Run one query against your supplier database this week.

Find every supplier record holding an ISO 9001:2015 certificate with a stored expiry date after 30 September 2029. Then find every supplier record holding an ISO 14001:2015 certificate with a stored expiry date after 30 April 2029.

Both lists are wrong, and they were wrong the moment the transition requirements were published in September 2026. The certificates in those records will stop being accredited certification before the dates printed on them. Nothing in your system knows that yet, because the expiry date on a certificate and the end of a transition period are two different things, and almost every supplier database stores only the first one.

This is not a crisis. It is a three year piece of housekeeping with a very long runway, and the teams that start it now will spend an hour on it rather than a quarter. It also happens to be one of the cleanest opportunities you will get this year to improve the quality of your supplier records, because it gives you a concrete, dated reason to go and look at them.

What actually happened in September 2026

Three things landed within two weeks of each other.

ISO 9001:2026 was published on 16 September 2026. We covered what the revision itself changes for supplier quality teams in our guide to ISO 9001:2026 and the control of external providers, and this piece deliberately does not repeat it. The question here is not what the new standard asks of your quality system. It is what the transition does to the certificates you hold on file for other companies.

ISO 14001:2026 was published shortly before it, and it has its own separate transition.

The transition rules for both were set by Global ACI, which is the body that now does the job the International Accreditation Forum and the International Laboratory Accreditation Cooperation used to do separately. Global ACI came into operation on 1 January 2026, and its single mutual recognition arrangement replaces the former IAF MLA and ILAC MRA. If you have been searching for an IAF resolution on the ISO 9001:2026 transition and finding nothing, that is why. The document exists, it just has a different name on it now.

For ISO 9001:2026, the rules sit in Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, issued 16 September 2026. For ISO 14001:2026, they sit in Global ACI-TECH-3-TR 2029-04-30 (M), Transition Requirements for ISO 14001:2026, issued 14 September 2026.

The two timetables, side by side

Here is where it gets interesting for anyone maintaining a supplier file. The two transitions do not run in step.

Read the two right hand columns against each other and the practical shape of the next three years appears. The environmental transition is roughly five months ahead of the quality one at every stage. The first milestone of either transition, accreditation bodies being ready to assess against ISO 14001:2026, falls on 31 October 2026, which is a few weeks away rather than a few years.

If you treat these as one combined project with one deadline, you will be late on the environmental side and early on the quality side. They are two projects that happen to look alike.

The two dates that are actually yours

Of the ten dates in that table, eight describe work that accreditation bodies and certification bodies have to do. You can safely ignore those. They matter to your suppliers’ auditors, not to you.

Two rows are yours.

The row that changes what arrives. From 31 March 2028 for quality, and 31 October 2027 for environment, new and initial accredited certifications may only be issued to the 2026 editions. This is the date that affects onboarding rather than monitoring. Qualify a new supplier after it, and the certificate they send you will be a 2026 one. Qualify a new supplier before it, and you may well receive a 2015 certificate that is perfectly valid on the day it arrives and already has a shortened life. If your supplier onboarding process has a checkbox that says “ISO 9001 certificate received”, that checkbox is about to start meaning two different things.

The row that changes what you already hold. 30 September 2029 for quality and 30 April 2029 for environment are the final deadlines for organisations still certified to the 2015 editions to complete their transition. These are the dates that quietly rewrite the expiry fields in your database.

Why the expiry field is wrong

A certificate carries an expiry date, usually three years from issue. A transition period carries an end date. When the two disagree, the transition date wins.

The previous cycle shows what that looks like in practice. ISO 9001:2015 replaced ISO 9001:2008, the transition period ended on 18 September 2018, and ISO/TC 176/SC 2 recorded the outcome in one sentence: “Accredited certification to ISO 9001:2008 is now no longer valid.” Certificates with printed dates running past that point did not survive it.

Global ACI’s announcements set the final deadline for completing the transition and do not spell out what happens to a 2015 certificate the day after. The sensible reading, and the one the previous cycle supports, is that an organisation which has not transitioned by then no longer holds accredited certification to the standard, whatever date is printed on the paper.

So the practical rule for your records is simple and slightly uncomfortable: for any ISO 9001:2015 or ISO 14001:2015 certificate you hold, the real expiry is the earlier of the printed date and the transition deadline. That is a one line change to how you calculate a renewal reminder, and it is worth making now rather than in 2029, because the whole point of the reminder is to give you notice.

A supplier whose certificate reads “valid to 14 March 2030” is not giving you cover until 2030. They are giving you cover until 30 September 2029 and then a question. If your certificate tracking lives in a spreadsheet, this is the kind of rule that has to be applied by hand every time somebody looks, which is to say it will not be applied. Systems that hold supplier information as structured records rather than attachments can hold two dates and alert on the earlier one, which is the whole argument for moving this work off spreadsheets in a single sentence.

