/ ISO 9001:2026: Key Changes, Timeline & Transition Guide

ISO 9001:2026: Key Changes, Timeline & Transition Guide

A new version of the world’s most widely adopted quality management standard is on the way. The Draft International Standard (ISO/DIS 9001) was released on 27 August 2025, and ISO member bodies voted to approve it in December 2025. Final publication is targeted for September 2026, with a three-year transition window expected to follow. Over 1.3 million organizations worldwide currently hold ISO 9001 certification. For every one of them, understanding what is changing, and what is not, matters.

This guide covers the confirmed changes in the DIS, the full revision timeline, what the update means for currently certified organizations, and how to plan your transition. Whether you are managing an existing Quality Management System (QMS) or considering certification for the first time, this is what you need to know.

What Is ISO 9001:2026?

ISO 9001 is the international standard that defines requirements for a Quality Management System. Published by the International Organization for Standardization (ISO), it provides a framework organizations can use to consistently deliver products and services that meet customer and regulatory requirements, and to drive continual improvement. Certification to ISO 9001 is recognized in virtually every industry and country worldwide.

ISO 9001:2026 is the sixth edition of the standard. It succeeds ISO 9001:2015 and is being developed by ISO/TC 176/SC 2, the technical subcommittee responsible for quality management system standards. The revision is being drafted by Working Group 29 (WG 29), a body of international experts convened specifically for this purpose.

Why Is ISO 9001:2015 Being Revised?

ISO standards undergo a formal review cycle every five years. Member bodies assess whether a standard remains relevant, needs updating, or should be discontinued. After a 2020 user survey led the committee to confirm ISO 9001:2015 without revision, a 2023 re-evaluation by a new task force reversed that decision. The conclusion: the world had changed enough since 2015 to warrant an update.

Three broad forces are driving the revision. The first is sustainability and climate change. ISO formally amended ISO 9001:2015 in February 2024, requiring organizations to consider climate change as part of their context analysis. That amendment is now being embedded directly into the body of the 2026 standard. The second is digital transformation. Since 2015, AI, IoT, cloud computing, and remote auditing have moved from emerging technologies to standard business practice. The standard needs to reflect that reality. The third is stakeholder expectations. Customers, employees, suppliers, and communities now expect organizations to operate transparently and ethically, not just efficiently.

The revision also reflects feedback from quality practitioners globally, who found certain parts of the 2015 standard, particularly the treatment of risks and opportunities, unclear in practice.

Pro Tip: EU and UK Customers

If your EU or UK customers ask for “an ISAE 3000 report” without specifying the assurance level, clarify upfront. A limited assurance engagement involves materially less testing and a lower fee, but some enterprise buyers will only accept reasonable assurance. Getting alignment early saves weeks of rework.

Current Status of the ISO 9001:2026 Revision

Draft International Standard (DIS)

The DIS was published on 27 August 2025, marking the first time the revised text was available to ISO member bodies for formal review and ballot. The voting period closed on 4 December 2025, with member countries approving the proposal. That approval is a significant milestone: it confirms the standard will be published and locks in the broad direction of the changes, though minor editorial refinements are still possible before final publication.

The DIS itself is not freely available, but its content has been widely discussed by national body experts, certification bodies such as DNV and Intertek, and quality management organizations globally. The picture of what is changing is now clear.

Final Draft International Standard (FDIS)

Following DIS approval, the working group addresses submitted comments before preparing the Final Draft International Standard (FDIS), expected in early 2026. This is typically a near-final text, with only minor adjustments possible at this stage. Once the FDIS is approved, the standard moves directly to publication.

ISO 9001:2026 Publication and Transition Timeline

Publication is targeted for September 2026. Following publication, the International Accreditation Forum (IAF) will establish the official transition timeline and accreditation requirements for certification bodies.

Important: The IAF has not yet formally confirmed the transition period. Based on precedent with previous major revisions, a three-year window is expected. Do not finalize your planning around any specific deadline until the IAF publishes its official transition rules after the standard is published.

Key Changes in ISO 9001:2026

The DIS confirms that ISO 9001:2026 is an evolutionary update, not a rebuild. The core requirements in Clauses 4 through 10 have changed modestly. The most significant additions appear in the non-mandatory Annex A, which has been substantially expanded to provide clearer implementation guidance. For organizations currently certified to ISO 9001:2015, the transition burden is expected to be manageable.

