u/ShenoyAI

ISO 9001:2026 came out on 16 September. I've been going through it next to the 2015 text, and this is the plain version of what's different.

Good news first. It's still clauses 4 to 10, the process approach is still the process approach, PDCA is still there. If your 2015 system works, you're not rebuilding it.

Clause	2015	2026
4.1 / 4.2	Climate added by the 2024 amendment	Climate is now in the standard; you decide which interested-party requirements the QMS covers
5.1.1	Leadership and commitment	Adds promoting quality culture and ethical behaviour
6.1	Risks and opportunities together	Split into 6.1.1 to 6.1.3, each analysed and evaluated
6.3	Planning of changes	Adds communication, monitoring and review of results
7.1.6	Knowledge to operate processes	Knowledge for the whole QMS: retain, apply, share
9.2.2	Audit criteria and scope	Adds objectives for each audit
9.3	Management review	Adds changes in interested-party needs; risks and opportunities reviewed separately
10.1 / 10.3	Two clauses	One clause, 10.1
Clause 3	Points to ISO 9000	Core terms listed; ISO 9000 still the reference
Annexes	Annex A and B	Annex A expanded, Annex B removed

I'd look at 6.1 first. Opportunities used to share a clause with risks, and in plenty of systems that meant a risk register and one sentence about opportunities. Now they get their own subclauses, and management review looks at both separately. If you can't point to one opportunity you evaluated, acted on and reviewed, that's a finding waiting to happen.

6.3 is quieter but I think it catches more people. Planning a change isn't enough anymore. You have to communicate it, watch how it performs, and review the result. My guess is plenty of change templates stop at approval.

5.1.1 is the one I'm curious about. You can't audit a poster, so how do you audit quality culture? I'd expect auditors to lean on how managers actually handled a reported quality problem.

The rest is small. Audit objectives in 9.2.2 are an easy fix, and the improvement clauses merging mostly means updating references.

On timing, the transition period is three years and the date I keep seeing is 30 September 2029. Your certification body will confirm yours. I'd ask early, because they'll all be running transition audits at the same time.

Which change surprised you most, and which one looks like the mountain of work for your team?

Is anyone else preparing for the ISO 9001:2026 Lead Implementer or Lead Auditor program?

Art. 37(5) says a DPO is picked for "expert knowledge of data protection law and practices." I always read that as mostly law. Not so sure anymore.

Earlier this quarter a DPO I know was asked to sign off on an AI note-taking tool the sales team had already started using.

The DPIA question was simple: does the vendor keep the recordings, and do they train on them?

Nobody could answer.

The contract said "service improvement" and the security page said "enterprise-grade." It took three weeks and a call with the vendor's security team to learn the answer was yes, for 30 days.

I expect to see this pattern frequently moving forward.

The law part is usually quick. Erasure requests, breaches, vendor reviews, they all get stuck on "which systems is this data in and what happened to it."

The DPOs who handle this best can read an ISO 27001 risk register and ask what's in scope. They're not engineers. They just don't get waved off by "yes, it's encrypted." The ones who struggle are often excellent on the law, and engineering slowly stops looping them in because their questions don't match how the systems work.

Could be I'm generalizing from too few cases.

Has the job drifted technical for you? And if you work with a DPO, do they get pulled in at design stage or after?

Been thinking about this since a conversation on another sub. If you came into AI governance from a CISA, CRISC, or COBIT background, how much of it actually transferred?

My take: the structural stuff carries over almost completely. Risk assessment, accountability mapping, evidence trails, monitoring; that's the same muscle, just pointed at a new asset class. What doesn't carry over is the risk taxonomy itself. Model drift, explainability, third-party model risk, bias testing — none of that has a clean COBIT or ISO 27001 equivalent to lean on.

Someone on r/cybersecurity described it as "control mapping was cake, drift and explainability made me feel like I walked into the wrong classroom" — which feels about right to me.

Curious if that matches what people here experienced, or if I'm underselling how different this actually is once you're past the governance-structure layer.

As of August 18, 2026, PECB became the first certification body in the world accredited by UKAS (the UK's national accreditation body) to certify individuals under ISO/IEC 17024:2012, for two schemes:

• PECB Certified ISO/IEC 42001 Lead Implementer
• PECB Certified ISO/IEC 42001 Lead Auditor

Quick context if you're not deep in the ISO world: ISO/IEC 42001:2023 is the first international standard for AI management systems: how an org governs its use of AI, not how any one model behaves. Up until now, the personal certs tied to that standard had zero independent accreditation behind them. Anyone could call a course "certified." Nobody was checking whether the certification scheme itself was actually run properly.

That's the gap this closes. What this does is let an employer or regulator check that someone holding one of these two PECB credentials actually went through an audited process, not just a marketed one.

A few reasons I think this is more than a routine announcement:

It closes a trust gap that's been sitting wide open. Before this, nothing verified that an ISO/IEC 42001 certification scheme was competent or impartial, you just had to take the training provider's word for it.

It also gives the credential some regulatory teeth. As AI rules (EU AI Act, sector-specific requirements, procurement checklists) start asking companies to prove they have qualified people running AI governance, an accredited cert is evidence. An unaccredited one is basically a LinkedIn badge.

I'd read it as a leading signal too. Accreditation bodies don't extend scope until there's real demand behind it. UKAS doing this now tells you AI governance roles are being taken seriously enough to standardize.

And honestly, the most practical use of this: if you're trying to get budget approved for an ISO/IEC 42001 rollout, "the certification is now independently accredited by the UK's national accreditation body" is a much stronger line to leadership than "we sent Dave on a course."