ISO 9001:2026 for BPO, IT and shared services: one update wave with ISO/IEC 27001:2022

Written from the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.

A Philippine BPO, IT services firm or shared-services centre that holds both ISO 9001 and ISO/IEC 27001 should move to ISO 9001:2026 in one planned update wave, not two projects. The ISO 9001:2026 standard, published on 16 September 2026, changes the clauses that ISO/IEC 27001:2022 rebuilt four years earlier: context and interested parties, risks and opportunities, planning of changes, awareness, management review inputs and improvement. Your ISMS already sits on its current edition, because the ISO/IEC 27001:2022 transition closed on 31 October 2025. Only the QMS moves, and much of the evidence it now needs already exists in ISMS records.

Why one update wave rather than two projects

One wave means one gap assessment reading both document sets, one change plan, one internal audit cycle with combined criteria, one management review and, where one certification body holds both certificates, one audit visit. It costs less audit time and stops two teams rewriting the same context statement, interested-party register and change form months apart.

The calendar allows it. Global ACI’s transition requirements, published on 16 September 2026, the day the standard was published, set a three-year transition ending 30 September 2029. By 31 March 2027 accreditation bodies must be in a position to assess certification bodies for the 2026 edition, and their decisions must be complete by 30 September 2027, so the first accredited ISO 9001:2026 certificates appear during 2027; from 31 March 2028 new certifications go only to the 2026 edition. A BPO whose ISMS surveillance falls in 2027 or 2028 can put the QMS transition audit in that visit. One wave is not one merged system: the ISMS risk assessment and Statement of Applicability stay ISMS-only.

Where ISO 9001:2026 overlaps ISO/IEC 27001:2022, clause by clause

Seven areas overlap directly: in each, ISO 9001:2026 adds or strengthens a requirement that ISO/IEC 27001:2022 already carries in the same clause number or in an Annex A control. The table gives the change, the ISMS counterpart and the single record Sterling builds so that both auditors read the same evidence.

Area	ISO 9001:2026 change	ISO/IEC 27001:2022 counterpart	One record for both
Context (4.1)	Determine whether climate change is relevant; 4.2 NOTE: interested parties can have climate-related requirements; no carbon accounting	4.1 (same climate consideration since Amd 1:2024); A.5.30 ICT readiness for business continuity	Context statement: client geography, typhoon and power exposure, the climate determination
Interested parties (4.2 c))	Decide which interested-party requirements the QMS addresses	4.2 c): the same decision for the ISMS	One register, one decision column per system
Risks and opportunities (6.1.1 to 6.1.3)	Risks determined, analysed and evaluated, with each action weighed against the risk’s potential impact on the intended results of the QMS; opportunities determined, analysed and evaluated on their own	6.1.2 risk assessment; 6.1.3 risk treatment	One risk method; two registers (quality, information security); a QMS opportunities list
Planning of changes (6.3 a) to g))	Seven considerations, now including communication, monitoring and evaluation of effectiveness, and review of results	6.3, added in 2022; A.8.32 change management	One change-control record with all seven considerations
Awareness (7.3 e))	Awareness of the organisational quality culture and ethical behaviour, which 5.1.1 i) asks top management to promote	7.3; A.6.3 awareness and training; A.5.4 management responsibilities	One onboarding and refresher module, a code of conduct, dated attendance
Management review (9.3.2 c), g), h); 9.1.3 e), f))	Changes in interested parties’ needs and expectations as an input; actions on risks and on opportunities evaluated and reviewed separately	9.3.2 c), added in 2022, the same input	One review agenda, inputs mapped to both standards
Improvement (10.1; 10.2.1 NOTE)	Improvement covers processes and future needs and expectations; complaints are a source of nonconformities; only 10.1 and 10.2 remain	10.1 then 10.2, the same order since 2022	One improvement log; one corrective-action process with two intakes

Clause 8 is substantively identical to 2015 and 9.2 is unchanged in substance, so service-delivery procedures and the audit programme stand; only the criteria change. There are no new mandatory documents or records: the 2015 verbs “maintain” and “retain” give way to a single formulation that documented information shall be available (Annex A.2 e)); nor is a quality manual, a set of documented procedures or a management representative required. Clause-level detail: the clause-by-clause register on iso-philippines.com.

What the auditor tests on a BPO or IT delivery floor

The auditor tests the service you sell against the contract you signed: statements of work and SLAs as customer requirements, QA scorecards and calibration sessions as process monitoring, escalation and complaint logs as the source of nonconformities, and workforce, IT and HR records as resources. ISO 9001:2026 adds questions on culture, ethics, risks, opportunities and change to the same walk.

Expect requests for the contract set with its contingency and disruption provisions (8.2.1 e)), the interested-party register with the QMS decision (4.2 c)), the quality risk register with proportionate actions and a separate opportunities list (6.1.1 to 6.1.3), change-control records (6.3 a) to g)), the remote-work standard (7.1.3), onboarding and refresher records on quality culture and ethical behaviour (7.3 e)) and management review minutes with the new inputs (9.3.2 c), g), h)).

