IgeraIndustria Quality Team · Updated 2026-07-07 · 8 min read
ISO 9001:2015 is the international standard specifying requirements for a Quality Management System (QMS). Published by the International Organization for Standardization, it provides a framework for consistently meeting customer and regulatory requirements while continually improving organisational performance. It is sector-neutral, size-neutral, and applicable to any organisation anywhere in the world that wants to demonstrate its ability to deliver products and services that meet customer expectations.
ISO 9001 is not a product standard — it does not specify what your product must look like. It specifies how your system for managing quality must work. The current version, ISO 9001:2015, replaced ISO 9001:2008 and introduced risk-based thinking, stronger leadership requirements, and the High Level Structure (HLS) that aligns it with ISO 14001, ISO 45001, and other management system standards.
1,220,000+
ISO 9001 certificates issued across 170 countries — the world's most widely adopted management system standard
Source: ISO Survey 2023
Who actually needs ISO 9001 — and who doesn't
The honest answer: no organisation is legally required to hold ISO 9001 certification. The standard is voluntary. However, in practice, certification has become a de facto commercial requirement in many sectors:
- UK public procurement: Many government frameworks (Crown Commercial Service, NHS Supply Chain, defence primes) explicitly require or strongly favour ISO 9001 certification from suppliers and subcontractors.
- Automotive supply chain: IATF 16949 (the automotive quality standard) requires ISO 9001 as its foundation. If your customer is Tier 1 automotive, you need both.
- Aerospace and defence: AS9100 Rev D (aerospace) sits on top of ISO 9001. Boeing, Airbus, and most defence primes require it.
- Medical devices: ISO 13485 (medical device QMS) largely mirrors ISO 9001 structure but is mandatory under UK MDR 2002 and EU MDR 2017/745 for device manufacturers.
- Export markets: Post-Brexit, UK manufacturers exporting to the EU often find that continental buyers — particularly in Germany, France, and the Netherlands — expect ISO 9001 as a baseline quality assurance.
Organisations that typically do not need ISO 9001: very small service businesses operating in a single local market with no public-sector customers, organisations already certified to a sector-specific scheme that incorporates ISO 9001 requirements (e.g., IATF 16949 holders already satisfy ISO 9001 requirements), and organisations in sectors with their own dominant quality frameworks (e.g., BRC/IFS for food retail supply chains, though ISO 9001 complements rather than conflicts with these).
The 7 clauses in plain English
ISO 9001:2015 is structured around clauses 4 through 10 (clauses 1–3 cover scope, references, and definitions). Here is what each clause actually requires:
| Clause | Title | Plain English summary |
|---|---|---|
| 4 | Context of the organisation | Understand your internal and external environment, identify who has a stake in your QMS, and define what your QMS covers. |
| 5 | Leadership | Top management must actively lead the QMS — not delegate it entirely — and set a quality policy that commits to improvement. |
| 6 | Planning | Identify risks and opportunities that could affect your ability to deliver quality, then set measurable objectives. |
| 7 | Support | Provide the resources, competent people, infrastructure, and documented information the QMS needs to function. |
| 8 | Operation | Plan and control your operational processes — from customer requirements through design, purchasing, production, and delivery. |
| 9 | Performance evaluation | Monitor, measure, analyse, and evaluate QMS performance through customer satisfaction data, internal audits, and management review. |
| 10 | Improvement | React to nonconformities with corrective action and continually improve the QMS — not just fix problems, but prevent recurrence. |
Real certification costs and timelines by company size
Certification costs depend on three variables: company size (employee count and number of sites), complexity of operations, and the certification body you choose. The following ranges reflect 2025–2026 UK market rates:
| Company size | Consultancy | Certification body audit | Typical timeline |
|---|---|---|---|
| Micro/SME (<25 staff) | £3,000 – £8,000 | £1,500 – £3,500 | 4 – 6 months |
| Mid-size (25–200 staff) | £8,000 – £25,000 | £3,500 – £8,000 | 6 – 12 months |
| Large / multi-site (200+ staff) | £25,000 – £80,000 | £8,000 – £30,000+ | 12 – 24 months |
The largest variable cost is not the certification body audit — it is the internal labour required to build and document the QMS. IgeraIndustria reduces documentation preparation time by up to 60% by indexing your existing procedures, standards, and work instructions, and generating gap analyses against ISO 9001 clause requirements automatically.
