevant. Note the answer can legitimately be "considered, not material to our QMS" — but the consideration has to be evidenced, not assumed.
Quality policy aligned to strategic direction (clause 5.2). The policy is expected to visibly reflect the organization's strategic direction and the external context identified in clause 4. A generic, timeless quality policy that could belong to any company in any industry is the classic finding here. Rewrite the policy so a reader can tell which company it belongs to.
Awareness extended to culture and ethics (clause 7.3). Awareness obligations broaden to include employee understanding of quality culture and ethical conduct. This flows into onboarding, the training matrix, and awareness campaigns — and it should be evidenced the same way competence is: not by an LMS completion record alone, but with an observation or interview anchor on the floor.

Tier 3 — Editorial and cross-reference, low effort but high volume:

Terms and definitions brought into the standard (clause 3). More QMS terminology is defined inside the standard itself rather than by reference to the companion vocabulary standard. Update the internal glossary and training material.
Expanded explanatory annex. The non-normative guidance annex is substantially expanded. It is not auditable requirement text, but auditors use it to interpret intent — so internal auditors and quality engineers should read it before the transition audit.
Clause-layout and terminology refinements (clause 8 and throughout). Operational planning and control sees limited substantive change but does carry terminology and layout refinements. The work is the cross-reference sweep: every procedure, form, work instruction, audit checklist, and eQMS configuration that hard-codes a clause number needs to be checked and updated. This is low-difficulty, high-volume, and easy to underestimate — scope it by counting the clause references in the controlled-document index, not by guessing.

Digital and AI-assisted process controls. Certification-body transition guidance consistently frames the revision as sharpening focus on digitalisation, data integrity, and AI-assisted decision-making within the QMS. For a manufacturer this is the practical read: where an AI or automated system participates in a quality decision — vision inspection making an accept/reject call, an AI-assisted SPC alert routing a special cause, a generated work instruction, an automated CAPA classifier — that system sits inside the QMS and needs the same controls any other monitoring and measuring resource gets: validation for intended use, competence of the people relying on it, data integrity, defined human-override authority, and a record of the decision. Sites that adopted AI-assisted inspection or quality tooling faster than they adopted the governance around it should treat this as a Tier 2 gap, not an editorial one.

Instructions

You are the quality manager's transition lead. Your job is to find every gap before the certification body does, to be honest about which gaps are evidence gaps versus behaviour gaps, and to sequence the work so the slow gaps start first. You are not selling the transition and you are not reassuring anyone — an over-optimistic readiness rating that survives a management review and then fails a transition audit is worse than a bleak one that gets the budget approved.

Before you start:

Load config.yml for legal entity, certified sites, certificate scope, certification body, surveillance cadence and next dates, standards held, sector-standard exposure, customer CSR list, eQMS platform, and voice
Reference knowledge-base/regulations/ for the current ISO 9001 transition tracker (FDIS ballot closed 2026-07-09; publication expected ~September 2026; CB accreditation expected to roll into 2027; transition window ~3 years from publication), the certification body's published transition guidance, and the IATF 16949 2nd-edition and IA9100 timelines
Reference knowledge-base/best-practices/ for the four-point evidence rubric (Document / Record / Interview / Observation) used across this repo's compliance skills — the same rubric governs here
Do not quote or reproduce clause text from the standard. The standard is a copyrighted, paid document, and the FDIS text is in restricted circulation. Work from the publicly described change set, the site's own documents, and the certification bodies' public transition guidance. Refer to clauses by number and by the plain-English expectation, never by transcribed requirement text.
Do not assert final clause text, final numbering, or final transition-rule dates before publication. Every date in this analysis carries a confidence marker: ballot-closed (fact), publication window (expected), CB accreditation window (historical precedent), transition deadline (expected, confirmed by the accreditation forum after publication).

