What is ISO/IEC 17020:2026 and which bodies does it cover?
It is the international standard that sets requirements for the competence, impartiality and consistent operation of bodies that perform inspections. Its third edition was published by ISO on 27 March 2026, under the responsibility of its committee on conformity assessment (ISO/CASCO), and cancels the 2012 edition, according to the standard’s page on the ISO website. Its English title is now “Conformity assessment — Requirements for bodies performing inspection”.
ISO states that the standard covers the inspection of materials, products, installations, processes and services, at every stage of their life cycle, from design to operation and maintenance. To inspect is to examine an item and then conclude on its conformity with specific requirements or, on the basis of professional judgement, with general requirements. A laboratory delivers a result; an inspection body delivers a conclusion. The difference is explained on our laboratories and inspection bodies sector page.
In Morocco, four profiles are concerned:
- the independent body that inspects for third parties: lifting equipment, pressure equipment, electrical installations, goods, construction works;
- the inspection service within an industrial group, which inspects the group’s sites and sometimes those of third parties;
- the technical centre that inspects and also runs the related tests;
- the public inspection service that wants its competence recognised.
The same changes matter to those who buy inspections. An importer, a main contractor or a group that relies on a report issued in Casablanca or Tangier is buying a judgement whose value depends on the competence and impartiality of the body behind it.
Every one of these bodies now faces the same question: how to move from the 2012 edition to the 2026 edition without losing accreditation, or how to prepare a first application directly against the new edition. Our ISO/IEC 17020:2026 inspection bodies page presents our support; this guide goes into the detail of the requirements.
The text of the 2026 edition is sold by ISO. The IMANOR catalogue (Institut marocain de normalisation, the Moroccan standards institute) distributes the Moroccan standard NM ISO/CEI 17020: check with IMANOR which edition it adopts before buying it.
What changes, clause by clause?
A great deal, and not only independence. ISO sums up the revision in three points: two independence categories instead of three, risk-based thinking and more flexibility, and new provisions on the control of data and information. The Irish accreditation body INAB, in its notice NF49, calls it a structural and conceptual revision, not a minor update.
The most precise document we have read is note INS INF 35, published in July 2026 by Cofrac, the French accreditation body. It cross-references the clauses of the two editions and flags, without claiming to be exhaustive, the new or changed requirements. We have kept those that change the day-to-day work of a Moroccan body.
Subject | What changes, according to Cofrac | What the body must review |
|---|---|---|
Terms and definitions | Definitions of “client” and “item” added; “product”, “process”, “service” and “inspection plan” (plan d’inspection in Cofrac’s note) removed | Vocabulary of procedures, contracts and reports |
Impartiality | Independence leaves this clause; safeguarding impartiality is built into it | Register of risks to impartiality |
Confidentiality | Personnel commitments are grouped here | Signed commitments, up to date for each person |
Independence | Two types, A and non-A, defined in an annex | Classification of each field of the scope |
Legal entity | Insurance cover based on a risk analysis and an assessment of liabilities; new requirement for internal contracts | Insurance policy, contracts with the other entities of the group |
Organisation and management | Explicit requirements for technical management; the notion of a deputy technical manager disappears | Job descriptions, delegations |
Personnel | Documented competence management process; supervision results taken into account to maintain authorisations; training linked to changing technologies | Competence matrix, authorisations, supervision |
External providers | More detailed selection, approval, evaluation and monitoring; the client may refuse subcontracting | Provider list, contracts, client information |
Review of requests and contracts | Procedure for accepting requests according to available resources; handling of deviations from the contract | Tender and contract review |
Methods | Development or modification of methods planned and assigned to competent personnel; content of methods specified; validation of non-standard methods | Methods, checklists, validation files |
Data and information | Identification of the equipment used, traceability of changes, retention of original files; validation of the systems that collect, process, transmit and store data | Field apps, spreadsheets, archiving |
Reports | Simplified reporting possible, by agreement with the client | Report and certificate templates |
Appeals and complaints | Two separate processes, made available to the public | Procedures and public information page |
Management system | Options A and B removed; risks and opportunities linked to inspection activities; recall and rework of inspections when a nonconformity is found after the event; internal audits covering all activities and all premises | Manual, risk analysis, audit programme |
This table summarises Cofrac’s reading, not the text itself: the standard, a paid document, prevails.
