The Standard You Stopped Reading In 1996 Just Rewrote Your 2030 Audit

By Marcelo Trevino, independent expert

On Sept. 16, 2026, the International Organization for Standardization (ISO) published the sixth edition of ISO 9001. Most medical device professionals shrugged. We live in ISO 13485. We answer to the FDA's Quality Management System Regulation (QMSR), to the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), to Medical Device Single Audit Program (MDSAP) auditors. ISO 9001 feels like the general-purpose standard we outgrew in the 1990s.

That shrug is a mistake. ISO 9001 has never stopped shaping our world. It is the genetic parent of ISO 13485. Its ideas arrive in our sector late, filtered, and sometimes resisted, but they arrive. Risk-based thinking, process approach, leadership accountability: every one of those entered medical device quality systems through the ISO 9001 door first.

So the right question is not whether ISO 9001:2026 applies to you. It is which of its ideas will show up in ISO 13485, ISO 14971, QMSR, and the EU regulations over the next decade, and whether our industry will shape that or just absorb it.

Two Committees, One Family Tree

ISO 9001 is written by ISO Technical Committee 176 (ISO/TC 176). ISO 13485 and ISO 14971 belong to ISO/TC 210. For almost four decades, TC 176 has moved first and TC 210 has decided how much to follow. That lag, and the reasons behind it, explain the standards we work with today.

The pattern is consistent. TC 176 introduces a concept. TC 210 waits one cycle, tests whether regulators can live with it, then adopts a narrower version. The one real break came in 2016, when TC 210 declined the harmonized structure that every other ISO management system standard adopted. That decision looked conservative at the time. Today it looks prescient, because it is the reason regulators felt safe incorporating ISO 13485 by reference.

What ISO 9001:2026 Actually Changes

This is a measured revision, not a rewrite. The clause structure is intact. Organizations certified to the 2015 edition have a three-year transition. But the changes that did land are not cosmetic, and three of them matter enormously for medical devices.

1. Quality culture and ethical behavior are now requirements. Leadership must promote a quality culture and ethical conduct, and people must be aware of their role in both. For the first time, ISO 9001 asks whether the organization behaves well, not just whether it documents well. Anyone who has read an FDA warning letter about data integrity or a notified body finding about management commitment understands why this matters.

2. Risk and opportunity are separated. Clause 6.1 is restructured so that risks and opportunities are addressed as distinct things with distinct actions. The 2015 edition blurred them, and auditors spent a decade arguing about it. The 2026 text settles the argument.

3. Change management gets teeth. Planning changes to the QMS now explicitly requires communicating the change, monitoring and evaluating whether it worked, and reviewing the results. Change control stops being a form and becomes a closed loop.

4. Organizational knowledge is tied to intended results. Knowledge is treated as a resource that has to be sufficient for the QMS to achieve what it is supposed to achieve, which quietly opens the door to how companies manage knowledge that lives in software, data, and AI tools.

5. Climate change enters the QMS. Nothing like this exists in ISO 13485, QMSR, MDR, or IVDR today. A 2024 amendment to all ISO management standards added two sentences: determine whether climate change is relevant to your context, and recognize that interested parties may have climate-related requirements. The 2026 edition makes that standing text in clauses 4.1 and 4.2. No carbon targets, no sustainability reporting, just the obligation to ask the question and act on the answer. For a device company the answers are concrete: single-source suppliers in flood or wildfire zones, cold-chain reagents exposed to heat excursions, sterilization capacity squeezed by ethylene oxide emissions rules. When TC 210 revises 13485, this will be on the table, and the sector will have to decide whether climate belongs in a regulatory QMS or stays in corporate sustainability.

6. Annex A expands into clause-by-clause clarification, and Annex B is gone, with its references moved into Annex A and TC 176 guidance.

Four of these six are about behavior, judgment, and feedback loops rather than documents. That is the direction TC 176 has been traveling since 2000: less prescription, more accountability for outcomes. Keep that direction in mind, because it is exactly where TC 210 and the regulators have historically been most reluctant to go.

Where The Ripples Land

ISO 13485. The 2016 edition is now 10 years old and tied to a 2008-era structure. The pressure to revise is real, and ISO 9001:2026 raises it. Quality culture and ethics map directly onto the management responsibility clauses regulators care most about. Closed-loop change management is already how good device companies run design and process change; the standard just does not say so yet. Expect the next ISO 13485 to borrow the concepts and keep its own skeleton, exactly as it did in 2003 and 2016.

ISO 14971. The cleaner split between risk and opportunity in 9001 will tempt some to ask whether 14971 should address opportunity or benefit more explicitly. It should not go far. ISO 14971 is a safety standard, and the 2019 edition already handles benefit-risk with precision. The more useful borrow is the change management loop: risk management files are notoriously weak at showing that a design change was monitored and its risk controls re-verified after release. ISO 9001:2026 gives a plain-language model for that.

FDA QMSR. This is where it gets interesting. The FDA incorporated ISO 13485:2016 by reference. If TC 210 publishes a new edition, the FDA must either run rulemaking to adopt it or live with a frozen 2016 text while the rest of the world moves. Rulemaking takes years. So, the cadence of ISO 13485 is now, in practice, partly set by the FDA's appetite for another rule. ISO 9001:2026 is the first revision of the parent standard to arrive after that lock-in, and it will be the test case for how a regulator-bound sector standard evolves.

