Category: Supplier Quality Management

Here is a clause that appears in a great many supplier quality agreements, in almost exactly these words:

The Supplier shall maintain a robust quality management system and shall promptly notify the Buyer of any significant changes.

It reads well. It has survived legal review at both ends. And it is doing almost no work, because three of its words carry the whole meaning and none of them is defined. Robust according to whom. Promptly meaning what. Significant by whose judgement.

A clause like that is not a problem when everything is going well. It becomes a problem on the one day you need it, when a supplier has moved a process to a second plant, told nobody, and can point out with a straight face that they did not consider the change significant.

The good news is that this is a fixable drafting problem rather than a relationship problem. Most supplier quality agreements can be made materially stronger in an afternoon, without renegotiating commercial terms and without a single adversarial conversation. The method is simple: every clause gets a record, an owner and a review point. If a clause has none of those three, it is a wish rather than a requirement.

What the quality agreement is for, and what it is not for

A supplier quality agreement is the document that says who does what on quality. It sits alongside the commercial contract rather than inside it, and the regulators who have written most clearly about these documents are unusually direct on that point.

The FDA’s 2016 guidance on quality agreements for contract drug manufacturing recommends that quality agreements “be separate documents, or at least severable, from commercial contracts such as master services agreements or supply agreements”, and says they “should not cover general business terms and conditions such as confidentiality, pricing or cost issues, delivery terms, or limits on liability or damages”. The guidance also describes the sections most quality agreements contain: purpose and scope, definitions, resolution of disagreements, manufacturing activities, and the life cycle of and revisions to the agreement itself.

The EU’s good manufacturing practice guidance takes the same line from a different angle. EudraLex Volume 4, Chapter 7 on outsourced activities states that “There must be a written Contract between the Contract Giver and the Contract Acceptor which clearly establishes the duties of each party”, and that the contract should specify “their respective responsibilities and communication processes relating to the outsourced activities”.

Those two sources come from pharmaceutical and medical device supply, where the expectations are written down most explicitly. Two things follow from the pairing, and they apply well outside those sectors.

First, the agreement is a responsibilities document. Its job is to remove ambiguity about who acts, not to express an aspiration about quality.

Second, keeping it severable from the commercial contract is what makes it maintainable. A quality agreement you can revise without reopening pricing is a quality agreement that stays current. One that is buried in a master supply agreement will be exactly as accurate as it was on the day it was signed.

That separation is also why the life cycle section the FDA describes matters more than it looks. An agreement with no stated revision route quietly becomes a historical document.

The clause-to-evidence map

This is the part worth doing properly, and it is the part almost nobody does. Take your existing agreement, list the clauses, and for each one write down the record that proves compliance, the person who looks at it, and the interval at which they look.

The clause promises	The record that proves it	Who watches it	Review point
A certified quality management system	Certificate number, issuing body, scope statement, expiry date	Supplier quality	On expiry, automatically
Notice before any change to product, process, material or site	Dated change notifications, matched against what you actually received	Supplier quality and engineering	Each notification, plus an annual confirm-or-correct
Manufacture only at the agreed sites	Site list with valid-from and valid-to dates, linked to the parts made there	Master data owner	On change, plus annual
No subcontracting without prior approval	Approved sub-tier list with the approval date and approver	Category owner	On request, plus annual
Response to a corrective action request within an agreed time	CAPA record with raised date, acknowledged date, containment date, closed date	Quality engineer	Per case, reported monthly
Retention of batch, lot or build records for an agreed period	The retention period stated per record type, plus a tested access route	Quality systems	Annual spot check
Agreed performance levels for delivery and quality	The metric definition and the dataset it is calculated from	Supplier quality	Per scorecard cycle
No shipment of non-conforming material without a written concession	Concession and deviation register, with an expiry on each one	Incoming quality	Per case

The exercise usually produces two uncomfortable findings and one useful one.

The uncomfortable findings are that several clauses have no record at all, and that several records exist but nobody owns them. The useful one is that the list of things you genuinely need from suppliers turns out to be shorter than the agreement implies, which makes the request you send them easier to answer. That matters, because supplier response rate is the constraint that decides whether any of this works in practice.

None of this needs new infrastructure to start. A spreadsheet with four columns will expose the gaps perfectly well. It is only when you want the review points to fire on their own that you need somewhere to keep them, which is the argument for holding the agreement’s obligations in the same place you hold supplier records and documents rather than in a folder on a shared drive.