Two lines often come as a surprise. Removing options A and B changes how a system already certified to ISO 9001 is presented: you will have to show how it covers the management system requirements of the standard, instead of relying on an option. And recalling inspections, when a nonconformity is detected after the report has been issued, means knowing which reports are affected, and therefore tracing inspectors, equipment and methods in fine detail.
Type A or Type non-A: how do you classify your body?
Start from your links with the items you inspect, field by field, then write down the justification. The 2012 edition distinguished three types: A, the independent third-party body; B, the in-house service that inspects only for its own organisation; C, the body that may also design, manufacture, supply or maintain items it inspects, with safeguards that separate responsibilities. The 2026 edition keeps only two.
According to Cofrac, the independence requirement moves to a different place in the standard and now relies on an annex dedicated to the types of bodies. Type A does not change in substance. Types B and C merge into a Type non-A, aligned with the former Type C requirements. The Singapore Accreditation Council (SAC) adds that the new edition places a heavier emphasis on how risks to impartiality are actually managed, rather than on how the organisation chart looks.
In Morocco, accreditation is granted by SEMAC (Service marocain d’accréditation), the Moroccan accreditation service under the Ministry of Industry and Trade. Its list of October 2026 shows fourteen active accreditations, still classified under the 2012 edition: two Type A, five mixed A/C and seven Type C. None is Type B, and a fifteenth line is a withdrawn accreditation.
Current classification | Expected 2026 category | Point to watch |
|---|---|---|
Type A | Type A | Check that independence still holds against new activities, clients and shareholders |
Type C | Type non-A | Independence requirements close to the former Type C; the effort lies in impartiality, risks and data |
Mixed A/C | Type A for some fields, non-A for others | Classification written field by field, consistent with the scope |
Type B (none in Morocco to date) | Type non-A | The former Type C requirements become the reference |
SEMAC has not yet said how it will word mixed classifications, A/C today, in its scopes and list after the transition. The definitions of each type are in the annexes of the standard.
We classify in five steps:
- Map the links: ownership, group, funding, contracts, and any design, manufacturing, supply, installation or maintenance work on the items inspected.
- Identify the interested parties for each item: manufacturer, owner, operator, buyer, authority.
- Classify each field of the scope, not just the body as a whole.
- Write the justification and the measures that treat the remaining risks.
- Have the classification reviewed by someone from outside the service before the assessment.
The SEMAC file already contains an independence criteria form, AI 312, required by document AI 411. That is where the assessor will read your classification.
How do you demonstrate impartiality under the 2026 edition?
By keeping a live risk register: each risk identified, documented and treated, then monitored through indicators reviewed at defined intervals. According to SAC, clause 4 of the 2026 edition requires these risks to be identified, documented and monitored on an ongoing basis. The SEMAC file already asks for “impartiality documents”, meaning the risk analysis and commitments, under document AI 411.
Risks come from five sources: the body’s relationships (ownership, group, funding), its other activities (advice, training, maintenance), its people (a former employee of a client, family ties, pay linked to volume), commercial pressure (a dominant client, deadlines, a challenged report) and its providers.
A useful register fits on one page per field:
Risk | Source | Measure | Monitoring indicator | Review |
|---|---|---|---|---|
Inspecting equipment maintained by a company of the same group | Other activities | Inspectors with no link to maintenance, sign-off by an independent manager | Share of inspections concerned, findings raised on that equipment | Quarterly |
Client that weighs heavily in revenue | Commercial pressure | Reports released outside the sales function | Share of revenue from the three largest clients | Management review |
Inspector recruited from a client | People | Cooling-off period before inspecting that client, declaration of links | Declarations updated within the year | Annual |
Report amended after a challenge | Commercial pressure | Written reason, approval by a second signatory | Number of amended reports and reasons | Management review |
According to Cofrac, the 2026 edition adds a separate analysis of the risks and opportunities linked to inspection activities: an inspector not qualified for a field, faulty equipment, an outdated checklist, lost data. The two analyses are kept side by side but not merged: the first protects judgement, the second protects the validity of the result.
Take a centre in Tangier that inspects lifting equipment and also sells plant operator training. Its training creates a link with the clients it inspects: the register must show that a trainer does not inspect the equipment of the trainees they have trained, and how this is checked.