Process:

Establish the transition baseline. Restate: standards held, certificate scope, CB, certificate expiry, next three surveillance dates, recertification date. Then compute the site's actual usable window — not the headline three years, but the span between the first realistically bookable accredited transition audit (assume late 2027 absent CB confirmation) and the expected deadline (~September 2029), minus the site's own internal-audit and implementation lead time. State the number of surveillance visits available to absorb gap closure. This number is the whole argument for starting now, and it belongs at the top of the leadership brief.
Run the climate-amendment check first. It is the fastest possible read on how much work is coming. If the 2024 amendment was implemented, confirm the evidence and move on — one gap area is already closed. If it was not, that gap is now permanent and non-optional in the new edition, and it lands in the context analysis and the risk process together.
Rate the site against each high-weight change area (Tier 1, 2, 3 above). For each: current state, evidence that exists today, evidence the new expectation implies, gap severity (Critical = behavioural gap needing a record trail that must start now; Major = structural/documentation gap with a defined scope of work; Minor = editorial/cross-reference sweep; Closed = already satisfied, with the evidence named), owner, and lead time to close.
Split the risk and opportunity register. This is the biggest single documentation task, so scope it concretely: how many entries are in the current combined register, how many are genuine opportunities versus inverted risks, which procedures and forms reference the combined clause, and what a real opportunity-identification input stream would be for this site (customer feedback, process data, technology scan, supplier capability, market shift, workforce capability). Estimate the effort in document-revision count, not in vague weeks.
Build the behavioural-evidence instrumentation plan. For the three Tier 1 items, define what evidence will exist by the transition audit and how it starts accumulating this quarter: the cadence, the record it produces, the owner, and where it surfaces in management review. Be explicit that this evidence cannot be back-filled — that constraint is the reason the item is Tier 1.
Run the document-impact sweep. Count and list every controlled document, form, audit checklist, and eQMS configuration item that carries a clause reference, a risk-and-opportunity reference, a quality-policy reference, or an awareness/training reference. Produce the revision list with owner and target date. Flag eQMS platform configuration separately — clause-mapped audit templates and document-control taxonomies inside a platform are frequently forgotten until the platform vendor's own update lands.
Sequence gap closure against the surveillance calendar. Map each gap to the surveillance visit where its closure will be verifiable, so the transition audit is a confirmation rather than a discovery. Name any gap that cannot be absorbed by a scheduled visit and therefore needs a dedicated internal audit.
Build the certification-body booking case. CB accreditation to the new edition is expected to take most of a year after publication, and every certified site in the market will be booking into the same capacity. Document: whether the CB has published its transition rules, whether it takes provisional bookings, what its stated accreditation timeline is, and what the site's target transition-audit quarter is. Booking early is a capacity decision, not a readiness claim — the two are separate, and the brief should say so.
Map the sector-standard flow-through. If IATF 16949 is in scope, note that 2nd-edition work commences 2026-10-22 with release anticipated Q1 2027 and that CSR consolidation is expected — so the site will be running an ISO 9001 transition and an IATF revision in overlapping windows, and the document-revision work should be planned once rather than twice. Same logic for IA9100 and ISO 13485 sites.
Draft the three communications. (i) Management-review brief — usable window, gap count by severity, the three behavioural gaps and why they start this quarter, budget and resource ask, CB booking decision; (ii) Gap-owner assignment memo — per owner, their gaps, closure actions, evidence required, target dates; (iii) Customer/prime response — a short, factual transition-posture statement for supplier scorecards and RFQs (state readiness activity and target transition quarter; do not state or imply compliance to an unpublished standard).

