The publication of ISO 9001:2026 raises important questions for companies across the medical device supply chain. What does the new edition mean for organisations working according to ISO 13485, and which companies actually need to take action? In this article, we explain where the two standards differ and what medical device companies, suppliers and dual-certified organisations should consider.
ISO 9001:2026 was published on 16 September 2026, replacing the 2015 edition of the world’s most widely recognised quality management system standard.
The revision is attracting attention throughout the medical device supply chain. Some manufacturers use ISO 9001 alongside ISO 13485, while suppliers, software developers, engineering consultancies and other service providers may rely primarily on ISO 9001.
But the publication of a new ISO 9001 edition does not automatically mean that every medical device company must revise its quality management system. The first step is to understand which standards, certifications and contractual obligations actually apply.
ISO 9001 and ISO 13485 serve different purposes
ISO 9001 is a generic quality management system standard intended for organisations in any industry. It focuses on consistent delivery, customer satisfaction, continual improvement and the effective management of risks and opportunities.
ISO 13485 is specifically designed for organisations involved in the design, manufacture, installation and servicing of medical devices and related services. Its primary purpose is to support medical device quality and applicable regulatory requirements.
The two standards share important management-system principles, but they are not interchangeable. ISO 13485 includes medical-device-specific requirements and places particular emphasis on regulatory compliance, documented processes, risk management, traceability, validation and control throughout the device lifecycle.
The current edition, ISO 13485:2016, was reviewed and confirmed by ISO in 2025 and remains current.
Does ISO 9001:2026 change ISO 13485 requirements?
Not directly.
A company certified only to ISO 13485 does not become subject to ISO 9001:2026 merely because the new standard has been published. The revision does not amend ISO 13485, the EU MDR or the IVDR.
However, ISO 9001:2026 may still matter in several situations.
The organisation is certified to both standards
Some medical device companies maintain an integrated management system certified to ISO 9001 and ISO 13485. These organisations will need to assess the new ISO 9001 requirements and plan the transition of their ISO 9001 certification.
The objective should be to update the integrated system without creating duplicate procedures or weakening the controls needed for medical device regulatory compliance.
A supplier relies on ISO 9001 certification
Many suppliers to medical device manufacturers are not certified to ISO 13485. Instead, their qualification may partly depend on ISO 9001 certification.
Manufacturers should determine whether the supplier’s transition affects:
- approved-supplier criteria;
- quality agreements;
- purchasing specifications;
- supplier questionnaires;
- audit programmes; or
- records in the supplier-management system.
A new edition does not necessarily require immediate supplier requalification. The appropriate response should depend on the supplier’s role, risk and applicable contractual requirements.
Contracts specify a particular edition
Customer or supplier agreements sometimes refer explicitly to “ISO 9001:2015” rather than to the current edition of ISO 9001.
Following the publication of the new edition, organisations should review whether these references need updating and whether the contract allows a transition period. The wording matters: “certified to ISO 9001” and “compliant with ISO 9001:2015” may create different expectations.
The company uses ISO 9001 as a source of good practice
Even without ISO 9001 certification, a medical device organisation may find parts of the revised standard useful for strengthening areas such as organisational context, quality culture, business continuity or management of change.
These practices can complement an ISO 13485 system, but they should be introduced because they add value, not because ISO 9001 has incorrectly been treated as a new medical device regulatory requirement.
Five practical steps to take following publication
1. Establish which obligations apply
Document whether ISO 9001 is relevant through certification, customer commitments, supplier requirements, tenders or internal company policy. This prevents unnecessary work based on assumptions.
2. Obtain and review the final published standard
The final published text should be used for the formal gap assessment. Organisations that previously reviewed draft versions or summaries should verify their conclusions against the final requirements before making significant procedural changes.
ISO describes the revision as addressing modern business needs and stakeholder expectations, including clearer management of risks and opportunities and a stronger quality culture. Detailed conclusions should be based on a review of the published standard. ISO 9001:2026
3. Separate shared and standard-specific requirements
Dual-certified organisations should map:
- requirements common to both standards;
- requirements specific to ISO 9001;
- requirements specific to ISO 13485; and
- regulatory procedures that extend beyond either standard.
A clear mapping makes it easier to preserve one integrated system while demonstrating conformity to each set of audit criteria.
4. Coordinate with the certification body
Confirm the applicable transition arrangements, audit timing and documentation requirements before scheduling major changes.
Organisations should avoid assuming a particular transition deadline unless it has been formally communicated by the relevant accreditation or certification body.
5. Use risk-based change control
Changes to an integrated quality system should be assessed for potential effects on regulatory compliance, validated processes, responsibilities, training and controlled documentation.
The goal is not to rename procedures to match new terminology. It is to ensure that changes are understood, proportionate and effective.
Conclusion
ISO 9001:2026 will be relevant to many organisations in the medical device supply chain, but its publication does not replace or automatically modify ISO 13485.
For companies certified only to ISO 13485, the immediate task is to determine whether ISO 9001 creates any contractual, supplier-related or internal implications. Dual-certified organisations will need a more structured transition plan, ideally built around their existing integrated management system.
The sensible approach is to review the final published standard, confirm the applicable transition arrangements and then conduct a focused gap assessment. This will help organisations respond to genuine requirements without creating unnecessary complexity in an already highly regulated quality system.
Do you need support with ISO 9001:2026?
Whether your organisation is certified to ISO 9001, ISO 13485 or both, our experienced Quality Assurance consultants can help you assess the impact of the new edition, identify relevant gaps and plan proportionate updates to your quality management system.