ISO 9001 for IT and Software Companies

ISO 9001 for IT companies is less about factories and inspection than many developers assume. The standard asks a simple set of questions: do you understand what your customers need, do you deliver it through controlled processes, do you check the result, and do you learn from mistakes? A software company with good requirements practice, code review, testing, release control and customer feedback already does much of what ISO 9001 requires. Certification proves it to customers, and many public tenders and enterprise supply chains will not consider a supplier without it.

The standard was revised in 2026. ISO 9001:2026, published on 16 September 2026, keeps the familiar clause structure but strengthens requirements on quality culture, ethical behaviour, risks and opportunities, and management of change. Organisations certified to ISO 9001:2015 have until 30 September 2029 to transition. This guide explains the requirements, how they apply to software and IT services, the documents and audits, the transition, and how ISO 9001 fits with agile delivery, ISO/IEC 27001 and CMMI.

What is ISO 9001?

ISO 9001 specifies requirements for a quality management system (QMS) when an organisation needs to demonstrate its ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements, and aims to enhance customer satisfaction. It is part of the ISO 9000 family: ISO 9000 sets out fundamentals and vocabulary, ISO 9001 contains the certifiable requirements, and ISO 9004 gives guidance on sustained success.

The standard rests on seven quality management principles described in ISO 9000: customer focus, leadership, engagement of people, the process approach, improvement, evidence-based decision making and relationship management. It uses the harmonised structure common to ISO management system standards, so its clauses 4 to 10 line up with ISO/IEC 27001, ISO 22301 and ISO/IEC 42001, which makes integrated systems practical.

For software, ISO/IEC/IEEE 90003 gives guidance on applying ISO 9001 to the acquisition, supply, development, operation and maintenance of computer software. It is not certifiable on its own but is a useful companion.

History and why ISO 9001 was introduced

ISO 9001 was first published in 1987, drawing on British Standard BS 5750 and earlier military quality assurance standards. The early editions focused on documented procedures and inspection. The 2000 revision introduced the process approach and customer satisfaction. The 2015 edition adopted the common high-level structure, introduced risk-based thinking and reduced prescriptive documentation. The 2026 edition keeps that structure and was published after a revision process that ISO began in 2023.

The standard exists because buyers needed confidence that suppliers could deliver consistently without inspecting every product or auditing every supplier themselves. Third-party certification to a common standard made that efficient, and ISO 9001 became the most widely certified management system standard in the world.

Who needs ISO 9001?

No law requires ISO 9001 in general. It becomes necessary when customers, tenders or regulators ask for it. For IT companies, this is common in:

Government and public sector tenders, which often list ISO 9001 as a qualification criterion.
Enterprise procurement for software development and IT outsourcing.
Regulated supply chains: medical devices (where IEC 62304 and ISO 13485 also apply), automotive, aerospace and defence.
IT services and managed service providers, where it is often paired with ISO/IEC 20000-1 and ISO/IEC 27001.

It applies worldwide; certificates issued by accredited bodies are recognised internationally.

What changed in ISO 9001:2026

According to certification bodies' summaries of the published standard, the 2026 edition:

Builds quality culture and ethical behaviour into the requirements, especially in leadership, awareness and the environment for operating processes.
Treats risks and opportunities separately, with distinct requirements for identifying and addressing each.
Strengthens requirements for planning, communicating, monitoring and reviewing changes to the QMS.
Includes a limited set of core terms in the standard itself, drawn from ISO 9000.
Expands the informative Annex A guidance on structure, terminology and intent, without adding obligations.
Keeps the process approach, the plan, do, check, act cycle and risk-based thinking at the core, and incorporates the 2024 amendment asking organisations to consider whether climate change is a relevant issue.

Transition

Certification bodies report a transition period ending on 30 September 2029, after which ISO 9001:2015 certificates expire or are withdrawn. 2015 certificates remain valid during the transition, and transition audits can be combined with surveillance or recertification visits. Confirm the arrangements with your certification body, which follows the rules of the accreditation system.

Key requirements: clauses 4 to 10

Clause 4: Context of the organisation

Understand internal and external issues and the needs of interested parties, define the scope of the QMS, and determine the processes needed, their inputs, outputs, sequence, criteria, resources, responsibilities, risks and opportunities.

Clause 5: Leadership

Top management must take accountability for the QMS, ensure customer focus, establish a quality policy and assign roles. The 2026 edition places more emphasis on leaders promoting a quality culture and ethical behaviour.

Clause 6: Planning

Address risks and opportunities, set measurable quality objectives with plans to achieve them, and plan changes to the QMS in a controlled way.

Clause 7: Support

Resources (people, infrastructure, the environment for operating processes, monitoring and measuring resources, organisational knowledge), competence, awareness, communication and control of documented information.

