Ask ten supplier quality teams how often they re-evaluate suppliers and most will say once a year. Ask why once a year, and the answers get thinner: it is what the last system did, it fits the budget cycle, it is what the auditor saw last time.

Annual is a habit rather than a rule. ISO 9001 asks for criteria to evaluate, select, monitor and re-evaluate external providers, and for controls proportionate to the impact of what those providers deliver. It does not name an interval. That silence is an opportunity, because the teams getting the most from their supply base are not evaluating everyone more often. They are evaluating far fewer suppliers on the calendar and far more of them on evidence.

This article sets out a cadence model you can defend to an auditor, explain to a supplier and actually sustain.

The mistake is having one clock

Most programmes run a single annual cycle that bundles three genuinely different activities together. Separating them is the single highest-return change available, because only one of the three costs your suppliers anything.

Clock one: signal monitoring. This runs on data you already own. On-time delivery, quality escapes, open nonconformities, invoice disputes, responsiveness to requests. No supplier has to fill in anything for you to see a trend forming. Because it is free at the supplier’s end, this clock should run continuously rather than annually. Teams making the shift from annual reviews to continuous supplier monitoring usually find the signals were sitting in their own systems the whole time.

Clock two: supplier-effort data collection. Questionnaires, certificates, self-assessments, document refreshes, audits. Every cycle spends a finite amount of supplier goodwill, and it is the only clock the supplier really feels. This is the one to ration, and the rest of this article is mostly about how.

Clock three: the relationship review. The conversation about direction, capacity, roadmap and joint improvement. This is a business rhythm rather than a compliance one, and it belongs with the suppliers where the upside justifies the time. A well-run quarterly business review drives supplier change in a way an annual form never will.

Once the clocks are separate, the question stops being “how often do we evaluate everyone” and becomes three sharper questions. What do we watch constantly? What do we ask for, and from whom? Who do we sit down with?

What regulators and accreditors already worked out

Setting inspection frequency under resource constraints is a solved problem in several industries, and the solutions converge on the same principle: frequency should be earned, not fixed.

Aerospace: intervals as a reward. In the Nadcap programme, run by the Performance Review Institute, initial accreditation runs for 12 months before a reaccreditation audit is expected. Suppliers with a strong record can then qualify for merit status, under which accreditations last 18 months, and later 24. The criteria are specific. For 18-month merit a supplier needs to be at least at its second reaccreditation in that commodity, carry no non-sustaining corrective actions from the current or previous audit, and stay within defined limits on delinquency days and nonconformance counts. The 24-month interval asks for more: two consecutive accreditations of at least 18 months each, no major nonconformances, and no more than seven cumulative days of delinquency.

The design is worth pausing on. A longer interval is not an administrative convenience granted to save the auditor time. It is a status the supplier earns, can see the criteria for, and can lose.

Food safety in the EU: frequency proportionate to risk. Regulation (EU) 2017/625 requires official controls to be performed regularly, on a risk basis and at appropriate frequency, with authorities adjusting the control effort to the risk and the level of compliance expected. The regulation is explicit that a good compliance record should mean lighter treatment, noting that operators with a good record of compliance should bear lower overall charges than non-compliant ones, as they should be subject to less frequent official controls.

Food safety in the US: risk-based frequency written into law. The FDA Food Safety Modernization Act established a mandated inspection frequency based on risk, requiring that all high-risk domestic facilities be inspected within five years of enactment and no less than every three years thereafter.

Three different regimes, three different industries, one shared conclusion. Nobody with real resource constraints inspects everything at the same interval, and nobody treats a good track record as irrelevant to how often you come back.

Your supplier programme has exactly the same constraints. It can use exactly the same logic.

A merit-based cadence model

Here is the model in one table. Treat the intervals as starting points to calibrate against your own category risk, not as universal truths.

Two design notes matter more than the numbers.

First, the tier follows impact on conformity, not spend. A low-spend supplier of a safety-critical component belongs above a high-spend supplier of office consumables. If you have not segmented yet, a risk-based supplier segmentation or a Kraljic-based split gets you most of the way in an afternoon.

Second, publish the criteria. A supplier who knows that two clean cycles earns a longer interval has a reason to respond well to the current one. A supplier who thinks the schedule is arbitrary has no such reason. This is the quiet advantage of the merit approach: it converts your evaluation cadence from a cost you impose into an incentive you offer, using nothing but information you already hold. Make the thresholds visible in your supplier scorecards, and if you are still designing the scoring model, our guide to building a weighted supplier scorecard covers how to set thresholds that hold up across categories.

