Requirements of ISO 9001
What does ISO 9001 require of your organisation exactly? On this page, we go through all the clauses of the NEN-EN-ISO 9001:2015 standard and explain what you need to do to comply. Come across a term you do not know? Then see all terms and definitions of ISO 9001. Certification takes place through an accredited certification body .
The standard has 10 clauses. Clauses 1-3 are introductory (scope, normative references, definitions). The actual requirements are in clauses 4-10.
All ISO 9001 requirements in one overview
The substantive requirements are in clauses 4 to 10. The table below gives, per clause, the core question you answer. Further down this page, we work out each clause with examples.
| Clause | Topic | Core question |
|---|---|---|
| 4 | Context of the organisation | Who are you, what is going on, and who does the system apply to? |
| 5 | Leadership | Does top management take responsibility? |
| 6 | Planning | Which risks, opportunities and objectives do you have? |
| 7 | Support | Do you have people, resources and knowledge in order? |
| 8 | Operation | Do you deliver the product or service in a controlled way? |
| 9 | Evaluation | Do you measure whether the system works? |
| 10 | Improvement | Do you address mistakes and become better? |
The structure of ISO 9001: 10 clauses
ISO 9001 follows the High Level Structure (HLS) . This is a fixed structure that all modern ISO standards use (such as ISO 14001 and ISO 27001). Useful if you later want to combine several certifications.
Some standards build directly on ISO 9001. If you make medical devices, ISO 13485 is the stricter version for your sector. If you work with food, companies often combine ISO 9001 with ISO 22000 for food safety.
The structure is based on the PDCA cycle (Plan, Do, Check, Act):
| Phase | Clauses |
|---|---|
| Plan | 4 (Context), 5 (Leadership), 6 (Planning) |
| Do | 7 (Support), 8 (Operation) |
| Check | 9 (Evaluation) |
| Act | 10 (Improvement) |
Clause 4: Context of the organisation
This clause is about understanding your own organisation and its environment. A step-by-step explanation with an example table is on the page context analysis ISO 9001.
What does ISO 9001 require for context?
4.1 Determine internal and external factors
You must establish which factors affect your organisation and your quality objectives.
Example: An installation company records:
- External: shortage of technical staff, new regulations, rising material prices
- Internal: ageing workforce, outdated software, strong reputation
4.2 Identify interested parties
Who are the parties that affect your organisation or have an interest in what you do? What do they expect?
| Interested party | Expectation |
|---|---|
| Clients | Quality, delivery reliability, service |
| Employees | Safe working environment, clarity |
| Suppliers | Timely payment, clear agreements |
| Government | Compliance with laws and regulations |
| Shareholders | Profit, continuity |
4.3 Determine the scope
Describe what your quality management system covers. Which activities, products, services and locations fall under it?
4.4 Establish the quality management system
You must identify your processes, including how they interact, and maintain and improve the system.
You do not need a process chart of dozens of pages. A clear overview of your core processes is sufficient.
Clause 5: Leadership
This clause is about the role of top management. Quality management is not a task for the quality manager alone; the top must contribute actively.
What does ISO 9001 require of your leadership?
5.1 Demonstrate leadership and commitment
Top management must:
- Take responsibility for the effectiveness of the system
- Ensure that the quality policy and objectives are established
- Integrate the requirements of the standard into business processes
- Encourage risk-based thinking
- Involve and guide employees
5.2 Establish the quality policy
You need a quality policy that:
- Suits the context of your organisation
- Provides a framework for quality objectives
- Contains a commitment to continual improvement
- Is communicated to employees
Example quality policy: “We deliver installations that meet the expectations of our clients and all legal requirements. We measure our performance and improve continuously based on feedback and data.”
5.3 Assign roles and responsibilities
Everyone must know what their role is within the quality management system. It does not have to be a three-page organisation chart, but clarity is required.
Clause 6: Planning
This clause is about looking ahead: risks, opportunities and objectives.
What does ISO 9001 require for planning?
6.1 Determine risks and opportunities
You must think about what could go wrong (risks) and where opportunities lie. And you must take action to control risks and take advantage of opportunities.
Example:
| Risk/Opportunity | Type | Measure |
|---|---|---|
| Supplier drops out | Risk | Qualify a second supplier |
| Entering a new market | Opportunity | Carry out market research |
| Shortage of staff | Risk | Own training programme |
The standard does not ask for an extensive risk matrix. You must, however, be able to show that you think about risks and do something about them.
If you want to tackle this clause concretely, read how to apply risk-based thinking and carry out a risk analysis for ISO 9001, with a worked example.
6.2 Establish quality objectives
You set concrete, measurable objectives. These must be SMART: Specific, Measurable, Achievable, Realistic, Time-bound. Read how to do this on the page quality objectives ISO 9001.
Examples:
- Client satisfaction of at least 8.0 on average
- Maximum 2% complaints on delivered work
- Deliver 95% of projects within budget
6.3 Plan changes
If you make changes to your system, you must do this in a planned way. What changes? Why? Who is responsible? What are the consequences?
Clause 7: Support
This clause is about the resources you need to deliver quality.
What does ISO 9001 require for support?