The three words to replace

Most weak clauses are weak for the same three reasons. Each has a straightforward fix.

Robust, appropriate, adequate. These invite a difference of opinion at the worst possible moment. Replace them with a named standard and a verifiable artefact. Not “a robust quality management system” but “certification to ISO 9001, with the certificate, its scope statement and its expiry date provided on request and on renewal”. If the site is a manufacturing site in a regulated sector, name the sector standard instead. ISO 13485 and IATF 16949 both certify at site level rather than company level, so a single corporate certificate does not answer the question you are asking. The control of external providers in ISO 9001:2026 works the same way: it asks you to state your requirements, not to hope they are understood.

Promptly, in a timely manner, as soon as practicable. Replace with a number, and attach the number to an event rather than to a feeling. Change notification is the clearest example. ISO 13485:2016 addresses this directly in its purchasing information requirements, which call for a written agreement that the supplier will notify the organisation of changes to the purchased product before those changes are implemented. Before implementation is the load-bearing phrase, and it is the one to borrow whatever sector you are in. In practice most teams turn that into a stated notice period for planned changes and immediate notice for unplanned ones. Whatever number you choose, choose it per category rather than globally, because thirty days of notice is generous for a packaging film and nowhere near enough for a sterilised component that needs revalidation.

Significant, material, major. This is the one that causes the most trouble, because it hands the judgement to the party with the least incentive to exercise it broadly. Replace it with a list. A change list does not need to be long to be effective: manufacturing site or line, production process or key process parameter, sub-tier supplier of a listed material, raw material grade or source, test method, software or firmware in a delivered product, packaging that contacts the product, and the standard or certificate the site holds. Then add a catch-all that asks the supplier to notify anything they are unsure about, and answer those quickly enough that asking stays cheap for them.

The last point is the one that decides whether the clause works. A change notification clause is only as good as your turnaround on the notifications you receive. If a supplier’s notice sits unanswered for six weeks, they will stop sending them, and no drafting will fix that.

The clauses worth the argument

Not every clause earns the negotiation time. These generally do, and they hold up across sectors.

Change notification, as above. The single highest-value clause in the document. Most supplier quality surprises are changes that were never announced.

Site of manufacture, named. A clause that commits the supplier to manufacture only at agreed sites gives you something specific to check, and it is the clause that makes the rest of your supplier and site data trustworthy. Ask for the site list with valid-from dates, not just a current snapshot.

Sub-tier visibility and approval. EudraLex Chapter 7 puts this plainly: “The Contract Acceptor should not subcontract to a third party any of the work entrusted to him under the Contract without the Contract Giver’s prior evaluation and approval.” You do not need full multi-tier mapping to benefit from this. Naming the sub-tiers that matter for the parts that matter is enough to start, and it is far easier to get at contract renewal than in the middle of an incident.

No unauthorised changes. Chapter 7 again: “The Contract Acceptor should not make unauthorized changes, outside the terms of the Contract, which may adversely affect the quality of the outsourced activities.” Worth including even where no GMP obligation applies, because it closes the gap between notifying a change and being allowed to make it.

Corrective action response times, tiered by severity. One response time for everything is either too slow for real problems or too aggressive for minor ones, and the second failure is worse because it trains everybody to miss the deadline. Tier it, and make sure the tiers match how your corrective action process actually classifies findings.

Concessions and deviations, with expiry dates. Every concession should carry an end date or a quantity limit. Concessions that quietly become permanent are one of the most common ways a specification drifts without anyone deciding to change it.

Records, retention and access. State the retention period per record type and, more importantly, state the access route. A retention clause that has never been tested is an assumption. One spot check a year turns it into a fact, and gives you the audit trail you will want if a customer or notified body ever asks how you verified it.

Audit rights, including remote. Write in the option of a documented remote assessment alongside on-site audit rights. It costs nothing to include and it is what makes a digital or remote audit available to you later without a fresh negotiation.

Exit provisions. Last-time-buy rights, record handover, tooling return and a transition period. These are far cheaper to agree at the start of a relationship than at the end of one, and they make an eventual structured offboarding a process rather than an argument.

The clauses that create work for you

Here is the part that most templates leave out, and it is the part that makes the rest credible.

A supplier quality agreement that only imposes obligations tends to be complied with narrowly. One that also states what you will do tends to be complied with willingly, and it is a much easier document to get signed. The FDA guidance and the EU GMP chapter both frame these documents as establishing the duties of each party, which is a useful reminder that there are two parties in the phrase.

