The FDIS version of ISO 9001:2026 has been finished and is circulating for internal approval prior to formal voting. At this stage, no real changes to the draft can happen, other than minor formatting and grammar. So, we should not see any additional requirements inserted into the standard before this is converted to a final, released standard.
That said, his article is based on the FDIS rather than the final version, and it is conceivable that changes could be made. This is highly, highly unlikely at this point, however. ISO, TC 176, and BSI have spent a lot of money on marketing materials related to “ethics” and “quality culture,” so those two elements will definitely not be removed before release.
As a result, his article should remain accurate even after publication of the final ISO 9001:2206 standard in a few months.
The Requirements
Looking at the FDIS, the requirements for these two new aspects appear as follows:
Under clause 5.1.1 “Leadership and Commitment – General,” the standard now says:
Top management shall demonstrate leadership and commitment with respect to the quality management system by:… (i) promoting quality culture and ethical behaviour.
A note then appears in clause 7.1.4 on “Environment for the Operation of Processes” adds this, but keep in mind, this is not a requirement. It’s just guidance (because it’s a note.)
NOTE: A suitable environment can include a combination of factors, which can differ depending on the products and services provided…. Some factors can be influenced by the organizational quality culture and ethical behaviour.
Under clause 7.3, “Awareness,” a new requirement is added as follows:
The organization shall ensure that persons doing work under the organization’s control are aware of:… (e) the organizational quality culture and ethical behavior.
That’s it. So all we have are two requirements (5.1.1 and 7.3) that don’t require any records or written policies, and which don’t prompt the user to create any actual demonstrable records or artifacts. Worse, the concepts of “ethics” and “culture” are entirely subjective, intangible, and highly reliant on personal interpretation. The note in 7.1.4 doesn’t add much except to suggest — and not require — that the concepts be somehow considered when managing the work environment.
Evidence Will Be Expected
Nevertheless, it is nearly guaranteed that third-party certification body (CB) auditors will demand something, whether written policies or records, despite the fact that the standard does not require them. We saw this when “risk” was added in 2015 and again in 2024, when “climate change” was added. CBs invoked made-up, often unwritten and invisible rules to justify auditing against their own interpretations rather than the actual standard.
Because “ethics and quality culture” will be the new, shiny thing, CB auditors will focus on it like a cat distracted by a laser pointer.
So, I have created the following two documents to help implement these new requirements in a way that makes them tangible, demonstrable acts rather than intangible, murky concepts.
One aside: consultants have already tried to turn this into a money-making scheme by making the requirements out to be something far more complicated than they need to be. One German consultant wrote an entire 139-page, $40 book on three words that appear in a standard that hasn’t even been released yet! My solution here is both free and simple. It also has the added benefit of improving your QMS. So be careful about buying any books, courses, or other content by consultants trying to get rich.
Ethics
A requirement for “ethics” has been in the AS9100 standard (for aerospace) since Rev. D, published ten years ago. So, we have a proven method for implementing this that has already been battle-tested for a decade.
The document linked below collects known industry ethics requirements and consolidates them into a single policy that can then be incorporated into your company’s QMS. A few caveats:
- This was written for the aerospace industry, but is largely generic.
- This cites some US laws and regulations; non-US users will have to tailor this for their own country’s regulations.
- It throws everything at the wall to see what sticks. You will want to edit this heavily, deleting whatever sections might not apply to you. Alternatively, your company may have corporate ethics policies that trump this, so delete anything that might conflict with the corporate policies. I urge you to keep the section on “Operational Ethics Requirements,” though, as those are the important QMS-related ones. But edit as you see fit.
Once you have this properly customized, you now have something you can publish internally (and thus prove exists) as well as use to conduct Ethics training. Train all your staff on this policy document and keep records of that training.
Finally, if your internal audit process is working right, you should audit internal conformity to this policy at least once a year. So it won’t get stale over time.
Grab the Company Ethics Policy document here (MS Word format, editable.)
Quality Culture
Ironically, the original Oxebridge Q001 standard — our open source variant of ISO 9001 — added a requirement for “Quality Culture” in its first release in 2020. It’s possible that TC 176 saw this and “borrowed” it for the 2026 update to ISO 9001.
But again, the approach below has been battle-tested. We’ve been implementing this for all Oxebridge clients for the past six years or so.
This document is essentially a Quality Policy on steroids. Whereas the Quality Policy is usually a single paragraph of wishy-washy platitudes, the purpose of the Oxebridge Q001 “Company Quality Culture” document was to create something that prompts the client to produce demonstrable artifacts and records that can be proven to customers, internal auditors, and CB auditors. Better yet, the company now has something tangible it can train its employees on.
It was originally driven by ISO 9001’s weak clause on “Customer Focus,” which fails to really drive the development of any real, actionable, provable events.
The Company Quality Culture document takes some crucial aspects of a QMS, such as the process approach, corrective action, etc., and combines them into an expression of the “culture” of the company, with the intent of creating an atmosphere that truly shows a management commitment to the customer and the concept of quality. It forces management to engage and then prove that engagement, since it requires specific records and demonstrable actions.
And, of course, it gives both your internal auditors and CB dummy something to hold in their hands when performing audits.
For this, download the document and customize it as you see fit. For this, I highly recommend you have management sign it, as that provides yet another level of demonstrable, tangible implementation of their commitment to a “quality culture.” Next, train all staff on it and consider posting it around the facility.
Grab the Company Quality Culture document here (MS Word format, editable.)
Christopher Paris is the founder and VP Operations of Oxebridge. He has over 35 years’ experience implementing ISO 9001 and AS9100 systems, and helps establish certification and accreditation bodies with the ISO 17000 series. He is a vocal advocate for the development and use of standards from the point of view of actual users. He is the writer and artist of THE AUDITOR comic strip, and is currently writing the DR. CUBA pulp novel series. Visit www.drcuba.world