Three populations in your supply base

Transitions are much easier to manage once you stop thinking of your certified suppliers as one group. They are three, and each needs a different thing from you.

The ones who will transition early and tell you. Typically larger suppliers with a dedicated quality function, often multi site, often certified to several standards at once. They will move during a scheduled surveillance or recertification audit, and a new certificate will arrive without you asking. Your only job here is to make sure the new certificate actually lands in the system and replaces the old one rather than sitting in somebody’s inbox. This is a process problem, not a supplier problem, and a supplier portal where the supplier uploads the document themselves removes it entirely.

The ones who will transition on their own schedule and need a reminder. The large middle. They are not at risk, they are just busy, and their certification body will handle it at the next audit in the normal way. They need one well timed, friendly request rather than a campaign, and the timing is the whole trick: too early and you are asking for something that does not exist yet, too late and you are chasing. More on timing below.

The ones who may quietly let certification lapse. This is the group worth your attention, and the reason is not compliance. A supplier deciding not to transition is a supplier making a decision about cost, capability or commitment, and that decision usually says something about the direction of the business well before it shows up in delivery or quality numbers. Treated well, a transition is a free, early, honest signal about supplier health, arriving years before your performance scorecards would pick anything up. That is genuinely useful information and it costs you nothing to collect.

Which suppliers belong in which group is a segmentation question, and if you already run risk based supplier segmentation you have most of the answer. Certification matters most where the purchased item carries the most risk, not where the supplier is largest, and segmentation models that separate strategic importance from risk exposure will tell you where to spend the attention.

The timing trap: do not require what cannot yet be issued

Here is the mistake to avoid, and it is an easy one to make with the best of intentions.

Someone writes a clause, or updates an onboarding requirement, or sends a supply base wide letter, asking suppliers to provide certification to ISO 9001:2026. In late 2026 and most of 2027, a large number of suppliers simply cannot, because their certification body has not yet been assessed and declared for the new edition. The accreditation decisions are not due to be complete until 30 September 2027 for quality and 30 April 2027 for environment. Asking before then produces confusion, a round of apologetic emails, and a small dent in your credibility with exactly the suppliers whose goodwill you will want later.

The generous version of the same request works far better and costs nothing. Ask when the supplier’s certification body expects to be able to audit them against the 2026 edition, and when their own transition audit is planned. That is a question every supplier can answer at any point in the next three years, it tells you what you actually need to know, and it reads as a buyer who understands the system rather than one issuing demands into it. It is also a much better use of your supplier follow up capacity than a request that will have to be sent twice.

A reasonable sequencing, which you can adjust to your own risk profile:

• Now to early 2027. Fix the data. Correct the expiry logic, find the records with missing or unreadable certificates, and establish which of your suppliers hold which standards at which sites. No supplier contact required.
• Through 2027. Ask the planning question above during reviews you are already holding. Fold it into the business reviews and evaluation cycles already in your calendar rather than creating a separate campaign.
• 2028. Follow up with the suppliers who have no plan and the suppliers who have gone quiet. By this point the system has capacity and there is still well over a year of runway.
• First half of 2029. Handle the exceptions, with the environmental deadline arriving five months before the quality one.

Starting the supplier facing work in 2027 rather than 2026 is not procrastination. It is waiting until the question has an answer.

What a certificate record should actually hold

Most supplier databases store a certificate as a file plus an expiry date. That was always a little thin, and this transition is a good excuse to fix it. A certificate record that earns its place holds:

The sites row is worth dwelling on, because it is where this topic meets a bigger one. A certificate is issued to named sites, not to a company, and a supplier can perfectly well hold a current certificate covering a plant that does not make your parts. If your records attach certificates to the vendor rather than to the site, you cannot answer that question at all. We set out how to build the underlying structure in supplier, site and part: the data model that answers product level questions, and the certificate layer is one of the clearest arguments for building it.

Storing the transition status and planned audit date turns a three year wait into something you can actually report on, which is the difference between knowing your exposure and discovering it. Whatever system holds this needs a reporting and audit trail layer so you can show when a certificate was received, by whom, and what it replaced.

What to put in the agreement

If you are writing or revising supplier quality agreements, this transition is a reason to look at the certification clause, which in most templates is one of the weakest things in the document. The usual wording says the supplier “shall maintain ISO 9001 certification”. It names no edition, no notice obligation and no evidence, so it cannot be monitored and nobody ever checks it.