Clause 8: Operation

The heart of the standard for a software or IT company:

Requirements for products and services: communicate with customers, determine and review requirements before committing, and manage changes to requirements.
Design and development: plan, define inputs, apply controls (reviews, verification, validation), define outputs and control design changes. In software terms: backlog and acceptance criteria, architecture and code review, automated testing, user acceptance testing and change control.
Control of externally provided processes, products and services: evaluate and monitor suppliers and subcontractors, including cloud providers and freelancers.
Production and service provision: controlled conditions, identification and traceability (for example, version control and release tagging), property belonging to customers (their data and credentials), preservation, post-delivery activities (support and maintenance) and control of changes.
Release of products and services: planned verification before release.
Control of nonconforming outputs: identify and handle defects and failed deliverables.

Clause 9: Performance evaluation

Monitor and measure, including customer satisfaction; analyse data; run internal audits; hold management reviews.

Clause 10: Improvement

Address nonconformities with corrective action and continually improve the QMS.

ISO 9001 in a software team: mapping clause 8 to everyday practice

Requirement	Typical software practice	Evidence an auditor can sample
Determining and reviewing requirements	Discovery workshops, user stories with acceptance criteria, signed statements of work	Requirement documents, approved backlog items, change requests
Design and development controls	Architecture reviews, pull request reviews, automated tests, staging demos	Review records, CI test reports, sprint review notes
Design and development changes	Change requests and impact assessment	Approved change tickets with estimates
Externally provided services	Selection and review of cloud providers, libraries and subcontractors	Supplier list, evaluations, contracts
Identification and traceability	Version control, tagged releases, linking commits to tickets	Repository history, release notes
Customer property	Protecting client data, source code and credentials	Access controls, NDAs, secrets management
Release	Release checklist, UAT sign-off, deployment approval	Signed UAT, deployment records
Nonconforming outputs	Bug tracking, hotfix process, defect triage	Defect records, root cause analysis
Customer satisfaction	Feedback surveys, NPS, account reviews	Survey results and actions

Agile methods fit ISO 9001 well. The standard does not prescribe waterfall phases or heavy documents. What matters is that requirements, reviews, verification and changes are controlled and leave evidence, which good agile tooling does naturally.

Quality objectives that work for software teams

Clause 6.2 asks for measurable quality objectives consistent with the quality policy. Good objectives are few, tied to what customers value, and measured from data you already have. Examples for a development or IT services company:

On-time delivery: percentage of milestones delivered on or before the agreed date, measured from the project plan.
Escaped defects: number of defects found by customers in the first 30 days after a release, per release, from the issue tracker.
Change failure rate: share of deployments that cause an incident or need a rollback, from deployment and incident records.
Support responsiveness: percentage of tickets answered within the agreed response time, from the help desk.
Customer satisfaction: score from a short survey at project close or quarterly for ongoing clients.

Each objective needs an owner, a target, a review frequency and a plan for what happens if it is missed. Management review should look at trends, not single months.

How to implement ISO 9001 step by step

Agree the reason and scope with leadership: which services, sites and teams.
Map your processes: sales and contract review, project delivery, support, procurement, HR and competence, and how they interact.
Write a quality policy and objectives that mean something, such as on-time delivery, defect escape rate or customer satisfaction.
Identify risks and opportunities for each key process.
Define controls that match how teams work, using existing tools.
Control documented information: where procedures live, how they are approved and versioned.
Train and communicate so people know the policy, objectives and their role.
Run the system long enough to produce records.
Measure objectives and customer satisfaction.
Internal audit by trained, impartial auditors.
Management review covering the required inputs, with decisions recorded.
Certification: Stage 1 and Stage 2 audits by an accredited body.

Documentation and records required

ISO 9001 requires the organisation to maintain or retain documented information in specific places, and to decide what else it needs. In the 2015 edition, which the 2026 edition closely follows, these include:

Scope of the QMS and documented information to support process operation.
Quality policy and quality objectives.
Evidence of fitness of monitoring and measuring resources, where relevant.
Evidence of competence.
Records of review of requirements for products and services.
Design and development records: planning, inputs, controls, outputs and changes.
Supplier evaluation and monitoring records.
Traceability records where required, and records of changes and their review.
Release records with evidence of conformity and the person authorising release.
Records of nonconforming outputs and actions.
Monitoring and measurement results, internal audit programme and results, management review results.
Nonconformities and corrective actions.

Audit and certification

Certification is carried out by a certification body accredited by a national accreditation body. The process is a Stage 1 readiness review, a Stage 2 audit of implementation and effectiveness, a certification decision, surveillance audits in the following two years, and recertification after three years. Certificates can be checked on IAF CertSearch. The international accreditation arrangement that underpins recognition was run by the International Accreditation Forum until 2025 and is now run by the Global Accreditation Cooperation.

Timeline and cost considerations

For an organisation already running disciplined delivery, implementation is mostly about defining processes, objectives and records, then operating long enough to audit. Larger organisations, multiple sites and weak existing practices take longer. Costs include certification body audit days (driven by headcount and complexity), internal staff time, training of internal auditors, and optional consultancy or QMS software. Integrating with an existing ISO/IEC 27001 system reduces cost because document control, audits and management review are shared.