Competence, methods, data: where do the gaps lie?
In the evidence, line by line of the scope, that a qualified inspector applied a controlled method with reliable data. INAB lists among the main changes the control of data, IT and software, competence management, external providers and the validation of non-standard methods.
Competence
Cofrac points to a documented competence management process, supervision results taken into account to maintain authorisations, and training linked to changing technologies. In practice: qualification criteria by field, a written authorisation to inspect and to sign, recorded on-site supervision, and the possibility of withdrawing an authorisation when supervision justifies it.
Methods
Each line of the scope refers to an identified method. An in-house or adapted method is validated before use, and its creation or modification is planned and assigned to a competent person. Field checklists are part of the method: a checklist changed without validation is a finding.
Data and software
An inspection produces photos, measurements, calculations and signatures on a tablet. The body identifies the equipment used, traces every change to a record, keeps the original files and validates the tools that collect, transmit and store this data, down to a simple calculation spreadsheet.
Checklist of the evidence to gather:
How do you obtain or keep SEMAC accreditation?
By following the procedures of SEMAC, which accredits against NM ISO/IEC 17020, the Moroccan adoption of the standard. According to the Accreditation page of the Ministry of Industry and Trade, accreditation is voluntary unless a regulation requires it; it is granted for a five-year cycle, with three surveillance assessments, then renewed at the body’s request.
Step | What SEMAC documents provide |
|---|---|
Application file | 22 items listed in document AI 411: application, self-assessment, draft scope, independence criteria, organisation charts, procedures, inspectors and signatories, internal audit, management review, impartiality, insurance, specimen report |
Admissibility | File to be completed within one month; decision within five working days of receipt of the complete file |
Assessment and decision | Assessment of the system and of the scope; decision by the head of SEMAC on the opinion of a committee; the certificate states the version of the reference standard in force |
Surveillance | First assessment no later than 12 months after the decision, then every 15 months, with no more than 24 months between two assessments |
Findings at surveillance | Nonconformities to be closed within six weeks, otherwise suspension may be proposed |
These rules come from procedure A 110.03. Because the certificate states the version of the reference standard, the transition will show on each body’s certificate and scope.
That leaves SEMAC’s own timeline. As of 6 November 2026, we had found no transition policy for the 2026 edition on the ministry’s pages, and the downloadable self-assessment questionnaire still carries “17020-2012” in its file name. The foreign accreditation bodies that have published their policy end the transition in late March 2029. NATA, the Australian accreditation body, gives 31 March 2029 as the transition date prescribed by Global ACI (Global Accreditation Cooperation Incorporated, formerly ILAC), which is the date in our registry. The detail is in our article on the ISO/IEC 17020:2026 transition timeline.
Publication dates differ too: 27 March 2026 for ISO, 30 March 2026 for INAB. For a body accredited by SEMAC, the transition end date that will count is the one SEMAC sets: ask SEMAC for it in writing.
Where should you start in 2027?
With the standard, the gap analysis and the date of your next SEMAC assessment. With a first surveillance no later than twelve months after the decision and a fifteen-month interval after that, an accredited body faces only one or two scheduled assessments before the end of March 2029. The transition must be ready for the next one, not the last.
- Buy the standard and have the quality and technical managers read it in full.
- Carry out the gap analysis, requirement by requirement, with the evidence expected for each.
- Redo the Type A or non-A classification of each field of the scope.
- Rebuild the impartiality register and the analysis of the risks and opportunities of inspections.
- Review the technical processes: competence, methods, data, providers, reports.
- Train the staff, then hold an internal audit and a management review against the 2026 edition.
- Agree with SEMAC on the date and form of the transition assessment.
The step-by-step method and the full checklist are in our article on the ISO/IEC 17020:2026 gap analysis. The cost and duration factors are covered in ISO/IEC 17020 accreditation cost and duration, and a complete example in our lifting equipment inspection body case study. The related training (requirements of the standard, impartiality, internal audit) sits in our ISO standards training domain. For Moroccan employers who enter it in their training plan, it may qualify for special training contracts (CSF) run by OFPPT (Office de la formation professionnelle et de la promotion du travail, Morocco’s vocational training office), with no guaranteed amount: see CSF and OFPPT funding.