7.1 Provide resources
Ensure sufficient:
- People
- Infrastructure (buildings, equipment, software)
- Work environment
- Resources for measurement and monitoring
- Knowledge
7.2 Ensure competence
Employees must be competent for their work. You must:
- Determine which competences are needed
- Ensure employees have them (through education, training, experience)
- Keep records of what you have done
7.3 Create awareness
Employees must know:
- What the quality policy is
- What their contribution to quality is
- What the consequences are if they do not meet requirements
7.4 Manage communication
Determine what you communicate about quality, when, with whom and how. Both internally and externally.
7.5 Control documented information
You must maintain and control the necessary documentation. The standard distinguishes two types:
- Documents: describe how you do something (policy, scope, procedures)
- Records: provide evidence that you actually did it (reports, forms)
Control means that you keep track of versions, approve documents and ensure the right version is available. A procedure without a date or approval does not count.
The standard speaks of “documented information”, not of “handbook”. You decide the form yourself: documents, checklists, videos, software. As long as it is available and controlled. Read how to build a lean quality manual.
Clause 8: Operation
The longest clause. This is about actually delivering your products or services.
What does ISO 9001 require for operation?
8.1 Operational planning and control
Plan and control the processes needed to meet client requirements.
8.2 Determine requirements for products and services
Make sure you know what the client wants, including:
- Stated requirements
- Unstated but expected requirements
- Legal requirements
- Your own additional requirements
Assess whether you can deliver what the client asks for before you make commitments.
8.3 Design and development (where applicable)
If you design products or services, you must control this process. Not all organisations have this; it depends on your activities.
8.4 Control externally provided products and services
Your suppliers and subcontractors must also deliver quality. You must:
- Determine what you expect from them
- Select and evaluate them
- Check what they deliver
8.5 Production and service provision
Ensure controlled conditions when delivering:
- Clear instructions
- Suitable resources
- Competent personnel
- Identification and traceability where needed
- Care for client property
8.6 Release of products and services
Check that the product or service meets requirements before you deliver it to the client.
8.7 Control of nonconforming outputs
If something does not meet requirements, you must take action. You must not simply deliver it to the client. Options are: correct it, separate it, inform the client, or ask permission for a deviation.
Clause 9: Performance evaluation
This clause is about measuring and evaluating.
What does ISO 9001 require for evaluation?
9.1 Monitoring, measurement, analysis and evaluation
Measure and analyse:
- Whether products and services meet requirements
- Client satisfaction
- Whether the quality management system is effective
9.2 Internal audit
Carry out internal audits regularly to check whether your system:
- Complies with the requirements of the standard
- Complies with your own requirements
- Is effectively implemented and maintained
An auditor must not audit their own work. Plan audits, record results, and take action on findings.
9.3 Management review
Top management periodically reviews the quality management system. This is a formal meeting. Read on the page management review ISO 9001 what is mandatory as input and output, and what an agenda looks like.
- Results of audits
- Client satisfaction and feedback
- Performance of processes
- Status of improvement actions
- Risks and opportunities
- Resources needed
The output is a list of decisions and improvement actions.
Clause 10: Improvement
The last clause is about getting better.
What does ISO 9001 require for improvement?
10.1 Determine opportunities for improvement
Actively identify where you can improve.
10.2 Nonconformity and corrective action
When something goes wrong (nonconformity, complaint, error), you must take action and record it. Read how to handle this, including an example record table and root cause analysis, on the page nonconformities and corrective actions ISO 9001.
- React and control the immediate consequences
- Investigate the cause
- Take action to prevent recurrence
- Evaluate the effectiveness of the action
- Record what you have done
10.3 Continual improvement
You must continually improve the suitability, adequacy and effectiveness of your system. This is not a one-off action but an ongoing attitude.
Which documents does ISO 9001 require?
ISO 9001 explicitly requires you to document the following:
| Topic | Standard clause |
|---|---|
| Scope of the system | 4.3 |
| Quality policy | 5.2 |
| Quality objectives | 6.2 |
| Competences of personnel | 7.2 |
| Operational planning and control | 8.1 |
| Requirements for products and services | 8.2 |
| Design and development (where applicable) | 8.3 |
| Supplier evaluation | 8.4 |
| Identification and traceability | 8.5.2 |
| Client property | 8.5.3 |
| Release of products and services | 8.6 |
| Nonconforming outputs | 8.7 |
| Monitoring and measurement | 9.1 |
| Internal audit | 9.2 |
| Management review | 9.3 |
| Nonconformities and corrective actions | 10.2 |
This is not an exhaustive list of everything you must document. The standard gives you the freedom to decide for yourself what further documentation you need.
Want to know how to bundle these mandatory documents without a thick binder? Read how to build a lean quality manual for ISO 9001 and reuse existing documents.
Next step
Now that you know what the requirements are, read how the audit works, go deeper into the context analysis (clause 4), or look at the mandatory documents per clause. More questions? See the frequently asked questions. Want to check where you stand per clause? Use the ISO 9001 checklist per clause. Working with projects? Then read ISO 9001 and project management.
Working on this in practice
Make the requirements practical with a process map for ISO 9001 and a supplier assessment with example criteria. That way you link responsibilities and agreements to verifiable results.