ISO 9001 quality management software for the 2015 and 2026 editions

Compliance has catalogs for ISO 9001:2015 and ISO 9001:2026. Each catalog holds clauses 4 to 10.

The catalog marks every clause as mandatory except 8.3 on design and development.

The requirement texts are summaries in plain language, not the ISO text. For the standard itself, the catalog points you to your national standards body, such as NEN in the Netherlands.

When you adopt ISO 9001, Compliance creates yearly schedules for the internal audit, the external audit and the management review.

Compliance does not certify your organisation. A certification body audits your quality management system and issues the certificate. Compliance is where you keep the evidence, findings and records the auditor asks to see.

You can adopt both editions at the same time, so you can run them side by side during the transition.

Adopting the 2026 edition does not copy coverage, narratives or owners from 2015. The crosswalk links the 2015 clauses to the 2026 clauses. Under Frameworks, Proposed coverage then suggests coverage for the new edition, and you accept or dismiss each suggestion.

The 2026 catalog reflects these changes:

• 6.1 is split into 6.1.1, 6.1.2 and 6.1.3.
• 10.1 and 10.3 are merged into 10.1 Continual improvement.
• 4.1 and 4.2 add climate change. The 2015 catalog does not include Amendment 1:2024 on climate, and the 2026 catalog does.
• The outputs of the management review in 9.3.3 are now called results.
• Quality culture and ethical behaviour are new.

ISO published ISO 9001:2026 on 16 September 2026. Under the transition rules for accredited certification, new and initial certifications are issued to ISO 9001:2026 only from 31 March 2028. Organisations certified to ISO 9001:2015 have until 30 September 2029 to complete their transition. Your certification body tells you when and how your own transition audit takes place.

The Findings register holds audit findings, nonconformities and opportunities. You use Raise finding and give each finding a severity of Major, Minor or Opportunity.

A Major or Minor finding gets a chain of tasks: Root cause investigation, Corrective action and Effectiveness check. If you mark the check Not effective, the corrective action opens again. An Opportunity gets an Improvement action task.

You record an internal or external audit as an Event of the kind Internal audit or External audit, with its targets and findings. You raise findings straight from the audit.

You record a management review as an Event of the kind Management review, with its date, description, targets and findings.

On a supplier, Record a review stores the outcome as Continue, Continue with conditions or Terminate. How often a supplier is reviewed follows its criticality.

Compliance links related requirements across the frameworks you adopt. The crosswalk marks each link as Equivalent, Partial or Related. Evidence, findings and register records can meet requirements in several frameworks.

ISO 9001 and ISO 27001 use the same clause structure for clauses 4 to 10. The crosswalk marks ISO 9001 4.1 on context, 5.2 on policy, 9.2 on internal audit, 9.3 on management review and 10.2 on nonconformity and corrective action as Equivalent to the same clauses in ISO 27001. Evidence and findings you keep for those clauses can meet requirements in both frameworks.

The crosswalk marks ISO 9001 7.3 on awareness as Partial to ISO 27001 A.6.3, and 8.4 on external providers as Related to the supplier controls A.5.19, A.5.20 and A.5.22. Customer focus, customer requirements and customer satisfaction have no ISO 27001 pair.

ISO 14001 uses the same clause structure too, and the crosswalk also links ISO 9001 to ISO 14001.

Each audit covers its own framework, even where the crosswalk marks clauses as Equivalent. A supplier review covers one supplier.

Compliance has registers for policies, procedures, risks, opportunities, objectives, KPIs, interested parties, business issues, assets, suppliers, evidence and findings, among others. Compliance also has Training & Awareness and schedules. The registers are shared between the frameworks you adopt, so ISO 9001 and ISO 27001 use the same records.

Compliance scores each risk on a 5×5 likelihood and impact matrix. Treatment actions lower the residual risk score.

Compliance creates recurring review tasks for policies, risks, assets and requirements on schedule. Every task has an owner and a due date, and all tasks appear in one inbox.

Compliance also has an AI assistant on every page. It runs on AI credits, billed in USD, and it is not part of the trial unless you buy AI credits.

Michiel van der Meer built Compliance after taking over an ISMS at Jewel and seeing how much hand-work it took. He needed a better solution, so he built one.

ISO 9001 is €999 per framework per year, excl. VAT. It includes $10 of AI credit per year, billed in USD, and you can buy extra credits. Users in your organisation are unlimited.

You pay for each framework you adopt separately. ISO 27001 is €999 per framework per year, excl. VAT.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

See all Compliance pricing →