Events should outrank the calendar

The strongest argument against pure calendar scheduling is that risk does not arrive in annual instalments. A re-evaluation triggered by something that actually happened is worth several triggered by a date.

Build a short, agreed list of events that pull a supplier forward regardless of when they are next due:

• A major nonconformance or a repeat of a previously closed one
• A change of ownership, site, or key sub-tier supplier
• A sustained fall in on-time delivery or responsiveness on clock one
• Entry into a new regulatory scope, a new market, or a new critical part
• A disruption affecting their region, sector or logistics route
• Loss or lapse of a certification you rely on

This is where clock one earns its place. Continuous signals are what make event triggers possible, and automated follow-up for supplier evaluation and risk turns a trigger into a request without anyone remembering to send it. Business continuity deserves a specific mention here, and it is worth telling your suppliers that continuity is a priority rather than discovering their assumptions during an incident.

Anything that triggers a re-evaluation should also close properly. A finding that leads nowhere teaches the supplier that findings lead nowhere, so each one needs a tracked supplier CAPA with an owner, a date and verification of effectiveness.

Spending the attention budget well

Think of supplier attention as a budget rather than a free resource. Every questionnaire draws on the same account, and the balance is shared across you, your colleagues in other departments and your supplier’s other customers. Cadence decisions are really allocation decisions.

Three moves free up budget without reducing coverage.

Collect once, use many times. Overlapping requests from quality, procurement and sustainability are the most common source of avoidable supplier effort. A single structured intake, through a supplier portal or a shared onboarding process, lets one submission serve several internal purposes.

Ask only for what changes. Much of a typical annual questionnaire repeats information that has not moved since last time. Pre-filling known answers and asking suppliers to confirm or correct turns a long form into a short one, which is a large part of avoiding evaluation fatigue in procurement teams and at the supplier’s end too.

Give something back each cycle. The most reliable way to keep response rates healthy over a long cadence is to return the supplier’s own scorecard with peer context and a clear view of where they stand. It costs you nothing you do not already have, and it changes the request from an obligation into an exchange. Consistency helps here, which is why reducing bias in supplier performance reviews matters as much for credibility with suppliers as for internal fairness.

Where an on-site visit would be the natural next step but the travel is hard to justify, digital supplier audits let you keep a meaningful interval without the cost that usually forces teams to stretch it.

Making the change without an argument

Changing cadence tends to raise two internal objections, and both have straightforward answers.

“Reducing frequency looks like reducing control.” It is the opposite if you say it properly. You are moving from a fixed interval applied uniformly to a risk-proportionate interval with documented criteria, continuous monitoring underneath it and event triggers on top. That is a stronger control story, and it is the same logic regulators use. Record the rationale, the tier definitions and the trigger list as documented information, and your reporting and audit trail shows an auditor a considered system rather than a habit.

“We cannot track different intervals for different suppliers.” This is a real constraint in a spreadsheet, where a single shared deadline is the only manageable option. It stops being a constraint once intervals, triggers and reminders are held in a system, which is a common reason teams replace spreadsheets for supplier management and the thing that makes differentiated cadence practical when you scale a programme past a few hundred suppliers.

In regulated sectors the tier boundaries sit tighter and the documentation bar is higher, though the structure holds. Teams working under device or pharmaceutical oversight will recognise it from supplier relationship management for medical devices and for pharma, and automotive teams from the customer-specific requirements behind a scorecard built for IATF 16949.

A sensible first step is to leave the cadence alone and split the clocks. Put continuous signals in place, agree the event trigger list, and let the evidence from the first two quarters tell you which suppliers have earned a longer interval. By the time you change the schedule, you will have the record to justify it.

If you want to see how tiered intervals, triggers and automated follow-up work in one place, you can start a supplier performance pilot or book a demo.

Frequently asked questions

How often should you evaluate suppliers?
There is no single correct interval. A practical model is 3 to 6 months for critical, new or recovering suppliers, 12 months as a standard cycle, 18 to 24 months for proven suppliers who have earned a longer interval through consecutive clean cycles, and 24 to 36 months or event-only for low-impact suppliers. Continuous monitoring of data you already hold should run underneath all tiers.

