ISO 9001 certification and the ISO 9001:2026 transition

What does ISO 9001 certification prove to your customers?

It proves that an independent certification body has checked that your quality management system meets the requirements of ISO 9001, and that it will keep checking every year. It does not certify a product. It certifies a way of working: understanding what customers need, controlling processes, measuring, correcting and improving.

For an exporter in Morocco or elsewhere in Africa, it is often the first filter. A European buyer or an industrial group asks for the certificate before reading the offer. For a growing company, it is also a structuring tool: clear roles, decisions based on data, fewer repeat complaints.

ISO 9001 applies to any organisation, whatever its size or sector: a packaging manufacturer supplying European brand owners, a construction contractor in Casablanca or Abidjan, a distributor in a Gulf free zone, a laboratory, an engineering firm, a training provider.

ACG is itself ISO 9001 certified for its consulting and training activities. We run our own firm the way we advise clients to run theirs.

What changes with ISO 9001:2026?

ISO 9001:2026 was published on 16 September 2026. It replaces ISO 9001:2015, including its 2024 amendment. According to the Global ACI transition requirements, the changes are minimal overall: most organisations should find them intuitive and achievable with reasonable effort. Global ACI is the body that took over the work of the International Accreditation Forum (IAF) in January 2026.

The main themes listed in that document are:

• alignment with the harmonized structure shared by ISO management system standards, which makes integration with ISO 14001:2026 easier;
• explicit attention to quality culture and ethical behaviour, led by top management;
• a more detailed treatment of risks, opportunities and the planning of changes;
• a management review that pays closer attention to changing needs of interested parties;
• clarified wording on documented information, and a revised informative annex explaining the requirements.

The Global ACI transition document describes the changes as “minimal” overall and spells out a few: quality-specific terms (quality management system, quality policy, quality objectives) are added to the definitions, with ISO 9000 remaining the reference vocabulary; the former Annex B is removed; the planning of changes now covers how their effectiveness is monitored, how they are communicated and how their results are reviewed; and staff awareness extends to quality culture and ethical behaviour. Each certified organisation remains responsible for working out what these changes mean for its own system.

For a certified site, the transition is not a rebuild. It is a methodical review of your system against the new text, a few targeted additions, and evidence that they work on the shop floor. The main risk is not technical. It is waiting until 2029.

What is the transition timeline?

The timeline comes from the Global ACI transition document, which is mandatory for signatory accreditation bodies and the certification bodies they accredit. Version 1.1 of 4 September 2026 sets the end of the transition at 30 September 2029, 36 months after the end of the month of publication.

How does the transition audit work?

It can be combined with a surveillance audit or a recertification audit, or carried out as a special audit. At a minimum, the auditor reviews the changed requirements, changes in your context, and any other changes your system needs. Global ACI allows remote transition audits where the certification body can show the objectives are met, and leaves it to the certification body to decide whether extra audit time is required.

Agree the timing with your certification body early. A recertification audit in 2027 or 2028 is often the natural moment. A site whose cycle ends just before September 2029 should not wait for its last surveillance audit: a major nonconformity to close in a hurry is the worst case.

How does ISO 9001 certification work, step by step?

It runs in eight steps, from gap analysis to maintenance, described in our method below. Three of them decide the outcome: the gap analysis, the process map and the mock audit.

Gap analysis, clause by clause

We compare your practice with every requirement clause of the standard, on site and not only on paper. We meet management, future process owners and teams, follow an order from enquiry to delivery and look at how a complaint is handled.

The output is a prioritised gap report: what is missing, what exists but cannot be evidenced, what is already solid. It sets the schedule and the budget. Without it, any timeline is a guess.

Process map and documented information

The process map is the core of the system. It fits on one page: management, operational and support processes and how they interact. Each process has a named owner, inputs, outputs, risks and indicators. The classic mistake is to copy the organisation chart. A packaging plant does not have a “sales department process”; it has a process “from customer enquiry to confirmed order” that runs across sales, technical office and planning.

ISO 9001 does not require a single quality manual. It requires the documented information needed for the system to work, plus a few mandatory items such as scope, policy, objectives and the records that prove activities took place. We write with your process owners, in their language: French, Arabic or English.

Training, mock audit and audit day

Each process owner must be able to explain their process, indicators and actions. Internal auditors must be able to audit a colleague objectively, using ISO 19011. Training is built on your own processes, with assessment of learning; see our training offer.