EU MDR and IVDR. EN ISO 13485:2016 is harmonized under both regulations with the Z annexes that map it to the general safety and performance requirements. Any new 13485 edition means a new EN version, new Z annexes, new harmonization in the Official Journal, and a notified body transition on top of the one manufacturers are still finishing. Brussels is also working on a targeted revision of the regulations themselves. Two moving targets at once is the scenario everyone in the EU system wants to avoid, which is a powerful argument for TC 210 to move slowly and deliberately.

The net effect: ISO 9001:2026 will not change your medical device QMS this year. It will set the agenda for the ISO 13485 debate, and that debate will be decided as much in Rockville and Brussels as in Geneva.

The TC 210 Dilemma

Having worked inside both TC 176 and TC 210, I can say the two committees are solving different problems. TC 176 writes for every organization on earth, so it optimizes for principles that travel. TC 210 writes for one of the most regulated industries on earth, so it optimizes for text that a regulator can enforce and an auditor can verify. Both are right. The friction between them is where our standards come from.

TC 210 now faces four hard questions.

1. Structure. Adopt the harmonized structure at last, or keep the 2008 skeleton? Harmonizing would make integrated QMS, environmental management system (EMS), and information security systems far simpler for companies that run all three. It would also renumber every clause that the FDA, Health Canada, MDSAP, and the EU Z annexes point to. Expect the committee to keep the skeleton and add content. That is the only option regulators can absorb without rulemaking.

2. Culture and ethics. Should a regulatory QMS standard require a quality culture? Regulators already judge it: it is the subtext of every data integrity finding and every repeat observation. Putting it in the text lets auditors cite it directly, which some manufacturers will resist. The ask for TC 210 is to write it in a way that is auditable, not aspirational. That is a drafting problem the committee has solved before with the risk-based approach.

3. Cadence. Who sets the clock now? ISO's own process would have ISO 13485 reviewed on a five-year cycle. The regulators who incorporated it by reference have no such cycle. A new edition that the FDA does not adopt creates two ISO 13485s in the market, one for certification and one for U.S. compliance. That outcome would be worse than no revision. TC 210 will need the FDA, the International Medical Device Regulators Forum (IMDRF), and the EU Commission at the table before it votes, not after.

4. Software and AI. ISO 9001:2026 touches organizational knowledge and emerging technology lightly. Medical devices cannot be light about it. Software as a medical device, machine learning change control, cybersecurity, and predetermined change control plans are the fastest-moving parts of our regulatory world and the weakest parts of our QMS standards. If TC 210 revises 13485, this is where the industry needs its voice heard most, and where the committee has the least precedent to lean on.

The risk is not that TC 210 moves too fast. It is that the regulatory lock-in makes it move so slowly that ISO 13485 becomes a compliance artifact while actual quality practice gets defined elsewhere, by FDA guidance, by notified body expectations, by MDSAP audit models. A standard that stops evolving stops leading.

What To Do Now

You do not need to change a single procedure because of ISO 9001:2026. You do need to read it, because it tells you where the audit expectations of 2030 are coming from.

Engineers And Quality Professionals

• Close the loop on change. For your next three significant changes, show the communication, the effectiveness check, and the review. If you cannot, you have found your gap before an auditor does.
• Separate risk from opportunity in your QMS risk registers. Most device companies already do this in 14971 files and then blur it in the QMS. Clean it up.
• Audit culture proportionately. Behavior is auditable through decisions, escalations, and how deviations get handled. Build that into internal audit now.

Executives

• If you hold both ISO 9001 and ISO 13485 certificates, plan the 9001 transition as a dry run for a future 13485 revision. Same team, same gap analysis method, lower stakes.
• Treat quality culture as a board-level metric before a regulator does. Repeat observations, overdue corrective and preventive actions (CAPAs), and data integrity findings are the lagging indicators. Speak-up rates and escalation speed are the leading ones.
• Fund standards participation. The next ISO 13485 will be shaped by the people in the room. If your company is not represented on TC 210 through your national body, the Association for the Advancement of Medical Instrumentation (AAMI), or your trade association, your competitors are writing your future QMS.

Conclusion

ISO 9001 and ISO 13485 are not rivals. They are a parent and a child who stopped dressing alike in 2016 and still share every instinct. ISO 9001:2026 just told us what the next generation of quality thinking looks like: culture you can audit, change you can prove, risk you can separate from ambition.

Medical devices will get there. The only question is whether we get there by design, through TC 210 and the regulators working in step, or by default, one warning letter at a time. I would rather we choose.

If you work in this industry, go read the new standard. Then ask what your QMS would look like if it had been written this year instead of in 2016. That gap is your roadmap.

About The Author:

Marcelo Trevino has more than 25 years of experience in global regulatory affairs, quality, and compliance, serving in senior leadership roles while managing a variety of medical devices: surgical heart valves, patient monitoring devices, insulin pump therapies, surgical instruments, orthopedics, medical imaging/surgical navigation, in vitro diagnostic devices, and medical device sterilization and disinfection products. He has an extensive knowledge of medical device management systems and medical device regulations worldwide (ISO 13485:2016, ISO 14971:2019, EU MDR/IVDR, MDSAP). He holds a BS in industrial and systems engineering and an MBA in supply chain management from the W.P. Carey School of Business at Arizona State University. Trevino is also a certified Medical Device Master Auditor and Master Auditor in Quality Management Systems by Exemplar Global. He has experience working on Lean Six Sigma Projects and many quality/regulatory affairs initiatives in the U.S. and around the world, including third-party auditing through Notified Bodies, supplier audits, risk management, process validation, and remediation. He can be reached at marcelotrevino@outlook.com or on LinkedIn.