Does ISO 9001 require annual supplier evaluation?
No. ISO 9001 requires defined criteria for evaluating, selecting, monitoring and re-evaluating external providers, with controls proportionate to the impact of what they supply, and documented evidence. It does not specify a frequency. Annual review is a widespread convention rather than a requirement, so a documented risk-based cadence is fully compatible with the standard.

Is it risky to reduce supplier evaluation frequency?
It depends entirely on what replaces the removed cycles. Reducing frequency on its own reduces oversight. Reducing frequency while adding continuous signal monitoring and event-based triggers usually increases it, because you learn about problems when they happen rather than at the next scheduled date. This is the same reasoning behind risk-based inspection frequency in food safety regulation and merit-based audit intervals in aerospace accreditation.

What should trigger an off-cycle supplier re-evaluation?
Common triggers are a major or repeat nonconformance, a change of ownership, site or critical sub-tier supplier, a sustained decline in delivery or responsiveness, entry into a new regulatory scope or critical part, a disruption affecting the supplier’s region or sector, and the lapse of a certification you rely on.

How do you decide which suppliers get a longer interval?
Base it on impact on conformity rather than spend, then let performance move suppliers between tiers against published criteria. Typical criteria for extending an interval are two consecutive cycles with no major findings, all corrective actions closed on time, and a scorecard above an agreed threshold. Publishing the criteria matters, because a supplier who can see how to earn a longer interval has a reason to engage with the current cycle.

How often should supplier business reviews happen?
Relationship reviews follow a different clock from compliance data collection. Quarterly suits strategic and development suppliers where there is a genuine agenda, annual suits most others, and low-impact suppliers rarely need one at all. Keeping this separate from your data collection cycle stops the review from becoming a form-filling exercise.

Sources: Nadcap merit process and accreditation intervals, Thermal Processing Magazine; Performance Review Institute, frequently asked questions; Regulation (EU) 2017/625 on official controls, EUR-Lex; Background on the FDA Food Safety Modernization Act, FDA.

Every supplier programme eventually runs into the same wall, and it is rarely the wall people plan for.

The scorecard design is sound. The KPI weightings survived the workshop. The regulatory requirement is understood, the questionnaire is built, the deadline is in the calendar. Then the requests go out, and six weeks later 58 percent of suppliers have responded. Now the team is making decisions on partial data, and the programme’s credibility depends on a number nobody owns.

Response rate is the quiet constraint on supplier evaluation, supplier compliance data, onboarding and risk monitoring alike. It is also one of the most improvable numbers in procurement, because decades of research exist on what makes people answer a request for information, and very little of that research has made its way into how supplier data requests are actually written and sent.

This piece is the practical version of that evidence. The studies below come from survey methodology rather than procurement, so treat the effect sizes as direction rather than promises. The direction is consistent enough to design around.

Why the number matters more than it looks

A response rate is not just a completeness statistic. It quietly determines four things.

It sets the ceiling on your analysis. A supplier scorecard covering 60 percent of your base is not 60 percent of a scorecard programme. It is a programme with a blind spot in an unknown place, because non-responders are rarely a random sample. They tend to be the smaller, busier, less well-resourced suppliers, which is often exactly where the interesting variance sits.

It decides whether the programme survives its first year. Teams abandon supplier evaluation cycles because chasing felt worse than the insight was worth. High response rates make the next cycle easy to justify.

It is the real deadline on compliance work. Regulatory data collection depends on people outside your organisation finding time to answer you. The legal analysis takes a week. Getting documents back from 300 suppliers across nine countries takes months, which is why the ESG, CSRD and CSDDD requirements you collect during onboarding are a response rate problem long before they are a reporting problem.

It is a relationship signal. Suppliers who answer promptly are usually suppliers who feel the relationship is worth the effort. A rising response rate is one of the earliest positive indicators you get.

The good news is that high rates are demonstrably achievable at scale. CDP’s supply chain programme had more than 45,000 suppliers requested to disclose in 2025 through 200-plus buying organisations, and it publishes member examples at the top of the range, including Lenovo reaching a 98 percent response rate among its suppliers in 2024. That is not a typical number, but it does establish that the ceiling is much higher than most programmes assume.

What the research actually found

Three bodies of evidence are worth knowing.

