Why certify straight to ISO 9001:2026?
Because it is the only edition that will still be valid at the end of your first certification cycle. ISO 9001:2026 has applied since 16 September 2026 and, according to Global ACI, no initial certification can be issued to the 2015 edition after 31 March 2028.
A company that starts its project in late 2026 will usually be audited in 2027. Building the system on the 2015 edition would mean preparing a transition a few months after receiving the certificate. The differences between editions are limited, but they hit points auditors examine closely: quality culture and ethical behaviour, risks and opportunities handled separately, planning of changes and management review inputs. Our article on ISO 9001:2026 changes and transition covers them clause by clause.
One timing issue is often missed. A certification body can only issue an accredited ISO 9001:2026 certificate once its own accreditation has been transferred to the new edition, and accreditation bodies have until 30 September 2027 to take those decisions. If your audit is planned for early 2027, ask the certification body whether it will be able to audit to the 2026 edition on that date.
The reasons to certify have not changed: a customer or principal requires it, public and private tenders ask for it, export buyers expect it, and a growing company needs structure. A certificate is only worth something if the system actually helps run the business, and that is exactly what the auditor checks.
For foreign groups opening a plant or a service centre in Morocco, there is an extra question: certify the Moroccan entity on its own, or bring it into the group’s multi-site certificate? The answer depends on the group’s certification body and its rules; settle it before you choose a local certifier.
What are the 7 steps of a first certification?
A first certification follows seven steps, from the management decision to the issue of the certificate. Steps 1 to 6 are run by the company, with or without a consultant; step 7 belongs to the certification body.
Step | What happens | Output | What drives the duration |
|---|---|---|---|
1. Scoping | Management sets the scope (activities, sites), the project owner and the target date | Scoping note, schedule | Number of sites, customer deadline |
2. Gap analysis | Gaps between current practice and each requirement of the standard | Gap report and action plan | Size, practices already formalised |
3. System design | Context, interested parties, process map, quality policy and objectives, risks and opportunities, documented information | Documented, approved system | Number of processes, customer requirements |
4. Training and roll-out | Staff awareness, training of process owners and internal auditors | Materials, attendance sheets, evaluations | Headcount, shift teams |
5. Operation | The system runs: indicators, records, nonconformity handling | Dated evidence | Business cycle, seasonality |
6. Internal audit and management review | Audit of every process, corrective actions, full management review | Audit reports, review minutes | Number of processes, findings |
7. Certification audit | Stage 1 (readiness review) then stage 2 (on-site audit) by an accredited body | Audit report, then certificate | Headcount, sites, nonconformities to close |
After certification, the cycle lasts three years, with surveillance audits at least once a year and a recertification audit at the end. The certificate is kept by running the system, not by preparing for a single audit.
Many companies book a mock audit by an auditor who was not involved in the project before the on-site audit. It simulates real conditions and leaves time to fix what it finds. The principle is the same as for food safety standards, described in our article on GFSI mock audits.
How long should you plan for?
Duration depends mainly on three factors: headcount and number of sites, the maturity of the existing system, and how much time the internal team can give. We do not quote a standard timeline: we set it after the gap analysis, based on your situation.
Two constraints set a floor, however.
The system must have run. At stage 1, the certification body checks that internal audits and management review are planned and performed. You therefore need real records: indicators tracked over several months, nonconformities handled, at least one full internal audit cycle and one management review.
The certification body has its own calendar. Auditors qualified for your sector are not always free on your preferred date. Book the audit as soon as the project schedule is stable.
What most often slows a project down:
- a quality lead who also carries other jobs, with no dedicated time;
- management delegating the whole project, while the standard requires its commitment;
- oversized documentation that nobody applies;
- several sites with different, unharmonised practices;
- stage 1 findings discovered too late to be closed before stage 2.
What speeds it up: a clear management decision, an available project owner, a well-defined scope and simple tools. In an SME, a readable process map and around ten useful indicators beat a hundred-page manual.
What are the cost items?
The cost of ISO 9001 certification falls into four items: support, training, the certification body and internal time. Their relative weight varies a lot from one company to another.