The failures Sterling’s local Filipino lead auditors see in pre-assessments repeat: culture evidence written the week before the audit; a risk register copied from the ISMS with no quality risks in it; no opportunities at all; change records only for IT changes; home-based staff outside the QMS scope; contingency clauses never rehearsed.

Remote and hybrid work: the 7.1.3 NOTE and the Philippine rules

The 7.1.3 NOTE is informative: it adds no requirement, it records that infrastructure includes what remote and hybrid workers need, and the requirement in 7.1.3 itself is unchanged from 2015. The practical test for a Philippine BPO is whether home-based agents sit inside the QMS scope with the same controls, monitoring and evidence as the floor, and whether the move home was planned as a change.

Work arrangements have moved twice in two years. The CREATE MORE Act, Republic Act No. 12066, signed on 11 November 2024, lets a registered business enterprise in an economic zone or freeport run a telecommuting programme for up to 50 per cent of its workforce without losing tax incentives, under its investment promotion agency’s rules. On 10 April 2026 the Fiscal Incentives Review Board announced Resolution No. 005-2026, temporarily allowing up to 90 per cent for one year from 24 March 2026 during the national energy emergency under Executive Order No. 110, s. 2026. A site that sent seats home in weeks has a change to plan under 6.3 a) to g), a context change under 4.1 and, on the ISMS side, A.6.7 to satisfy.

Personal data follows the seats. The Data Privacy Act of 2012, Republic Act No. 10173, created the National Privacy Commission and applies to personal information controllers and processors, including those not established in the Philippines that use equipment located here (Section 4). Under Section 21 a controller stays responsible for personal information it transfers to a third party for processing, domestically or internationally, which is why clients write privacy obligations into your contract. Both belong in the 4.2 register with the system that addresses each.

Does ISO 9001:2026 require anything on artificial intelligence?

No. ISO 9001:2026 does not mention artificial intelligence. ISO/IEC 42001:2023 is the AI management system standard, and a client who wants assurance on your AI use will ask for that, not for a QMS clause. Where AI is used in service delivery, the auditor tests it under existing requirements: infrastructure (7.1.3), planning of changes (6.3), organisational knowledge (7.1.6) and, when a vendor supplies it, externally provided processes and services (8.4).

For each tool, the auditor asks what risk it introduces and how that was analysed and evaluated (6.1.2), what opportunity it captures and whether that was evaluated separately (6.1.3), how the change was planned and its effectiveness monitored (6.3), and how its output is checked under the substantively unchanged Clause 8 controls. On the ISMS side it sits under supplier controls A.5.19 to A.5.22 and change management A.8.32.

One credential point for bids: a SOC 2 report is an attestation by an independent accounting firm, not a certification, and must never be described as one.

How Sterling runs the wave: sequence and evidence

Sterling Revise™ is a fixed-scope ISO 9001:2026 transition engagement; for a site that also holds ISO/IEC 27001, the same review reads both document sets. The first week is spent on the documentation review and gap assessment against the ISO 9001:2026 standard; the second delivers the gap report, with the number, before you commit; the third and fourth produce the plan, the certification-body booking and the first document updates. Sterling prepares you for the audit; it does not certify.

Step	Evidence produced	When
Documentation review and gap assessment against the ISO 9001:2026 standard, ISMS documents read alongside; gap report with the number	Findings by clause, each marked met by an ISMS record, to extend, or new for the QMS; gap report and fixed-price proposal	Weeks 1 to 2
Change plan under 6.3 with the transition as the change; certification-body booking; first updates in Effivity or your document control	Change record a) to g); the body’s written confirmation of audit type, remote or on-site conduct, and additional audit time with a justified calculation under ISO/IEC 17021-1	Weeks 3 to 4
Remaining updates; awareness sessions; internal audit against the 2026 criteria alongside the ISMS audit; management review with the new inputs	Updated registers; dated attendance records; audit report citing the 2026 clauses; minutes covering 9.3.2 c), g) and h)	To the plan, before the transition audit
Transition audit, inside the ISMS surveillance visit where one body holds both certificates	Nonconformities closed; ISO 9001:2026 certificate from a body whose accreditation covers the 2026 edition	2027 onwards, as accreditation extends

Mark Santos (Metro Manila), Zia Bautista (Cebu) and Ann Reyes (Davao) lead the pre-assessment interviews: local Filipino lead auditors who know how a floor huddle and a client business review actually go.

Start with the integrated gap assessment

Take the free ISO 9001:2026 gap check: 20 questions, about ten minutes, an instant scored readiness report on screen and by email. If you also hold ISO/IEC 27001 or another standard, use the gap assessment tools hub so the scores sit side by side. A local Filipino lead auditor then walks through the results and scopes the one-wave gap assessment. Or book a free consultation: +63 977 815 1204 or info@iso-certification.ph.