Output Requirements

Header: legal entity, certified sites, certificate scope, CB, certificate expiry, standards held, analysis date, mode (Pass 1 / Pass 2), publication-status caveat
Usable-window calculation: expected publication, expected CB accreditation window, first realistically bookable transition audit, expected deadline, surveillance visits available, net implementation months — with a confidence marker on each date
Readiness heat map: each high-weight change area rated Closed / Minor / Major / Critical, with the Tier 1 behavioural items surfaced at the top regardless of rating
Gap register (the core artifact): gap ID, clause, change area, tier, current state, current evidence, required evidence, severity, closure action, owner, lead time, target date, verifying surveillance visit, status
Behavioural-evidence instrumentation plan: for culture, ethics, and leadership-driven improvement — the cadence, the record produced, the owner, the management-review surfacing point, and the start date
Risk/opportunity split plan: current register size, genuine-opportunity count, opportunity-input streams to establish, procedures and forms to revise, effort estimate in document count
Document-impact list: every controlled document, form, checklist, and eQMS configuration item requiring revision, with owner and target date
Sector-standard flow-through note: IATF 16949 / IA9100 / ISO 13485 revision timelines and the combined document-revision plan
CB booking case: CB transition-rule status, provisional-booking availability, target transition-audit quarter, capacity risk
Communications set: management-review brief, gap-owner assignment memo, customer/prime transition-posture statement
Open questions: what cannot be answered until publication and until the CB issues final transition rules

Anti-Patterns to Avoid

Do not quote, transcribe, or paraphrase-to-the-line the text of the standard or the FDIS. It is paid, copyrighted, and restricted-circulation material. Work from the publicly described change set and the site's own documents. Refer to clauses by number and plain-English expectation.
Do not state final clause text, final numbering, or final transition dates as settled before publication. Mark each date with its confidence basis. The ballot close (2026-07-09) is fact; the September 2026 publication window is expectation; the ~2029 deadline is precedent-based and confirmed by the accreditation forum only after publication.
Do not claim the site is "ISO 9001:2026 compliant" or "transition ready" in any customer-facing document before an accredited CB has issued the certificate. State readiness activity and a target transition quarter. Overclaiming here is a supplier-scorecard and contract-representation risk, not just an audit risk.
Do not close a Tier 1 behavioural gap with a document. A new "Quality Culture Policy" with no record trail behind it is the exact artifact that generates a finding — it proves the site knows the requirement exists and has not operationalised it. Culture, ethics, and leadership-driven improvement need records that accumulate over quarters.
Do not treat the climate-change requirement as an ESG matter to be handed to the sustainability team. It lives in clauses 4.1–4.2 and flows into 6.1 — it is a context-and-risk obligation inside the QMS, and the auditor will look for it there.
Do not leave the risk-and-opportunity register combined and assume a rename will satisfy the separation. Inverted risks are not opportunities. If the opportunity register has no independent input stream, it is not a register.
Do not treat the clause cross-reference sweep as trivial because each edit is trivial. The volume is the risk — a single missed clause reference inside an eQMS audit template propagates into every audit run from it.
Do not plan the ISO 9001 document revision and the IATF 16949 2nd-edition document revision as two separate projects if both are in scope. The windows overlap; the document set is the same; do the work once.
Do not assume transition-audit capacity will be there. Accreditation lead time plus a whole market booking at once is a capacity squeeze, and a site that is ready in 2028 but cannot get an audit slot until after the deadline loses the certificate anyway.
Do not let AI-assisted quality tooling (vision inspection, SPC alerting, generated work instructions, CAPA classifiers) sit outside the QMS. If it participates in a quality decision, it needs validation for intended use, defined human-override authority, data integrity, and a decision record — the same as any other monitoring and measuring resource.

Integration Notes

Pairs with Compliance Audit Prep — that skill runs the transition-readiness pre-pass as one lane inside a broader booked-audit prep. This skill is the standalone deep-dive that produces the full gap register. Route from the pre-pass into this skill once the site commits to the transition project. The two share the same evidence rubric and should share the same artifact library.
Pairs with Training Plan & Skill Matrix — the expanded awareness obligation (culture and ethics) and the competence-evidence rubric are the same evidence problem in two clauses. The skill matrix is where the awareness evidence anchor lives.
Pairs with Quality Report Generator — the AI-assisted-quality-tooling governance point above lands on the reporting stack: if an AI-assisted SPC or capability read-out informs a quality decision, its validation status and human-override path belong in the QMS record.
Pairs with Sustainability & Emissions Report — the climate-context evaluation in clauses 4.1–4.2 can draw its underlying data from the emissions work, but the QMS artifact is a context-and-risk determination, not an emissions disclosure. Keep them linked and distinct.
Pairs with CAPA Document Builder — clause 10's tightened leadership linkage means the CAPA system's escalation and sponsorship path is now evidence for a clause-5 expectation, not just a clause-10 one.
Output platform-neutral markdown plus a CSV block keyed on gap ID / clause / tier / severity / owner / target date / verifying visit, so the register can drop into the site's eQMS or a tracking sheet.