A Cochrane methodology review by Edwards and colleagues pooled 32 trials covering 27 different strategies for electronic questionnaires and reported the odds of response for each. A meta-analysis by Wu, Zhao and Fils-Aime of 1,071 response rates drawn from 1,043 studies, in education-related research, found a weighted mean online response rate of 44.1 percent, with useful detail on what shifted it. And a controlled length experiment at the University of Gothenburg’s SOM Institute tested a long questionnaire against a shorter one on the same population.

Here is what moved the needle, and by how much.

Two patterns jump out.

The first is that length and framing beat pressure. Shortening the request and making its relevance obvious carry more weight than deadlines or money. The Gothenburg experiment adds a useful nuance: the length penalty appeared in paper responses and not in web responses, which suggests that on a well-built digital form, perceived effort matters more than the raw question count. A long form that shows progress and remembers previous answers is treated differently from a long form that looks long.

The second is that the cheapest wins are in the wording. Personalisation, a named sender, a clear deadline, social proof and an offer to share results back cost nothing to implement and compound with each other.

Seven levers, in the order we would pull them

1. Cut the request to what you will actually use

Before touching the send mechanics, delete questions. Every field should have a named consumer and a decision it feeds. In most supplier questionnaires, a meaningful share of fields exist because someone might want them one day, and they are paid for in response rate by everyone.

If different supplier groups need different depth, send different forms. A supplier passing you a single certificate should never see the questionnaire designed for your strategic partners. A simple risk-based segmentation or a Kraljic-style split is usually enough to define two or three tiers of depth.

2. Pre-notify, especially the suppliers who matter most

Pre-contact lifted response from 45.4 to 54.6 percent in the meta-analysis, roughly nine points for one extra touch. In a supplier context, this is your category manager mentioning the upcoming request on the next call, or a short note from a named person a week ahead.

It works because it converts a cold request into an expected one. For your top suppliers, a two-minute mention in an existing conversation is the highest-return activity on this list.

3. Write it as a business request, not a survey

The Cochrane finding that the word “survey” in a subject line reduced response is a small effect with a large lesson. A supplier data request is not market research. It is part of a commercial relationship, and the wording should say so.

Name the sender and make them a real person. Say what the data is for, what decision it feeds and what the supplier gets from it. Give a date. Add social proof where you have it, since telling recipients that others had already responded raised the odds of response by around half. A line noting that most suppliers in their category have already completed it is honest, easy to generate from your own completion data, and effective.

These are the same principles that make supplier communication management work generally: clarity about purpose, a named owner, and a visible consequence.

4. Offer something back, and then deliver it

Offering to share results raised the odds of response by about a third, and non-monetary incentives nearly doubled them, while cash-style incentives showed no significant effect at all. For supplier programmes this is close to ideal, because the thing suppliers most want is something you already have.

Send the scorecard back. Show them where they rank against the anonymised peer group. Suppliers are rarely told how their buyer sees them, and many genuinely want to know. Doing this once changes next cycle’s response rate, because the request is no longer a tax, it is the price of admission to a conversation about their own performance. A structured business review is the natural place for that exchange.

5. Automate the reminder cadence, then escalate by channel

Response arrives in waves, and most programmes stop chasing before the second wave. Reminders work, and their effect depends on channel: phone follow-up reached 79 percent against 37.8 percent for email reminders in the meta-analysis, although that figure rests on only six cases and should be read as a strong hint rather than a benchmark.

The practical design is a ladder. Automated reminders on a fixed cadence handle the bulk, so nobody spends their week chasing 300 suppliers by hand. Then human escalation, by phone and through the category manager, is reserved for the suppliers who matter and the ones still missing. Automated follow-up is what makes that ladder affordable, and it is the single change that most reliably moves a stalled campaign.

6. Remove every avoidable point of friction

Each obstacle between the request and the answer costs you responses: a login nobody can find, a form that loses work, a file the supplier has already sent twice, a question only available in a language they do not work in.

Three fixes cover most of it. Let suppliers see and update what you already hold rather than re-entering it, which is what a supplier portal with clean master data is for. Support the languages and legal entities your supply base actually has, since multi-entity and multi-language onboarding removes a barrier that is invisible from headquarters. And never ask twice for the same document.

The internal version matters too. Evaluation fatigue on your own side produces vaguer requests and weaker follow-up, so protecting your team’s attention protects the response rate.