Frequently asked questions

Can the ISO 9001:2026 transition audit be combined with our ISO/IEC 27001 surveillance audit? Yes, when one body holds both certificates and its accreditation covers the 2026 edition. Global ACI allows the transition audit to be combined with a scheduled surveillance or recertification visit, or to stand alone as a special transition audit; the body must consider whether additional audit time is needed and justify the calculation under ISO/IEC 17021-1.

Can the transition audit be conducted remotely for a work-from-home operation? Yes. Remote conduct by information and communication technology is allowed under the Global ACI requirements, at the body’s discretion. Home-based agents are interviewed by video and records shown by screen share; the review still covers the changed requirements, changes to your context and any other changes the system needs.

Do we need a new quality manual or new procedures for ISO 9001:2026? No. The 2026 edition adds no mandatory documents or records, replaces the 2015 verbs “maintain” and “retain” with a single formulation that documented information shall be available (Annex A.2 e)), and still requires no quality manual, documented procedures or management representative. Update the records you hold; leave the ISMS document set alone.

Can our ISMS risk register serve as the ISO 9001:2026 risk register? The method can; the content cannot. Clause 6.1.2 wants quality risks determined, then analysed and evaluated, with the action on each sized to how far that risk could dent the intended results of the QMS; 6.1.3 wants opportunities handled and evaluated on their own. An information security risk register holds neither.

Until when is our ISO 9001:2015 certificate valid? Until 30 September 2029 at the latest, the end of the Global ACI transition period, or your certificate’s own expiry if earlier; after that ISO 9001:2015 certificates are no longer valid. No new ISO 9001:2015 certification can be issued from 31 March 2028 onwards; the first accredited ISO 9001:2026 certificates appear during 2027.

Does a chatbot or AI quality tool need ISO/IEC 42001 before the ISO 9001:2026 audit? No. ISO 9001:2026 has no AI requirement, so the auditor will not ask for an AI management system. The tool is tested under clauses you already meet: risk and opportunity (6.1.2, 6.1.3), planning of the change (6.3), organisational knowledge (7.1.6) and the Clause 8 controls on checking its output. ISO/IEC 42001:2023 matters only when a client asks.

Read next

Plan the programme with the Sterling Revise™ transition service, then read the ISO 9001:2026 transition audit, the risk and opportunity registers under 6.1.2 and 6.1.3 and the 6.3 planning-of-changes worked example. For clause-level reference, see the ISO 9001:2026 guide for BPO and IT on iso-philippines.com and its page on technology, remote work and AI.

Sources

• ISO 9001:2026, Quality management systems — Requirements, sixth edition, published 16 September 2026: clauses 4.1, 4.2 c) and NOTE, 5.1.1 i) and k), 6.1.1, 6.1.2, 6.1.3, 6.3 a) to g), 7.1.3 and its NOTE, 7.1.6, 7.3 e), 8.2.1 e), 8.4, 9.1.3 e) and f), 9.2, 9.3.2 c), g) and h), 10.1, 10.2 and the 10.2.1 NOTE; Annex A.2 e). https://www.iso.org/standard/9001
• Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, version 1.0, issued 4 September 2026, published 16 September 2026 (global-aci.org).
• ISO/IEC 27001:2022 with Amd 1:2024, Information security, cybersecurity and privacy protection — Information security management systems — Requirements: clauses 4.1, 4.2 c), 6.1.2, 6.1.3, 6.3, 7.3, 9.3.2 c), 10.1, 10.2; Annex A controls 5.4, 5.19 to 5.22, 5.24 to 5.28, 5.30, 6.3, 6.7, 8.32. Transition to the 2022 edition closed 31 October 2025.
• ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system.
• ISO/IEC 17021-1, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements.
• Republic Act No. 10173, Data Privacy Act of 2012 (Sections 3, 4 and 21): National Privacy Commission, https://privacy.gov.ph/data-privacy-act/ ; Official Gazette, https://www.officialgazette.gov.ph/2012/08/15/republic-act-no-10173/
• Republic Act No. 12066, CREATE MORE Act, signed 11 November 2024: Fiscal Incentives Review Board, https://firb.gov.ph/create-more-is-among-pbbms-biggest-christmas-and-new-years-gifts-to-investors-and-the-filipino-people/ ; telecommuting for up to 50 per cent of the workforce: ACCRALAW, “MORE to CREATE”, 20 January 2025, https://accralaw.com/2025/01/20/more-to-create/
• FIRB Resolution No. 005-2026, temporary work-from-home arrangements for registered business enterprises during the national energy emergency under Executive Order No. 110, s. 2026: Fiscal Incentives Review Board, 10 April 2026, https://firb.gov.ph/firb-allows-temporary-wfh-for-ecozone-businesses-amid-national-energy-emergency/