UK and EU accreditation bodies — UKAS, ENAC, DAkkS, ACCREDIA
Not all ISO 9001 certificates are equal. The certificate is only as credible as the accreditation body that oversees the certification body. In the UK, the sole national accreditation body is UKAS (United Kingdom Accreditation Service). A UKAS-accredited certification means the certification body has been independently assessed for competence and impartiality.
Post-Brexit, UKAS operates under UK law (the Accreditation Regulations 2009) rather than EU Regulation 765/2008. UKAS certificates are recognised internationally through the IAF (International Accreditation Forum) MLA — the multilateral arrangement that makes ISO 9001 certificates mutually recognised across 100+ countries. For UK manufacturers exporting to Spain, Germany, Italy, or France, a UKAS-accredited certificate carries exactly the same weight as one issued by a body accredited by ENAC (Spain), DAkkS (Germany), or ACCREDIA (Italy).
Leading UKAS-accredited certification bodies in the UK include: BSI (British Standards Institution), Bureau Veritas, SGS UK, Lloyd's Register Quality Assurance (LRQA), and NQA. Prices vary — it is worth obtaining at least three quotes, as audit day-rate differences can amount to thousands of pounds over a three-year certification cycle.
Important: Some low-cost online providers offer ISO 9001 "certificates" issued by non-accredited bodies. These have little commercial value and will not be accepted by procurement teams who verify accreditation status. Always check the certification body's accreditation on the UKAS website.
Sector-specific extensions: IATF 16949, AS9100, and ISO 13485
ISO 9001 is the foundation, but several sectors have developed their own standards that extend and tighten its requirements. Understanding which applies to you avoids wasted effort certifying to ISO 9001 alone when your customers need the sector-specific scheme:
- IATF 16949:2016 — Automotive. Mandated by the IATF (International Automotive Task Force). Required by automotive OEMs (Stellantis, Volkswagen, Toyota, Ford, etc.) for direct and indirect production-part suppliers. IATF 16949 incorporates ISO 9001:2015 by reference — you cannot hold IATF 16949 without satisfying ISO 9001.
- AS9100 Rev D — Aerospace, space, and defence. Administered by IAQG (International Aerospace Quality Group). Required by Boeing, Airbus, Rolls-Royce, BAE Systems, and most defence primes. UK-specific variant: AS9100 aligned with JOSCAR supplier qualification.
- ISO 13485:2016 — Medical devices. Required for manufacturers and suppliers under UK MDR 2002 (as amended) and EU MDR 2017/745 / IVDR 2017/746. Not a superset of ISO 9001 — it has different requirements, particularly around post-market surveillance and regulatory compliance.
- ISO 9001 alone — General manufacturing, professional services, logistics, construction, IT services, and any sector without a mandated sector-specific scheme.
Where IgeraIndustria fits in your ISO 9001 journey
The most time-consuming part of ISO 9001 certification is not the audit — it is creating, organising, and maintaining documented information. Clause 7.5 alone requires organisations to control documented information: version control, access rights, distribution, retention. For a mid-size manufacturer, this can mean hundreds of procedures, work instructions, forms, and records.
IgeraIndustria indexes all of your QMS documentation and makes it instantly queryable by anyone in your organisation — quality managers preparing for audits, production supervisors checking procedures, new starters looking for the right form. The AI cites the exact document, revision, and clause, eliminating the 45+ minutes the average quality professional spends searching for documentation before each auditor visit.
// IgeraIndustria RAG demo — ISO 9001 Clause 7.5 query
Quality Manager: What documented information must we maintain and retain under Clause 7.5 of ISO 9001:2015, and where are our current versions stored?
IgeraIndustria: Under Clause 7.5.1, your QMS must include documented information required by ISO 9001:2015 (the standard specifies 24 items across clauses 4–10) plus documented information determined by your organisation as necessary. Your current QMS index (QMS-IDX-001, Rev 8, updated 2026-05-12) lists 47 maintained documents and 31 retained records. Clause 7.5.2 requires you to ensure documents are identified, formatted, reviewed and approved — your document control procedure is DC-PROC-001 Rev 4. Clause 7.5.3 covers distribution, access, retrieval, and disposition — see DC-PROC-002 Rev 3 for version control rules. Three documents in your index are flagged as overdue for review: QP-007 (last reviewed 2024-03-01, review cycle 24 months), WI-PAINT-012 (2023-11-15), and FM-NCR-003 (2024-01-08).
