ISO 9001:2026: what medical device distributors should review

ISO 9001:2026 has been published since 16 September 2026 and replaces the 2015 edition, which is now withdrawn. Your ISO 9001:2015 certificate stays valid during a transition period that ends on 30 September 2029. For a medical device distributor, the useful first step is a focused gap analysis of the existing quality system, followed by planning the transition audit with your certification body.

Which version applies?

The ISO catalogue lists ISO 9001:2026 (opens in a new tab) as the sixth edition, published in September 2026. The same page shows that ISO 9001:2015 and its Amendment 1:2024 are withdrawn. According to ISO, this edition brings more clarity, puts emphasis on leadership and separates risks from opportunities more clearly. It is also better aligned with other management system standards.

Two subjects need to be kept apart. Publication of the standard is ISO’s matter. Certificate transition rules belong to accreditation. The Global ACI transition requirements (opens in a new tab), from the international organisation of accreditation bodies, provide for three years:

• from 31 March 2028, new accredited initial certifications are issued only to ISO 9001:2026;
• organisations already certified to ISO 9001:2015 have until 30 September 2029 to complete their transition;
• the transition audit can take place during a surveillance audit, a recertification audit or a separate audit.

ISO also reminds readers that certification remains the company’s own choice. This article does not go through the changes clause by clause. It offers a review method suited to distribution activities.

Which points should you review first?

At a distributor, the review works best when it starts from daily processes. These are the areas we examine first. They reflect our review practice and are not a list of the changes in the standard.

• Context and obligations. Are your customer requirements, the expectations of the manufacturers you represent and your distributor obligations under Regulation (EU) 2017/745 (MDR) built into the system?
• Leadership and responsibilities. Does management visibly own the quality objectives? Are roles clear between quality, logistics and customer service?
• Risks and opportunities. Does your risk register treat opportunities separately, with concrete actions?
• Suppliers and service providers. Are manufacturers, carriers and external warehouses evaluated and monitored against documented criteria?
• Competence and training. Are the training needs of logistics and customer service staff defined, and is the effectiveness of training evaluated?
• Complaints and corrective actions. Do complaints lead to root cause analysis and to actions whose effectiveness is verified?
• Traceability. Can you quickly find the affected batches and customers in the event of a recall?
• Internal audit and management review. Do both processes end in decisions that are followed up?

What should you gather for the gap analysis?

A solid gap analysis rests on concrete evidence. Gather at least:

• the scope and the process map;
• the risk and opportunity register;
• supplier evaluations and quality agreements;
• the complaints register and corrective action follow-up;
• the results of a traceability test or a recall simulation;
• internal audit reports and the latest management review minutes;
• the latest report from your certification body, with its findings.

The table below structures the review. The last row is a fictional example, given only to illustrate the method.

How does this relate to ISO 13485?

ISO 9001 is written for any type of organisation. ISO 13485 for medical devices (opens in a new tab) targets the sector specifically, with an emphasis on regulatory compliance, risk management, traceability and process validation. The 2016 edition remains in force; ISO last confirmed it in 2025.

A distributor can use one, the other or both. The choice often depends on customer requirements, tenders and manufacturers' expectations. The MDR does not, as a general rule, require distributors to hold ISO 9001 or ISO 13485 certification. Conversely, a certificate does not by itself meet your regulatory obligations as a distributor. For the EUDAMED side, see our EUDAMED registration guide.

One point deserves particular attention. If you market a device under your own name or brand, or change its intended purpose, Article 16 of the MDR can make you take on the obligations of a manufacturer. Relabelling and repackaging also bring specific requirements. In those situations, your quality system needs a separate regulatory analysis.

What should you ask your certification body?

Your certification body, accredited for example by BELAC in Belgium, sets the practical timetable. Put these questions to it early:

• When will you be accredited to audit against ISO 9001:2026?
• Will the transition take place at our next surveillance audit, at renewal or in a separate audit?
• Should we plan extra audit time?
• Which validity date will the new certificate carry?
• Which documents do you expect before the audit?

We support the preparation. The certification itself is issued by an independent body.

A focused action plan

The sequence below is a practical recommendation, to be adapted to your certification cycle.

1. Agree the transition audit date with your certification body.
2. Obtain the text of ISO 9001:2026 and brief the quality team on the changes.
3. Carry out the gap analysis using the table above.
4. Update the documents and records concerned.
5. Run an internal audit and a management review based on the new edition.
6. Close the actions before the transition audit.

If your renewal falls in 2027 or 2028, combining the transition with that audit often saves an extra visit. Check, though, that your body is accredited for the new edition by then. If your cycle ends later, the surveillance audit can serve as the transition audit, provided you leave enough time to correct any gaps before 30 September 2029.

A gap analysis of your QMS carried out by an outside pair of eyes often helps to focus the effort. We can define with you which points to examine first. Let us talk about your quality system.

Frequently asked questions

Does my ISO 9001:2015 certificate become invalid automatically?

No. Accredited ISO 9001:2015 certificates stay valid during the transition. After 30 September 2029 they are no longer valid. Your certification body may, however, set an earlier validity date depending on your cycle.

Is ISO 13485 equivalent to ISO 9001?

Not quite. Both standards cover a quality management system, but ISO 13485 contains requirements specific to medical devices and regulatory compliance.

Can we use both standards?

Yes. Some distributors choose ISO 9001 for the whole company and ISO 13485 for specific activities, depending on what their customers and manufacturers expect.

What does a gap analysis contain?

A comparison between your current system and the new edition, backed by evidence. It ends in an action list with an owner and a due date for each action.