Four mutual clauses are worth writing in.

Your approval turnaround. If you require notice before a change, state how quickly you will respond. Suppliers who wait months for a deviation decision start making decisions themselves.

Your forecast horizon. Say what visibility you will provide and how far ahead. Much of what looks like supplier delivery unreliability is a forecast problem wearing a supplier’s name, and saying so in the agreement is an act of good faith that costs very little.

A named contact on your side, with a named backup. Agreements routinely require the supplier to nominate a quality contact and say nothing about who the supplier should call. This one clause removes a surprising amount of friction.

The results come back. Commit to sharing the supplier’s own performance data with them on a stated cycle. This is the cheapest clause in the document and one of the most effective, because the data already exists on your side. Sending the supplier scorecard back is what turns evaluation from something done to a supplier into something they can act on, and it makes every subsequent data request easier to land.

Where the agreement meets the scorecard

Most disputes about a supplier scorecard are not disputes about performance. They are disputes about definitions, and they are almost always traceable to a clause that was never written.

Two teams looking at the same shipments will produce different on-time delivery numbers if one measures against the date the supplier promised and the other against the date the buyer requested. Add goods-receipt date versus dock date, a tolerance window measured in days versus hours, and different treatment of partial deliveries, and the gap between two honest calculations can be very wide.

The agreement is where those definitions belong. For each metric you intend to hold a supplier to, write down the event that starts the clock, the event that stops it, the tolerance, the treatment of partials and reschedules, and the data source of record. That is perhaps a paragraph per metric, and it converts an annual argument into a shared reference.

The same logic applies to quality metrics. Parts per million defective is not one number until you have said whether it counts incoming rejections only or includes line stoppages and field returns, and whether it is measured per part number or per site. Settling that in the agreement is what allows a weighted scorecard to be discussed on its merits.

There is a useful discipline here: do not write a metric into the agreement that you are not yet able to calculate. A committed metric you cannot produce is worse than no metric, because the first time you fail to produce it you have taught the supplier that the agreement is decorative.

Retiring clauses is part of maintaining them

Quality agreements only ever grow. Every incident adds a clause, and nothing ever removes one. After a few years the document is long, parts of it contradict other parts, and nobody can say which clauses are actually monitored.

The fix is a review point on the document itself, which is exactly what the FDA guidance means by including the life cycle of and revisions to the agreement. Once a year, walk the clause-to-evidence map and ask three questions of each clause: has anybody looked at this record in the past twelve months, is the named owner still in the role, and would we notice if the supplier stopped complying.

A clause that fails all three is not protecting you. It is either a record you should start collecting or a clause you should remove, and removing it is a legitimate answer. A shorter agreement that is fully monitored is stronger than a long one that is monitored in patches, and it is a much better basis for the kind of conversation you want in a quarterly business review.

Tier the review effort the way you tier everything else. Your critical and strategic suppliers deserve a genuine annual clause review. For the long tail, a confirm-or-correct on the certificates and the site list is proportionate, and that judgement should follow the same risk-based segmentation you already use for evaluation frequency.

A first pass you can do this week

You do not need a legal project to make progress. Pick your three highest-spend or highest-risk suppliers and do this.

1. Print the current quality agreement and list its clauses in a four-column table: clause, record, owner, review point.
2. Fill in the columns you can. Leave the rest blank rather than guessing, because the blanks are the output of the exercise.
3. Circle every use of robust, appropriate, adequate, promptly, timely, significant, material and major.
4. For the change notification clause only, draft the replacement: the change list, the notice period per category, and your own response commitment.
5. Check the certificate expiry dates you hold against the certificates the supplier holds. This single check finds more issues than most people expect, and it is a friendly conversation to have.
6. Note which of the blanks in column two are records you could collect through your existing supplier portal rather than by email.

Three suppliers is enough to tell you whether your template needs a revision or a rewrite, and it gives you a worked example to take to the rest of the base. If you want a structured way to prove the approach before rolling it out, a short supplier performance pilot on those same three is a reasonable way to do it.

The short version

A supplier quality agreement is not a statement of intent. It is a list of obligations, each of which should point at a record, an owner and a date. Write clauses you can measure, say what you will do as well as what you require, put your metric definitions in the document rather than in the argument, and review the whole thing once a year with permission to delete.