Item | What it covers | What makes it vary | Possible funding in Morocco |
|---|---|---|---|
Support | Gap analysis, system design, mock audit, follow-up | Headcount, sites, maturity, level of autonomy wanted | Maroc PME (PACT’Qualité), subject to eligibility |
Training | Awareness, process owners, internal auditors | Headcount, number of sessions, in-house or external | OFPPT (CSF); GIAC for training engineering |
Certification body | Stages 1 and 2, annual surveillance, recertification, file and travel fees | Headcount, sites, sector, complexity | Company’s own budget |
Internal time | Quality lead, process owners, management | Availability, use of external support | — |
Other | Purchase of the standard, tools, possible investments | Company choices | Case by case |
Three ways to keep the budget under control:
- Request at least two offers from accredited bodies, priced over the full three-year cycle rather than the initial audit alone.
- Check the proposed audit time. It is calculated under international rules (IAF MD 5, now carried by Global ACI), mainly from headcount. An unusually low offer often hides too little audit time or extra fees.
- Size the support to your autonomy. A company with a trained quality lead mainly needs a gap analysis, a method and a mock audit; a company with no quality function needs more continuous support, which an outsourced QHSE function can provide.
What funding is available in Morocco?
Three schemes can reduce the bill: Maroc PME for consulting, OFPPT special training contracts (CSF) for training, and the GIACs for training engineering. Each has its own scope and rules, and no amount is secured before the body concerned approves it.
Maroc PME: PACT’Qualité
According to the Maroc PME PACT’Qualité page, consulted on 4 November 2026, the programme supports bringing products, services or management systems into conformity, up to certification. It announces:
- 80% coverage of the cost of consulting and technical expertise;
- a cap of MAD 400,000 per beneficiary;
- an annual turnover ceiling of MAD 200 million excluding VAT, with specific rules for subsidiaries and groups;
- covered services: quality diagnostic, conformity support, documentation, staff training on the standard’s requirements, corrective actions, mock audit and post-certification follow-up.
The page names no specific standard: it covers management systems against the standard the company chooses. It does not mention certification body audit fees, so budget those yourself. Applications are filed online from the same page; have Maroc PME confirm that your project is eligible before committing. Note the turnover rule: a subsidiary more than 50% owned by a company with a turnover above that ceiling is excluded, which matters for foreign-owned entities.
OFPPT: special training contracts (CSF)
Project-related training (awareness, process owners, internal auditors) can be partly reimbursed through special training contracts. Under the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014), the rates are 70% for planned external training and 40% for unplanned training; for training delivered in-house, the same rates apply to a retained cost of MAD 800 per day per participant. All of this stays within caps linked to the vocational training tax declared. Our training funding page offers an indicative simulation that carries no commitment.
GIAC: training engineering
The sector-based GIACs (groupements interprofessionnels d’aide au conseil) can fund part of the training engineering, such as the needs assessment and the training plan. Under the GIAC procedures manual (March 2003, Amendment No. 1 of 2 June 2014), coverage is 70% excluding VAT, raised to 80% when the engineering follows a strategic study validated by the GIAC, within a limit of MAD 100,000 excluding VAT. The relevant GIAC depends on your sector: for the food industry, it is the food-industry GIAC (GIAC Agro). The full set-up is explained in our article on funding a certification project with GIAC and CSF.
Before launching the project, check:
How do you choose the certification body?
Choose a body accredited for ISO 9001 in your sector, whose certificate your customers recognise and which can audit to the 2026 edition. Price comes after that.
Accreditation shows that the body meets the international requirements for management system certification bodies (ISO/IEC 17021-1). In Morocco, accreditation is handled by SEMAC (Service marocain d’accréditation), which reports to the Ministry of Industry and Trade. Certification bodies active in Morocco may also be accredited abroad, for example by COFRAC in France or UKAS in the United Kingdom. SEMAC does accredit management system certification bodies under NM ISO/IEC 17021-1, and the Ministry publishes their list on its accreditation page. Within Global ACI, it is listed among the associate members, not yet signatories of the mutual recognition arrangement (list checked in November 2026).
Questions to put to each certification body:
- Accreditation: by which accreditation body, for which standard and sectors? Can the accreditation certificate be checked?
- 2026 edition: has its accreditation already moved to ISO 9001:2026? If not, when?
- Recognition: do your customers, especially export buyers or your parent group, accept this certificate?
- Auditors: are they qualified in your sector, available in your region and in your working language (French, Arabic, English)?
- Offer: are audit time and fees detailed over three years (stages 1 and 2, surveillance, recertification, travel)?
- Impartiality: the body must not offer you consulting on building your system. A "turnkey" offer mixing consulting and certification from the same entity is a red flag.
The same logic applies when choosing a consultancy: verifiable references, a written method, practising auditors. Our article on how to choose a quality or food safety consultancy gives a scoring grid.