Ethics and Integrity Within Leadership

Clause 5.1.1 now explicitly requires top management to promote and demonstrate a culture of quality and ethical behavior. Previous editions required leadership commitment to the QMS, but the 2026 version makes quality culture and ethical conduct formal leadership responsibilities,  not just implied expectations.

Clause 7.3 adds a corresponding requirement at the workforce level: employees must be aware of what quality culture and ethical behavior mean in their context. This pairs leadership obligation with organizational awareness, creating accountability at both ends of the organization.

Enhanced and Restructured Risk Management

Risk-based thinking has been part of ISO 9001 since 2015, but practitioners consistently reported that the standard did not give enough guidance on how to handle risks and opportunities differently. The 2026 revision addresses this directly.

Clause 6.1 is restructured into sub-sections: 6.1.2 for actions to address risks, and 6.1.3 for actions to address opportunities. This is not just editorial. The separation forces organizations to treat opportunity management as a distinct planning activity, not simply the positive counterpart to risk. Many organizations with mature QMS processes had already made this distinction informally,  the standard now makes it explicit.

Greater Emphasis on Stakeholder Engagement

The revision places stronger emphasis on understanding and responding to the perspectives of interested parties: customers, employees, suppliers, regulatory bodies, and the broader community. This reflects a decade of change in how organizations are expected to operate, particularly around transparency and social accountability. The requirements stop well short of making ISO 9001 an ESG standard, but the direction is clear.

Digital Transformation and Industry 4.0

The standard does not mandate specific technologies or tools. However, the 2026 revision acknowledges that quality management now routinely involves digital workflows, automated monitoring, AI-assisted analysis, and remote audit capabilities. Organizations using these tools are expected to ensure their QMS reflects and governs them appropriately. The documented information requirements in Clause 7.5 are expected to be clarified to better accommodate modern digital record-keeping,  a welcome update for organizations that have moved well beyond paper-based systems.

Sustainability, Climate Change, and Social Responsibility

ISO 9001:2026 does not attempt to replicate ISO 14001 or become an ESG framework. But sustainability concerns are more visible than in previous editions. The Climate Change Amendment of 2024, already binding on certified organizations, is formally embedded in Clause 4.1. Organizations are required to consider whether climate change is relevant to their context and to reflect that assessment in their QMS if it is.

The 2024 amendment added two short but consequential notes to Clauses 4.1 and 4.2 of ISO 9001:2015. Clause 4.1 now includes a note that relevant interested parties can have requirements related to climate change. Clause 4.2 notes that climate change can be a relevant external issue to consider. These are not requirements to act on climate change,  they are requirements to consider it. The integration of these notes into the body of ISO 9001:2026 formalizes what has already been expected since February 2024.

Pro tip: If your organization has not yet updated its context analysis (Clause 4.1) and interested party register (Clause 4.2) to reflect the 2024 Climate Change Amendment, do it now. Certification bodies are already checking for this during regularly scheduled audits,  and it is also the most straightforward part of your ISO 9001:2026 preparation.

Greater Flexibility and Simplification

One persistent criticism of ISO 9001 has been that it creates unnecessary documentation burden, particularly for smaller organizations. The 2026 revision continues the trend toward flexibility. Several clauses have been editorially revised to make requirements clearer and easier to audit, without adding new obligations. Quality objectives must be measurable, but only where practical,  a nuance that gives organizations more room to set meaningful targets in complex environments.

Improved Alignment with Other Management Systems

The Harmonized Structure introduced in 2015 aligned ISO 9001 with other management system standards. ISO 9001:2026 deepens this alignment by updating terminology and clause structure to reflect changes across the ISO management system family since 2015. Organizations running integrated management systems covering quality, environment, and occupational health and safety will find the 2026 version easier to integrate with updated editions of ISO 14001 and ISO 45001. For organizations that also manage information security, it is worth reviewing how ISO 9001 compares with and integrates with data protection frameworks.

What Isn’t Changing in ISO 9001:2026

The seven quality management principles that underpin ISO 9001 remain unchanged: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. These principles, codified in ISO 9000:2015, are the philosophical foundation of the standard and are not being revised.