Suppliers are rarely the obstacle here. Most of them would much rather be held to a clear standard they can meet than a vague one they can only fail unexpectedly.

If you would like to see how the obligations in an agreement can be held against live supplier records, certificates and scorecards in one place, we are happy to walk you through it.

Frequently asked questions

Is a supplier quality agreement the same as a supply agreement?

No, and it is generally better if it is not. The FDA’s guidance on quality agreements recommends they be separate documents, or at least severable, from commercial contracts, and that they leave out general business terms such as confidentiality, pricing, delivery terms and liability. The practical benefit is maintainability: you can revise a severable quality agreement as processes change without reopening the commercial negotiation.

Do we need one for every supplier?

Very few organisations need a full quality agreement with every supplier, and attempting it usually produces a lot of unsigned documents. Tier it. A full agreement for suppliers whose output affects product conformity or regulatory status, a short quality annex for the middle tier, and standard purchase order terms for the long tail is a defensible structure. The segmentation model you already use for evaluation can decide the tiers.

What is the single most valuable clause to fix first?

Change notification, in almost every case. Most supplier quality surprises are changes that happened without notice. Replace the word significant with an explicit change list, require notice before implementation rather than promptly, set the notice period per category, and state your own response time in the same clause.

How do we handle a supplier who will not sign our template?

Ask which specific clauses they object to, because the answer is informative. Objections to record retention, site naming or sub-tier disclosure sometimes reveal a capability gap rather than a commercial position, and a capability gap is something you can work on together through supplier development. Objections to one-sided approval timelines are usually fair, and adding your own commitments is the cheapest concession available.

Where should the agreement’s obligations actually live?

Wherever you will see them without looking for them. An agreement in a contract repository is a legal record; the obligations inside it need to be operational, which means certificate expiry dates that raise a task, change notifications that create a record, and clause owners who are named people rather than departments. Teams that keep this in documents tend to discover lapses at audit time, which is the argument for moving supplier obligations out of spreadsheets.

Does this apply outside regulated industries?

The drafting method does, entirely. The regulatory sources quoted here are simply the places where the thinking has been written down most clearly. A change notification clause with a defined change list is just as useful for an electronics contract manufacturer or a packaging converter as it is for a pharmaceutical contract facility, and the clause-to-evidence map works the same way in IT services as in automotive.

Run one query against your supplier database this week.

Find every supplier record holding an ISO 9001:2015 certificate with a stored expiry date after 30 September 2029. Then find every supplier record holding an ISO 14001:2015 certificate with a stored expiry date after 30 April 2029.

Both lists are wrong, and they were wrong the moment the transition requirements were published in September 2026. The certificates in those records will stop being accredited certification before the dates printed on them. Nothing in your system knows that yet, because the expiry date on a certificate and the end of a transition period are two different things, and almost every supplier database stores only the first one.

This is not a crisis. It is a three year piece of housekeeping with a very long runway, and the teams that start it now will spend an hour on it rather than a quarter. It also happens to be one of the cleanest opportunities you will get this year to improve the quality of your supplier records, because it gives you a concrete, dated reason to go and look at them.

What actually happened in September 2026

Three things landed within two weeks of each other.

ISO 9001:2026 was published on 16 September 2026. We covered what the revision itself changes for supplier quality teams in our guide to ISO 9001:2026 and the control of external providers, and this piece deliberately does not repeat it. The question here is not what the new standard asks of your quality system. It is what the transition does to the certificates you hold on file for other companies.

ISO 14001:2026 was published shortly before it, and it has its own separate transition.

The transition rules for both were set by Global ACI, which is the body that now does the job the International Accreditation Forum and the International Laboratory Accreditation Cooperation used to do separately. Global ACI came into operation on 1 January 2026, and its single mutual recognition arrangement replaces the former IAF MLA and ILAC MRA. If you have been searching for an IAF resolution on the ISO 9001:2026 transition and finding nothing, that is why. The document exists, it just has a different name on it now.

For ISO 9001:2026, the rules sit in Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, issued 16 September 2026. For ISO 14001:2026, they sit in Global ACI-TECH-3-TR 2029-04-30 (M), Transition Requirements for ISO 14001:2026, issued 14 September 2026.

The two timetables, side by side

Here is where it gets interesting for anyone maintaining a supplier file. The two transitions do not run in step.