7. Make response rate a tracked KPI with an owner

Most programmes measure supplier performance and forget to measure the programme. Put the response rate on the dashboard: overall, by category, by region, by supplier tier and by days since request. Watch the curve rather than the endpoint, since a campaign that is flat in week three will not rescue itself in week eight.

Treat a persistent non-responder the way you would treat any other open issue, with an owner and a date, which is the same discipline as a supplier corrective action. And keep the record, because an audit trail of who was asked, when, and how many times is what turns a chase into evidence of due diligence.

What good looks like

Rather than a benchmark, use these as design targets, tested against your own baseline.

• First send, no reminders: many programmes land somewhere near the 44 percent weighted mean the meta-analysis found for online surveys in its field, which is a rough reference point rather than a procurement benchmark. If you are well above it, your relationships are doing real work.
• After a full automated reminder cadence: a large share of the remaining willing respondents arrive here. This is where most of the available improvement sits, and it is almost entirely a systems question.
• After human escalation on the suppliers that matter: strategic and high-risk suppliers should approach complete coverage, because for those relationships a non-response is a commercial conversation rather than a data problem.
• Next cycle: the strongest predictor of response is what happened last time. Suppliers who received something useful in return answer faster.

The shift from an annual push to a continuous rhythm helps here too. When requests are smaller and more frequent, each one is less disruptive, which is a large part of the case for moving from annual reviews to continuous monitoring.

Where software earns its place

Nothing on this list is impossible in a spreadsheet and an inbox. What a system changes is the cost of doing it consistently, at scale, cycle after cycle.

EvaluationsHub is built around exactly this layer of the work: per-supplier completion tracking so the gap is visible rather than estimated, automated reminders that keep the curve climbing without anyone chasing by hand, tiered request forms so each supplier group answers only what it should, supplier-facing access in the languages and entities your base actually needs, scorecards you can send back as the thing suppliers get in return, and an audit trail that assembles itself while the team works. Because it sits across the supplier lifecycle, the data you collect lands beside performance, risk and corrective actions instead of in another silo, which is the practical end of replacing spreadsheets.

If you want to see what your own response curve looks like, the fastest route is a focused pilot on one category, or a demo with your supplier list in front of you.

Frequently asked questions

What is a good supplier response rate?
There is no published procurement-wide benchmark, so the useful comparison is your own baseline. For context, a meta-analysis of 1,043 studies in education-related research found a weighted mean online survey response rate of 44.1 percent, and CDP publishes supply chain member examples at the top of the range, including a 98 percent supplier response rate reported by Lenovo in 2024. Most programmes should target near-complete coverage for strategic and high-risk suppliers and accept a lower rate on the long tail.

How do I increase supplier response rates?
The evidence points to shortening the request, making its relevance and purpose explicit, pre-notifying suppliers before it arrives, personalising it with a named sender, giving a clear deadline, adding social proof, offering something back such as the scorecard, and running an automated reminder cadence with human escalation for the suppliers who matter most.

Do incentives improve supplier response rates?
Financial incentives showed no significant effect in the meta-analysis, while non-monetary incentives nearly doubled the odds of response in the Cochrane review. In a supplier context the most valuable non-monetary offer is usually information the buyer already holds, such as performance feedback and anonymised peer benchmarking.

How many reminders should I send?
Enough to catch the second and third waves, on a predictable cadence, with the schedule automated rather than manual. Reminder effect varies sharply by channel, with phone follow-up outperforming email in the available research, so the efficient pattern is automated reminders for everyone and human follow-up reserved for strategic, high-risk and still-missing suppliers.

Does a longer supplier questionnaire reduce responses?
Yes, though the mechanism matters. Shorter electronic questionnaires had 1.73 times the odds of response in the Cochrane review. A controlled experiment comparing a 205-question form with a 149-question form found a 2.7 point drop, but only for paper responses, with no significant difference on the web. Perceived effort appears to matter more than question count, so a well-designed digital form with saved progress is treated more kindly than its length suggests.

Who should own the supplier response rate?
Someone with a commercial relationship to the supplier, supported by the programme owner. Compliance reminders move data slowly, and category managers move it quickly, which is why cross-department collaboration tends to be the difference between a stalled campaign and a complete one.

Should response rate be a reported KPI?
Yes. Tracking it overall and by category, region, tier and days since request turns a vague sense of “suppliers are slow” into a curve you can act on while there is still time to act, and it makes the programme’s own performance visible alongside the suppliers’.