The mock audit reproduces the certification audit: audit plan, interviews, sampling, findings graded as the certification body would. On audit day, our consultant supports your team in presenting evidence and understanding findings, without answering in place of your process owners. The certification audit itself has two stages: stage 1 checks the system is ready, stage 2 checks it works in practice. The certificate then runs for a three-year cycle with annual surveillance audits.

Stage 1 readiness checklist

• Certification scope defined and justified, sites and activities included.
  
• Quality policy signed, measurable objectives cascaded to processes.
  
• Process map approved, one named owner per process.
  
• Risks and opportunities identified, with tracked actions.
  
• Customer and legal requirements listed and up to date.
  
• Indicators measured over several months, not created the day before.
  
• One full internal audit cycle completed by trained auditors.
  
• Management review held, with decisions and owners.
  
• Nonconformities and complaints handled with root cause analysis.
  
• Mock audit completed and major gaps closed.
  

How do you build an integrated QHSE management system?

By building one system, not three. ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018 share the same clause logic. An integrated QHSE management system relies on one process map, shared document control, one audit programme, one management review and often a combined audit.

Integration keeps one QHSE manager, one legal compliance review and one action plan. It does not remove the specific requirements of each standard: environmental aspects or occupational risk assessment do not come out of a quality process. For a site already certified to the 2015 editions of ISO 9001 and ISO 14001, a sensible plan is to combine both transitions in one audit, before 30 April 2029 for the environmental standard. See our QHSE and ISO systems page, and our outsourced QHSE service if you have no full-time QHSE manager.

How do you choose an ISO 9001 certification body?

Choose a body that is accredited, independent of your consultant and competent in your sector. Price comes after these three criteria.

An accredited certificate is issued by a certification body that is itself assessed by an accreditation body. In Morocco, the Ministry of Industry and Trade publishes the list of management system certification bodies accredited to NM ISO/IEC 17021-1. Bodies accredited abroad also operate in Morocco and across Africa and the Middle East: check which accreditation body appears on the certificate and whether it is a signatory of the international recognition arrangements. As of 6 November 2026, SEMAC is listed among the associate members of Global ACI, accreditation bodies that are not yet signatories of its mutual recognition arrangement: a SEMAC-accredited certificate does not yet benefit from that multilateral recognition.

Impartiality is a rule. A certification body cannot advise you on building your system, and a consultant cannot audit you. Be wary of offers that bundle consulting and certification within one organisation or related entities.

• Valid accreditation for ISO 9001 and for your business sector.
  
• Accreditation body named on the certificate.
  
• ISO 9001:2026 transition confirmed with its accreditation body.
  
• Auditors qualified in your sector, able to audit in your working language.
  
• Detailed quote: justified audit time, stages 1 and 2, surveillance, recertification, travel costs.
  
• Combined audit possible if you also target ISO 14001 or ISO 45001.
  
• No link with the firm supporting you.
  

We do not recommend any particular certification body. We help you compare the quotes you receive on these criteria, and we prepare your system for any accredited body.

Can the project be funded in Morocco?

Consulting fees and the certification audit are paid by the company. In Morocco, training and training engineering linked to the project may be partly funded through the OFPPT special training contracts (CSF), with GIAC support for training engineering, under the rules in force and within ceilings based on the vocational training tax the company has declared. We never promise an amount: we run a simulation on your actual situation. Details on our CSF and OFPPT funding page.

These rules come from the CSF procedures manual of May 2006, amended by amendment No. 2 of 2 June 2014, and the GIAC procedures manual of March 2003, amended by amendment No. 1 of 2014 (all in French). CSF rates apply to the cost excluding VAT and to in-person training only; GIAC support is capped at 100,000 DH per year per company. Points specific to your file are confirmed with OFPPT, on its CSF page, or with the competent GIAC. For consulting, Maroc PME runs the PACT’Qualité programme, which supports eligible companies from compliance work to certification (diagnosis, support, documentation, training, mock audit); eligibility and support are decided when Maroc PME reviews the application.

How do you keep the certificate after the audit?

By running the system between audits. The certificate is checked every year, and a system that only runs for the audit shows quickly: stale indicators, postponed internal audits, management reviews copied from one year to the next. Maintenance rests on four routines: an annual internal audit programme covering every process, an up-to-date regulatory watch with compliance evaluation, a management review that produces decisions, and preparation of each surveillance and recertification audit. ACG can take on all or part of this, including outsourced internal audits based on ISO 19011; see audits and inspections. ISO 19011:2026 was published on 27 May 2026 (4th edition) and replaces the 2018 edition, according to the ISO committee page.