ISO 9001:2026 is published, and the EU AI Act applies in phases. Quality teams should assess these developments separately, then coordinate the controls that overlap. An ISO 9001 certificate does not establish AI Act compliance, and using AI does not automatically put every organisation under the same obligations.
Updated 26 September 2026. This article replaces earlier predictions about the revision and the AI Act timetable with the published sources below.
What changed with ISO 9001:2026?
ISO announced publication on 16 September 2026. Its release describes clearer requirements and added emphasis on leadership, quality culture and the treatment of risks and opportunities. It does not justify treating every predicted digital or sustainability initiative as a new mandatory clause.
Review the actual requirements against your existing management system. For edition selection, certification and the published transition guidance, see our ISO 9001 and EN ISO 9001 guide. Confirm your transition audit plan with your certification body.
Why the AI Act is a separate assessment
The European Commission’s AI Act guidance distinguishes providers, deployers and other operators. Obligations depend on the system’s intended purpose, classification and the organisation’s role. The specific quality management duties for providers of high-risk AI systems should not be presented as a universal requirement for every business using an AI tool.
For example, a business developing a system and a business using a supplier’s system may have different responsibilities. Document your role and the actual use before deciding which evidence and assessments are needed. Sector-specific rules may also apply.
Check the phased application dates
The Commission’s implementation timeline, checked on 26 September 2026, incorporates the Digital Omnibus amendments and lists these milestones:
| Date | Relevant milestone |
|---|---|
| 2 August 2026 | Most rules, including Article 50 transparency obligations, start applying; specific transitions remain. |
| 2 December 2027 | Rules for high-risk AI systems listed in Annex III apply. |
| 2 August 2028 | Rules for high-risk AI embedded in regulated products covered by Annex I apply. |
These are not interchangeable deadlines. Earlier rules already apply, and specific transitional provisions can affect a system. Check the current legal text and official guidance for your situation.
A practical checklist for quality teams
- Make an AI inventory. Record each tool, supplier, intended use, process owner and the decisions it supports.
- Separate the assessments. Keep an ISO 9001 gap review and an AI Act applicability review, with links between shared actions.
- Assess effects on process quality. Consider inaccurate outputs, unavailable services, uncontrolled updates and inappropriate reliance on generated information.
- Assign review and escalation. Decide which outputs need checking, who can approve them and how staff report errors.
- Control supplier and system changes. Record relevant versions, changes in intended use and the evidence needed before wider deployment.
- Evaluate results. Monitor errors, complaints and corrective actions. Use evidence from actual operations in management review.
This is an implementation planning aid, not a statement that each item is a mandatory clause of ISO 9001 or the AI Act. Where legal classification or a regulated product is involved, obtain advice suited to the specific system.
Choose the next step
If your immediate task is QMS certification, start with the ISO 9001 edition and certification checklist. If it is AI deployment, establish the role, intended purpose and applicable AI Act provisions first. A shared action log can then coordinate the work without confusing a voluntary management-system certificate with regulatory conformity.