Sources: Edwards PJ and colleagues, Methods to increase response to postal and electronic questionnaires, Cochrane systematic review; Wu M-J, Zhao K and Fils-Aime F, Response rates of online surveys in published research: a meta-analysis, Computers in Human Behavior Reports, 2022; Sandelin F, The effects of questionnaire length on response rate, non-response bias and data quality, SOM Institute, University of Gothenburg, 2022; CDP Supply Chain.

On 16 September 2026, ISO published ISO 9001:2026, the first full revision of the world’s most widely used quality management standard in more than a decade. Certification bodies are already publishing gap guides, and most commentary focuses on leadership, quality culture and climate.

For supplier quality and vendor management teams, the more useful question is simpler: what does the new edition change about how we select, monitor and develop external providers, and what should we do about it this quarter?

The good news: nothing in ISO 9001:2026 asks you to rebuild your supplier programme. The revision rewards teams that already manage suppliers with structure, evidence and follow-through, and it gives everyone else a clear reason to get there over the transition period.

The short version

• Clause 8.4 (control of externally provided processes, products and services) keeps its core logic. You still need defined criteria for evaluating, selecting, monitoring and re-evaluating external providers, with documented evidence.
• Clause 6.1 now separates risks from opportunities, each with its own action cycle. That maps neatly onto supplier risk management on one side and supplier development on the other.
• Clause 4.1 asks you to determine whether climate change is a relevant issue, which for most manufacturers quickly leads to the supply base.
• Clause 4.2 asks which interested-party requirements you will actually address through the QMS, which matters when customers flow down supplier requirements.
• Quality culture and ethical behaviour are now explicit in leadership and awareness requirements, and suppliers are part of how that culture shows up in practice.
• A three-year transition is widely expected, in line with earlier revisions. Confirm exact dates with your certification body.

Why 8.4 staying stable is actually good news

Clause 8.4 has always been where supplier management lives inside ISO 9001. It requires an organisation to determine the controls it applies to external providers, and to base them on the potential impact of what those providers deliver.

The 2026 edition keeps that foundation. Clause 8.1 is aligned with 8.4 terminology so operational planning now explicitly covers externally provided processes, products or services that are relevant to the QMS. In other words, suppliers are part of the operation you plan, not a separate topic you audit once a year.

That stability gives supplier quality teams a practical advantage: the work you invest now in consistent evaluation criteria, performance data and follow-up will carry straight into your transition audit. If you want a refresher on what good looks like, our guide on how to build a weighted supplier scorecard covers the mechanics.

Where the 2026 revision touches your supplier programme

1. Risks and opportunities now run on separate tracks (6.1)

In ISO 9001:2015, risks and opportunities sat together, and in many QMS documents “opportunities” became an afterthought. The 2026 edition splits them: one action cycle for risks, one for opportunities. A note also links risk actions to maintaining conformity during and after disruptions.

For a supplier programme, this is a helpful framing:

• The risk track covers single-source exposure, financial fragility, capacity, quality escapes, geopolitical and logistics disruption. This is the work of supplier risk management: identifying which suppliers could interrupt conformity, and what you do before it happens.
• The opportunity track covers suppliers who could improve cost, quality, innovation or sustainability if you invest in the relationship. This is where supplier development programmes and structured supplier performance improvement belong.

An auditor asking “how do you address opportunities?” is a chance to show that your best suppliers are managed actively, not only your worst ones.

2. Disruption resilience becomes part of the quality conversation

The link between risk actions and conformity during disruption reflects what quality teams have experienced over the past few years. It is hard to demonstrate that link with an annual supplier survey and a spreadsheet.

What helps is a monitoring rhythm that surfaces early signals: late deliveries trending up, a drop in responsiveness, repeated minor nonconformities. Moving from annual reviews to continuous supplier monitoring is one of the most practical steps you can take here, and it pays off in daily operations long before the audit.

3. Climate change relevance (4.1) reaches the supply base

The 2024 climate amendment is now fully integrated: organisations must determine whether climate change is a relevant issue for their context. For most manufacturers, a large share of climate exposure sits with suppliers, whether as physical risk to supplier sites or as emissions data customers are starting to request.