Milestone	ISO 9001:2026	ISO 14001:2026
Accreditation bodies ready to assess	31 March 2027	31 October 2026
Certification bodies submit transition declarations	30 June 2027	31 January 2027
Accreditation decisions completed	30 September 2027	30 April 2027
New certifications issued only to the 2026 edition	31 March 2028	31 October 2027
Final deadline for existing certificate holders to transition	30 September 2029	30 April 2029

Read the two right hand columns against each other and the practical shape of the next three years appears. The environmental transition is roughly five months ahead of the quality one at every stage. The first milestone of either transition, accreditation bodies being ready to assess against ISO 14001:2026, falls on 31 October 2026, which is a few weeks away rather than a few years.

If you treat these as one combined project with one deadline, you will be late on the environmental side and early on the quality side. They are two projects that happen to look alike.

The two dates that are actually yours

Of the ten dates in that table, eight describe work that accreditation bodies and certification bodies have to do. You can safely ignore those. They matter to your suppliers’ auditors, not to you.

Two rows are yours.

The row that changes what arrives. From 31 March 2028 for quality, and 31 October 2027 for environment, new and initial accredited certifications may only be issued to the 2026 editions. This is the date that affects onboarding rather than monitoring. Qualify a new supplier after it, and the certificate they send you will be a 2026 one. Qualify a new supplier before it, and you may well receive a 2015 certificate that is perfectly valid on the day it arrives and already has a shortened life. If your supplier onboarding process has a checkbox that says “ISO 9001 certificate received”, that checkbox is about to start meaning two different things.

The row that changes what you already hold. 30 September 2029 for quality and 30 April 2029 for environment are the final deadlines for organisations still certified to the 2015 editions to complete their transition. These are the dates that quietly rewrite the expiry fields in your database.

Why the expiry field is wrong

A certificate carries an expiry date, usually three years from issue. A transition period carries an end date. When the two disagree, the transition date wins.

The previous cycle shows what that looks like in practice. ISO 9001:2015 replaced ISO 9001:2008, the transition period ended on 18 September 2018, and ISO/TC 176/SC 2 recorded the outcome in one sentence: “Accredited certification to ISO 9001:2008 is now no longer valid.” Certificates with printed dates running past that point did not survive it.

Global ACI’s announcements set the final deadline for completing the transition and do not spell out what happens to a 2015 certificate the day after. The sensible reading, and the one the previous cycle supports, is that an organisation which has not transitioned by then no longer holds accredited certification to the standard, whatever date is printed on the paper.

So the practical rule for your records is simple and slightly uncomfortable: for any ISO 9001:2015 or ISO 14001:2015 certificate you hold, the real expiry is the earlier of the printed date and the transition deadline. That is a one line change to how you calculate a renewal reminder, and it is worth making now rather than in 2029, because the whole point of the reminder is to give you notice.

A supplier whose certificate reads “valid to 14 March 2030” is not giving you cover until 2030. They are giving you cover until 30 September 2029 and then a question. If your certificate tracking lives in a spreadsheet, this is the kind of rule that has to be applied by hand every time somebody looks, which is to say it will not be applied. Systems that hold supplier information as structured records rather than attachments can hold two dates and alert on the earlier one, which is the whole argument for moving this work off spreadsheets in a single sentence.

Three populations in your supply base

Transitions are much easier to manage once you stop thinking of your certified suppliers as one group. They are three, and each needs a different thing from you.

The ones who will transition early and tell you. Typically larger suppliers with a dedicated quality function, often multi site, often certified to several standards at once. They will move during a scheduled surveillance or recertification audit, and a new certificate will arrive without you asking. Your only job here is to make sure the new certificate actually lands in the system and replaces the old one rather than sitting in somebody’s inbox. This is a process problem, not a supplier problem, and a supplier portal where the supplier uploads the document themselves removes it entirely.

The ones who will transition on their own schedule and need a reminder. The large middle. They are not at risk, they are just busy, and their certification body will handle it at the next audit in the normal way. They need one well timed, friendly request rather than a campaign, and the timing is the whole trick: too early and you are asking for something that does not exist yet, too late and you are chasing. More on timing below.

The ones who may quietly let certification lapse. This is the group worth your attention, and the reason is not compliance. A supplier deciding not to transition is a supplier making a decision about cost, capability or commitment, and that decision usually says something about the direction of the business well before it shows up in delivery or quality numbers. Treated well, a transition is a free, early, honest signal about supplier health, arriving years before your performance scorecards would pick anything up. That is genuinely useful information and it costs you nothing to collect.