A clause that works through a transition does four things. It names the standard and the edition rather than the standard alone. It requires the supplier to notify you of any change to the status, scope or sites of their certification, within a stated number of days, which is the same change notification discipline that applies to process and material changes. It names the record where the current certificate lives and who owns keeping it current. And it says what happens if certification lapses, which should be a conversation and a plan rather than an automatic consequence, because a supplier who loses certification for administrative reasons and a supplier who loses it for capability reasons are not the same problem.

The general method is the one we apply to every clause worth having: name the standard, name the record that proves it, name the owner, and name the point at which somebody looks. The certification clause is a good first candidate for it, because the evidence is unusually easy to name. It sits naturally alongside the qualification evidence you already gather at onboarding and qualification.

Worth saying plainly: adding a notice obligation to an agreement does not oblige you to renegotiate every contract this year. Most teams will pick the clause up at the next scheduled revision, and a short covering note to strategic suppliers explaining how you intend to handle the transition will do more good in the meantime than a contractual amendment.

The supplier who is not going to transition

Some suppliers will decide that certification is no longer worth the cost. For a small specialist with one customer who cares, that can be an entirely rational decision, and it is better to find out in 2027 than in 2029.

Treat it as a sourcing question rather than a compliance failure. The useful questions are whether the certificate was ever the thing giving you confidence or just the thing giving you documentation, whether you have your own evidence of capability from audits, performance history and corrective action records, and whether a second source exists if you need one. For many indirect and low risk categories the honest answer is that the certificate was a convenience, and a well evidenced supplier without one is a perfectly good supplier. For a critical component in a regulated product it is a different conversation, and you now have two full years to have it calmly.

Where the supplier is one you want to keep, this is also an opening for supplier development rather than an exit. A small supplier struggling with the cost of transition is a supplier telling you about a capability gap, and that is the kind of gap a buyer can actually help close. Where it is not, a planned and ethical offboarding started early beats an unplanned one started late.

A twenty minute first pass

You can do the whole of the valuable part of this in one sitting.

1. Pull every supplier record with an ISO 9001 or ISO 14001 certificate on file.
2. Flag the ones with a printed expiry after 30 September 2029 (quality) or 30 April 2029 (environment). Those are your effective expiry corrections.
3. Flag the ones where you cannot tell which edition the certificate is, or cannot find the certificate at all. In most supply bases this list is longer than the first one, and it is the more useful finding.
4. Cross the flagged list against your critical and strategic suppliers. That intersection is your actual work. Everything else can wait for a scheduled review.
5. Add two fields to wherever you keep this: edition, and transition status.

Step three is the one that pays for the exercise. Most teams running it discover that the transition is the smaller problem and the state of their certificate records is the bigger one. That finding has been sitting there for years and this is simply what finally surfaced it, which is a good outcome rather than a bad one.

If you want to see what this looks like when certificates, sites and expiry logic sit in one place, our supplier compliance tracking and audit capability covers the mechanics, and a short supplier performance pilot is usually the quickest way to find out whether your current records would survive the exercise. You can also book a demo and bring your own certificate list to it.

Frequently asked questions

Does this affect my own ISO 9001 certification as well as my suppliers’?

Yes, and your quality function is almost certainly already on it. This piece is deliberately about the other side of the relationship, the certificates you hold for other companies, because that side usually has no owner. Our ISO 9001:2026 guide covers what the revision means for your own system and for how you control external providers.

Do my suppliers have to be certified to ISO 9001:2026 by 30 September 2029?

Suppliers who hold accredited ISO 9001:2015 certification and wish to keep accredited certification need to complete the transition by then. Suppliers who are not certified at all are unaffected, and suppliers certified to other schemes follow those schemes’ own rules. The equivalent environmental deadline is 30 April 2029.

Should I ask my suppliers for ISO 9001:2026 certificates now?

Asking for the certificate now will not get you far, because certification bodies are still being assessed and declared for the new edition into 2027. Asking when their transition audit is planned works at any time and gives you better information.

What about IATF 16949, AS9100 and the other sector schemes?

Sector schemes built on ISO 9001 have their own governance and their own transition arrangements, which are published separately by the bodies that own them. Do not assume the dates above apply to them. If you work in automotive, our piece on building a supplier scorecard that satisfies IATF 16949 covers the related ground on evidence, and SRM for automotive covers the wider context.

Is this relevant in regulated manufacturing, where we rely on other standards?

Very. In medical devices and pharma, supplier files are inspected, and a file containing a certificate that expired under a transition you did not track is exactly the sort of finding that is easy to avoid and awkward to explain. The fix is the same: store the edition, calculate the effective expiry, and keep the evidence where somebody can find it.

We have hundreds of suppliers. Is this really worth it?

The correction itself is a one off rule change, not a per supplier task. The work that scales is only the follow up, and the three population split above exists precisely so you do not do it for everyone. Teams running supplier programmes at scale handle this by acting on the critical intersection and letting the rest resolve through normal review cycles.