ISO 9001:2026 does not turn your QMS into a sustainability report. But if you conclude climate is relevant, your supplier evaluation criteria are a natural place to reflect it. Teams already collecting supplier ESG and CSRD data can connect those two worlds rather than running them in parallel.

4. Interested-party requirements you commit to (4.2)

The new 4.2 requirement asks you to determine which interested-party requirements will be addressed through the QMS. In practice, a lot of those arrive as customer flow-downs: supplier approval rules, special characteristics, traceability, audit rights.

Being explicit about which of these you manage through your supplier processes makes audits smoother and makes the conversation with customers easier. For automotive suppliers, our article on building a supplier scorecard that satisfies IATF 16949 shows how customer-specific requirements translate into scorecard criteria.

5. Quality culture and ethics include how you treat suppliers

Leadership must now demonstrate commitment to quality culture and ethical behaviour, and people must be aware of what that means (7.3). Culture is visible in behaviour, and supplier management is one of the most visible places: whether evaluations are fair and consistent, whether feedback reaches the supplier, whether corrective actions are closed or quietly forgotten.

Consistency across evaluators and sites matters here. Our piece on reducing bias in supplier performance reviews offers a few simple design choices that make evaluations more defensible and more useful for the supplier.

A practical 90-day plan for supplier quality teams

You have time. The aim of the first 90 days is not to be “2026-certified” but to know where you stand and to start collecting the evidence you will need anyway.

Days 1 to 30: map and baseline

1. Get the standard and your certification body’s transition guidance, and note the dates that apply to you.
2. List your current supplier evaluation, selection, monitoring and re-evaluation criteria (8.4.1) and check they are applied consistently across sites and categories.
3. Segment suppliers by impact on conformity. A simple Kraljic-based segmentation is enough to decide where controls should be tighter.

Days 31 to 60: split risks and opportunities

1. For critical suppliers, record the top risks to conformity and the planned actions, including continuity during disruption.
2. Separately, pick three to five suppliers with clear improvement or innovation potential and define what you want to achieve with each.
3. Decide whether climate change is relevant for your context, and if so, which supplier criteria will reflect it.

Days 61 to 90: close the loop and prove it

1. Make sure every nonconformity from a supplier leads to a tracked supplier CAPA with an owner, a due date and verification of effectiveness.
2. Check that evaluation results, decisions and follow-ups are retained as documented information that an auditor can navigate in minutes. A clear reporting and audit trail is the difference between a stressful audit and a calm one.
3. Share results with suppliers. Feedback that never reaches the supplier improves nothing.

Where software helps (and where it does not)

A standard cannot be met by a tool, and ISO 9001:2026 is deliberately technology-neutral. What software does well is make good practice the default: the same criteria applied by every evaluator, reminders that keep reviews on cadence, CAPAs that cannot silently stall, and an audit trail that builds itself as you work.

EvaluationsHub is built for exactly this layer of supplier lifecycle management, from supplier onboarding and supplier scorecards to risk, CAPA and development. If you want to see how your current process would look in a structured setup, you can start a supplier performance pilot or book a demo.

Frequently asked questions

When was ISO 9001:2026 published?
ISO published ISO 9001:2026 on 16 September 2026. It replaces ISO 9001:2015.

How long is the ISO 9001:2026 transition period?
A three-year transition period is widely expected, in line with previous revisions, which points to late 2029. Your certification body will confirm the exact dates and audit rules that apply to you.

Does ISO 9001:2026 change clause 8.4 on external providers?
The core requirements of 8.4 remain: defined criteria for evaluation, selection, performance monitoring and re-evaluation of external providers, with documented evidence. The wider revision (separate risk and opportunity cycles in 6.1, climate relevance in 4.1, interested-party requirements in 4.2, quality culture and ethics) influences how you apply those controls.

Do we need new supplier evaluation criteria for ISO 9001:2026?
Not necessarily. Many organisations can keep their criteria and strengthen consistency, risk and opportunity actions, and evidence. If you decide climate change is relevant to your context, reviewing supplier criteria with that lens is a sensible step.

Is a supplier scorecard enough to meet clause 8.4?
A scorecard covers performance monitoring, which is a central part of 8.4. Auditors will also look at selection criteria, re-evaluation, actions on poor performance and documented evidence, so the scorecard works best as part of a connected process.

Sources: ISO news release, September 2026; ISO 9001:2026 standard page; CQI | IRCA revision guidance; TÜV Rheinland revision overview; SGS publication note.