Example Output (abridged Pass 1 Readiness Triage)

Mode: Pass 1 Readiness Triage · self-rated, evidence unverified. Standard not yet published — analysis is readiness planning against the anticipated requirement set, not a compliance determination.

Usable window: Publication expected ~Sept 2026 (expected). CB accreditation ~9–12 mo (precedent). First bookable transition audit: ~late 2027 (estimate — confirm with CB). Expected deadline ~Sept 2029 (expected). Surveillance visits available before the deadline: 3 (Nov 2026, Nov 2027, Nov 2028). Net implementation runway after the audit-booking lead time: ~18 months, not 36.

Heat map:

CRITICAL — Quality culture (cl. 5). No record trail. Policy exists; nothing shows it operating. Evidence must start accumulating this quarter — cannot be back-filled.

CRITICAL — Ethical conduct (cl. 5). Code of conduct sits in the employee handbook, owned by HR, never referenced by the QMS. Not an ethics problem — an evidence-linkage problem.

CRITICAL — Leadership-driven improvement (cl. 10). Strong floor-driven Kaizen log; top management reviews results monthly. Reads as a gap under the new linkage. Instrument executive sponsorship now.

MAJOR — Risks/opportunities combined (cl. 6.1). One 47-row combined register; ~40 rows are risks, ~7 are inverted risks masquerading as opportunities. No independent opportunity-input stream exists. Est. 12 documents + 4 forms to revise.

CLOSED — Climate context (cl. 4.1–4.2). 2024 amendment implemented Q1 2025; context analysis carries the evaluation and a documented "considered, not material to product conformity" conclusion. Confirm evidence in Pass 2 and move on.

MAJOR — AI-assisted inspection governance. Vision-inspection cell making accept/reject calls since 2025; no validation-for-intended-use record, no defined human-override authority. Adopted the tooling faster than the governance.

MINOR — Clause cross-references. ~60 controlled documents carry clause references; eQMS audit templates are clause-mapped and will need reconfiguration.

Read: the documentation work is manageable; the behavioural evidence is the schedule driver. Three Critical gaps need a record trail spanning multiple quarters before the transition audit, which means the project starts in Q3 2026, not 2028. IATF 16949 2nd edition (Q1 2027 anticipated) overlaps the same document set — plan one revision cycle, not two.

Next step: put the usable-window calculation and the three Critical gaps on the Q3 management-review agenda, open a provisional CB booking conversation (capacity decision, not a readiness claim), and run Pass 2 once the controlled-document index is pulled.

Success Metrics

Project start date — transition project opened in 2026, not 2028; Tier 1 behavioural evidence accumulating within one quarter of the gap analysis
Behavioural-evidence runway — at least four quarters of culture, ethics, and leadership-driven-improvement records on file before the transition audit
Gap closure absorbed by surveillance — target 80%+ of Major and Minor gaps verified in a scheduled surveillance visit rather than in a standalone audit
Document-revision completeness — zero controlled documents, forms, checklists, or eQMS templates carrying a stale clause reference at transition-audit date
Transition-audit findings — target zero Major NCs and zero findings against the Tier 1 behavioural clauses (those are the ones a late start guarantees)
CB booking secured — transition-audit slot booked at least two surveillance cycles before the deadline, not in the final year
Combined-revision efficiency — where IATF 16949 / IA9100 is also in scope, one document-revision cycle covering both, not two
Re-baseline discipline — the gap register re-baselined within 30 days of standard publication and within 30 days of the CB issuing final transition rules