Which suppliers belong in which group is a segmentation question, and if you already run risk based supplier segmentation you have most of the answer. Certification matters most where the purchased item carries the most risk, not where the supplier is largest, and segmentation models that separate strategic importance from risk exposure will tell you where to spend the attention.

The timing trap: do not require what cannot yet be issued

Here is the mistake to avoid, and it is an easy one to make with the best of intentions.

Someone writes a clause, or updates an onboarding requirement, or sends a supply base wide letter, asking suppliers to provide certification to ISO 9001:2026. In late 2026 and most of 2027, a large number of suppliers simply cannot, because their certification body has not yet been assessed and declared for the new edition. The accreditation decisions are not due to be complete until 30 September 2027 for quality and 30 April 2027 for environment. Asking before then produces confusion, a round of apologetic emails, and a small dent in your credibility with exactly the suppliers whose goodwill you will want later.

The generous version of the same request works far better and costs nothing. Ask when the supplier’s certification body expects to be able to audit them against the 2026 edition, and when their own transition audit is planned. That is a question every supplier can answer at any point in the next three years, it tells you what you actually need to know, and it reads as a buyer who understands the system rather than one issuing demands into it. It is also a much better use of your supplier follow up capacity than a request that will have to be sent twice.

A reasonable sequencing, which you can adjust to your own risk profile:

• Now to early 2027. Fix the data. Correct the expiry logic, find the records with missing or unreadable certificates, and establish which of your suppliers hold which standards at which sites. No supplier contact required.
• Through 2027. Ask the planning question above during reviews you are already holding. Fold it into the business reviews and evaluation cycles already in your calendar rather than creating a separate campaign.
• 2028. Follow up with the suppliers who have no plan and the suppliers who have gone quiet. By this point the system has capacity and there is still well over a year of runway.
• First half of 2029. Handle the exceptions, with the environmental deadline arriving five months before the quality one.

Starting the supplier facing work in 2027 rather than 2026 is not procrastination. It is waiting until the question has an answer.

What a certificate record should actually hold

Most supplier databases store a certificate as a file plus an expiry date. That was always a little thin, and this transition is a good excuse to fix it. A certificate record that earns its place holds:

Field	Why it matters
Standard and edition	The whole point. “ISO 9001” is no longer enough to identify what you hold.
Certificate number and issuing certification body	So you can verify it, and so you know whose transition declaration affects it.
Accreditation body	An unaccredited certificate is a different thing from an accredited one, and the transition rules described here govern accredited certification.
Scope statement	A certificate covering a product family you do not buy tells you very little.
Sites covered	The field most often missing, and the one that matters most.
Issue date and printed expiry date	The baseline.
Effective expiry	The earlier of the printed date and the applicable transition deadline.
Transition status and planned audit date	The field that makes the next three years manageable.

The sites row is worth dwelling on, because it is where this topic meets a bigger one. A certificate is issued to named sites, not to a company, and a supplier can perfectly well hold a current certificate covering a plant that does not make your parts. If your records attach certificates to the vendor rather than to the site, you cannot answer that question at all. We set out how to build the underlying structure in supplier, site and part: the data model that answers product level questions, and the certificate layer is one of the clearest arguments for building it.

Storing the transition status and planned audit date turns a three year wait into something you can actually report on, which is the difference between knowing your exposure and discovering it. Whatever system holds this needs a reporting and audit trail layer so you can show when a certificate was received, by whom, and what it replaced.

What to put in the agreement

If you are writing or revising supplier quality agreements, this transition is a reason to look at the certification clause, which in most templates is one of the weakest things in the document. The usual wording says the supplier “shall maintain ISO 9001 certification”. It names no edition, no notice obligation and no evidence, so it cannot be monitored and nobody ever checks it.

A clause that works through a transition does four things. It names the standard and the edition rather than the standard alone. It requires the supplier to notify you of any change to the status, scope or sites of their certification, within a stated number of days, which is the same change notification discipline that applies to process and material changes. It names the record where the current certificate lives and who owns keeping it current. And it says what happens if certification lapses, which should be a conversation and a plan rather than an automatic consequence, because a supplier who loses certification for administrative reasons and a supplier who loses it for capability reasons are not the same problem.