Frequently asked questions
What is the difference between ISO 9001 and ISO 9004?
ISO 9001 is a requirements standard — it specifies what a QMS must do, and you can be certified against it. ISO 9004:2018 is a guidance standard titled "Quality of an organisation — Guidance to achieve sustained success." It is broader, covering organisational resilience and stakeholder value, but you cannot be certified to ISO 9004. Most organisations use ISO 9001 for certification and ISO 9004 as a voluntary self-assessment framework for improvement beyond the minimum requirements.
How long is an ISO 9001 certificate valid, and what are surveillance audits?
An ISO 9001 certificate is valid for three years from the date of issue, subject to annual surveillance audits in years one and two. A full recertification audit takes place in year three. Surveillance audits are shorter (typically one to two days) and focus on specific clauses plus any areas of concern from the initial audit. If a major nonconformity is found at surveillance and not corrected within the agreed timeframe (usually 90 days), the certification body may suspend or withdraw the certificate.
Is UKAS-accredited certification accepted by European buyers post-Brexit?
Yes. UKAS is a signatory to the IAF Multilateral Recognition Arrangement (MLA), which means certificates issued by UKAS-accredited bodies are mutually recognised by accreditation bodies in EU member states and 100+ other countries. A UKAS-accredited ISO 9001 certificate carries the same international weight as one issued by ENAC (Spain), DAkkS (Germany), COFRAC (France), or ACCREDIA (Italy). Post-Brexit changes to UK conformity assessment rules affect CE marking, not ISO management system certificates.
Is ISO 9001 mandatory for UK government contracts?
Not universally mandatory under law, but functionally required in many frameworks. The UK Public Contracts Regulations 2015 (and the new Procurement Act 2023) allow contracting authorities to require quality management system certification as a selection criterion. Many Crown Commercial Service frameworks, NHS Supply Chain agreements, and MOD contracts explicitly require UKAS-accredited ISO 9001 certification. The Cabinet Office Procurement Policy Note 11/20 encourages but does not mandate it. Check the specific tender requirements — some accept "equivalent measures" if you can demonstrate an equivalent level of assurance.
Do I need both ISO 9001 and IATF 16949 / AS9100?
You do not hold separate certificates for both. IATF 16949 and AS9100 are sector-specific standards that incorporate ISO 9001:2015 by reference. When you are audited against IATF 16949 or AS9100, the auditor covers ISO 9001 requirements as part of the same audit. You receive a single certificate (e.g., IATF 16949) that implicitly satisfies ISO 9001. If your customers include both automotive (requiring IATF 16949) and general manufacturing clients (requiring only ISO 9001), your IATF 16949 certificate satisfies the ISO 9001 requirement for the general manufacturing customers.
What are the key differences between ISO 9001:2015 and ISO 9001:2008?
The 2015 version introduced five significant changes versus 2008: (1) Risk-based thinking — formal consideration of risks and opportunities is now embedded throughout the standard, replacing the separate "preventive action" requirement of 2008; (2) Leadership accountability — top management has explicit, personal obligations rather than being able to delegate all QMS responsibility to a management representative; (3) Context and interested parties — organisations must understand their external/internal context and the needs of interested parties (Clauses 4.1 and 4.2, which had no equivalent in 2008); (4) Knowledge management — Clause 7.1.6 requires organisations to determine and maintain organisational knowledge; (5) No mandatory quality manual — the 2015 version removed the requirement for a formal quality manual (though many organisations still maintain one voluntarily).
Ready to prepare for ISO 9001 certification? IgeraIndustria indexes your QMS documentation and cuts audit prep time by 60%.
Explore IgeraIndustria for ISO 9001Continue reading — ISO 9001 Step by Step series
Article reviewed by IgeraIndustria Quality Team, updated 2026-07-07. References: ISO 9001:2015 Quality management systems — Requirements; ISO Survey 2023; UKAS accreditation register; UK Public Contracts Regulations 2015; UK Procurement Act 2023; IAF MLA signatories list.