Benefits and the risk of not having it

ISO 9001 certification qualifies you for tenders and supply chains that require it, gives customers confidence in delivery, and creates habits that reduce rework: clear requirements, reviews, testing, root cause analysis and customer feedback. Measured objectives make delivery performance visible to leadership.

There is no legal penalty for not being certified. The cost is lost bids and, without a quality system, repeated delivery problems that customers notice before management does.

Common mistakes and challenges for IT companies

A manual nobody reads. Write short process descriptions linked to the tools teams use.
Measuring the wrong things. Objectives should reflect customer outcomes, not activity counts.
Treating ISO 9001 as waterfall. It works with agile if reviews and changes leave evidence.
Ignoring suppliers. Cloud services, open source components and subcontractors are externally provided processes.
Corrective action without root cause. Fixing a bug without asking why the process let it through misses the point.
Leaving the 2026 transition late. Plan gap analysis and training well before 2029.

Best practices, tools and technologies

Use your issue tracker, repository and CI system as the QMS evidence base.
Define a definition of done that includes review, tests and documentation.
Track a few delivery metrics: on-time delivery, escaped defects, change failure rate and customer satisfaction.
Run blameless retrospectives and post-incident reviews and record actions.
Integrate ISO 9001 with ISO/IEC 27001 and ISO/IEC 20000-1 where customers need all three.

We run projects with documented requirements, code review, automated testing and release control; see our custom software development process.

How ISO 9001 relates to other frameworks

Framework	Relationship
ISO/IEC 27001	Same structure; quality and security systems are often integrated.
CMMI	A capability and maturity model for development and services; complementary and often requested in IT outsourcing.
ISO/IEC 20000-1	Service management system standard for IT service providers.
ITIL	Service management practices that support ISO 9001 in service delivery.
IEC 62304	Medical device software life cycle standard used within a regulated QMS.

Real-world implementation examples

Many Indian and global IT services companies hold ISO 9001 certification alongside ISO/IEC 27001, often for their delivery centres, because large clients and government tenders require it. Certificates and scopes can be verified through certification bodies and IAF CertSearch.

An illustrative case for a 60-person development agency: tender requirements push it toward certification. It maps its delivery process from proposal to support, uses its project management tool for requirements and change requests, makes pull request reviews and automated tests part of its definition of done, adds a quarterly customer feedback survey, and trains two staff as internal auditors. The Stage 2 auditor samples three projects end to end and finds records in the tools rather than in separate documents, which is exactly what the standard intends.

Next steps

Confirm which tenders or customers require ISO 9001.
Decide whether to certify directly to the 2026 edition (recommended for new certifications).
Map processes and close gaps in requirements, review, testing and supplier control.
Set objectives, train internal auditors and run a full cycle.
Book the certification audit, or plan your transition if you hold a 2015 certificate.

Frequently asked questions

What is the latest version of ISO 9001?

ISO 9001:2026, published on 16 September 2026. It replaces ISO 9001:2015.

When must we transition from ISO 9001:2015?

Certification bodies report a transition deadline of 30 September 2029. Confirm with your certification body.

Is ISO 9001 mandatory for IT companies?

No. It is voluntary, but often required by tenders and customers.

Is ISO 9001 relevant for software development?

Yes. Its design and development, release and nonconformity requirements map closely to software practices. ISO/IEC/IEEE 90003 gives software-specific guidance.

Does ISO 9001 work with agile?

Yes. It does not prescribe a lifecycle model. It requires controlled requirements, reviews, verification and changes, which agile teams can evidence in their tools.

How long is an ISO 9001 certificate valid?

An ISO 9001 certificate is issued for three years. The certification body audits part of the system in each of the two following years and runs a full recertification audit before the certificate ends.

What is the difference between ISO 9001 and ISO 27001?

ISO 9001 is about consistently meeting customer requirements and improving quality; ISO/IEC 27001 is about managing information security risk. Many companies hold both.

What is the difference between ISO 9001 and CMMI?

ISO 9001 is a certifiable quality management standard applicable to any organisation. CMMI is a capability maturity model for development and services, appraised by CMMI-authorised lead appraisers.

Do we need a quality manual?

Not since the 2015 edition. You must maintain the documented information the standard requires and what your organisation needs to operate effectively.

What changed in ISO 9001:2026?

It strengthens quality culture and ethical behaviour, treats risks and opportunities separately, strengthens change management, adds core terms and expands informative guidance, while keeping the same structure.

Can we combine ISO 9001 and ISO 27001 audits?

Yes. Because they share a structure, many certification bodies run integrated audits that cover both.

Who certifies ISO 9001?

Accredited certification bodies, not ISO. Check accreditation and verify certificates through IAF CertSearch.