The general method is the one we apply to every clause worth having: name the standard, name the record that proves it, name the owner, and name the point at which somebody looks. The certification clause is a good first candidate for it, because the evidence is unusually easy to name. It sits naturally alongside the qualification evidence you already gather at onboarding and qualification.

Worth saying plainly: adding a notice obligation to an agreement does not oblige you to renegotiate every contract this year. Most teams will pick the clause up at the next scheduled revision, and a short covering note to strategic suppliers explaining how you intend to handle the transition will do more good in the meantime than a contractual amendment.

The supplier who is not going to transition

Some suppliers will decide that certification is no longer worth the cost. For a small specialist with one customer who cares, that can be an entirely rational decision, and it is better to find out in 2027 than in 2029.

Treat it as a sourcing question rather than a compliance failure. The useful questions are whether the certificate was ever the thing giving you confidence or just the thing giving you documentation, whether you have your own evidence of capability from audits, performance history and corrective action records, and whether a second source exists if you need one. For many indirect and low risk categories the honest answer is that the certificate was a convenience, and a well evidenced supplier without one is a perfectly good supplier. For a critical component in a regulated product it is a different conversation, and you now have two full years to have it calmly.

Where the supplier is one you want to keep, this is also an opening for supplier development rather than an exit. A small supplier struggling with the cost of transition is a supplier telling you about a capability gap, and that is the kind of gap a buyer can actually help close. Where it is not, a planned and ethical offboarding started early beats an unplanned one started late.

A twenty minute first pass

You can do the whole of the valuable part of this in one sitting.

1. Pull every supplier record with an ISO 9001 or ISO 14001 certificate on file.
2. Flag the ones with a printed expiry after 30 September 2029 (quality) or 30 April 2029 (environment). Those are your effective expiry corrections.
3. Flag the ones where you cannot tell which edition the certificate is, or cannot find the certificate at all. In most supply bases this list is longer than the first one, and it is the more useful finding.
4. Cross the flagged list against your critical and strategic suppliers. That intersection is your actual work. Everything else can wait for a scheduled review.
5. Add two fields to wherever you keep this: edition, and transition status.

Step three is the one that pays for the exercise. Most teams running it discover that the transition is the smaller problem and the state of their certificate records is the bigger one. That finding has been sitting there for years and this is simply what finally surfaced it, which is a good outcome rather than a bad one.

If you want to see what this looks like when certificates, sites and expiry logic sit in one place, our supplier compliance tracking and audit capability covers the mechanics, and a short supplier performance pilot is usually the quickest way to find out whether your current records would survive the exercise. You can also book a demo and bring your own certificate list to it.

Frequently asked questions

Does this affect my own ISO 9001 certification as well as my suppliers’?

Yes, and your quality function is almost certainly already on it. This piece is deliberately about the other side of the relationship, the certificates you hold for other companies, because that side usually has no owner. Our ISO 9001:2026 guide covers what the revision means for your own system and for how you control external providers.

Do my suppliers have to be certified to ISO 9001:2026 by 30 September 2029?

Suppliers who hold accredited ISO 9001:2015 certification and wish to keep accredited certification need to complete the transition by then. Suppliers who are not certified at all are unaffected, and suppliers certified to other schemes follow those schemes’ own rules. The equivalent environmental deadline is 30 April 2029.

Should I ask my suppliers for ISO 9001:2026 certificates now?

Asking for the certificate now will not get you far, because certification bodies are still being assessed and declared for the new edition into 2027. Asking when their transition audit is planned works at any time and gives you better information.

What about IATF 16949, AS9100 and the other sector schemes?

Sector schemes built on ISO 9001 have their own governance and their own transition arrangements, which are published separately by the bodies that own them. Do not assume the dates above apply to them. If you work in automotive, our piece on building a supplier scorecard that satisfies IATF 16949 covers the related ground on evidence, and SRM for automotive covers the wider context.

Is this relevant in regulated manufacturing, where we rely on other standards?

Very. In medical devices and pharma, supplier files are inspected, and a file containing a certificate that expired under a transition you did not track is exactly the sort of finding that is easy to avoid and awkward to explain. The fix is the same: store the edition, calculate the effective expiry, and keep the evidence where somebody can find it.

We have hundreds of suppliers. Is this really worth it?

The correction itself is a one off rule change, not a per supplier task. The work that scales is only the follow up, and the three population split above exists precisely so you do not do it for everyone. Teams running supplier programmes at scale handle this by acting on the critical intersection and letting the rest resolve through normal review cycles.