The Plan-Do-Check-Act (PDCA) cycle remains the operational model. The process approach is unchanged. The High-Level Structure (HLS) is maintained, preserving compatibility with ISO 14001, ISO 27001, ISO 45001, and other management system standards. Organizations certified to ISO 9001:2015 will not need to redesign their QMS from scratch. For most, the transition will be a focused update, not a reinvention.

What ISO 9001:2026 Means for Your Organization

Impact on Currently Certified Organizations

The transition burden for currently certified organizations is expected to be low. The core requirements you implemented for ISO 9001:2015 remain valid. The changes that require active attention are the ethics and quality culture requirements in Clauses 5.1.1 and 7.3, the restructured approach to risks and opportunities in Clause 6.1, and the formal integration of the climate change considerations you should already have addressed following the 2024 amendment.

Documentation updates will be required to reflect the revised clause structure. Internal audit programs will need to be updated to check against the new requirements. Leadership briefings are worth prioritizing early, since the quality culture and ethical behavior expectations now sit explicitly at the top management level.

Impact on Organizations Not Yet Certified

For organizations that have not yet pursued ISO 9001 certification, there is no reason to wait for the 2026 edition. ISO 9001:2015, supplemented by the 2024 Climate Change Amendment, remains the current standard and is fully certifiable today. A QMS built to that standard will provide a solid foundation for the 2026 transition. Beginning the certification journey now means you gain the operational and commercial benefits of certification sooner, and your system will already be mature by the time the 2026 transition window opens.

Your Certification Is Secure Until 2029

Existing ISO 9001:2015 certificates will remain valid during the transition period. Based on precedent with the 2015 revision, organizations will have approximately three years from the date of publication to transition to the new standard. If ISO 9001:2026 is published in September 2026, the 2015 version would likely remain valid until September 2029, subject to formal IAF confirmation.

How to Prepare for the ISO 9001:2026 Transition

Conducting a Gap Analysis

A gap analysis compares your current QMS against the requirements of ISO 9001:2026. With the DIS now approved, the picture of what is changing is sufficiently clear to begin this exercise. For a detailed walkthrough of the process, the gap analysis guide provides a practical framework that translates well across management system standards. Focus particularly on how your organization currently documents quality culture, how leadership commitment to ethical behavior is demonstrated, and how your risk and opportunity planning distinguishes between the two,  these are the areas most likely to reveal gaps.

Training and Awareness

The explicit awareness requirement in the revised Clause 7.3 means that employee training programs will need updating. Quality culture and ethical behavior need to be defined in your organizational context, communicated clearly, and evidenced in training records. Leadership briefings should start early, since top management is now formally responsible for demonstrating these behaviors.

Updating Documentation

Documentation updates for the 2026 transition are primarily structural: updating clause references, revising the QMS manual or policy documents to reflect the new requirements, and ensuring records support the separated risk and opportunity planning approach. No organization should find itself rebuilding its entire documented system. The task is refinement and alignment, not reconstruction.

Internal Audits

Your internal audit programs should be updated to include the new and revised requirements once the final standard is published. Auditors will need training on the specific changes, particularly the quality culture and ethics requirements and the restructured Clause 6.1. Scheduling a focused internal audit against the 2026 requirements before your first external transition audit is strongly recommended.

Engaging Stakeholders

The stronger emphasis on interested parties in the 2026 revision means that your stakeholder register,  and the processes you use to identify and respond to their needs,  should be reviewed. This is particularly relevant for organizations operating in sectors where customer, regulatory, or community expectations around sustainability and transparency have shifted significantly since 2015.

Investing in Technology

The standard does not require any specific technology. However, organizations that still rely heavily on paper-based or legacy document control systems may find that the 2026 revision is a practical prompt to modernize. Digital QMS platforms can simplify compliance evidence, automate KPI tracking, and make the audit process significantly more efficient. Investing in these capabilities before the transition also gives you time to validate them properly.

Pro tip: Map a rough three-year transition plan from September 2026 now. Gap analysis in months 1–6, documentation and training updates in months 6–18, internal audits in months 18–24, and your transition certification audit scheduled before the September 2029 deadline. When the IAF publishes official transition rules, adjust accordingly. Starting with a plan is far better than waiting for certainty.

Action Plans for the ISO 9001:2026 Transition

For Companies Not Yet Certified

Start your ISO 9001:2015 implementation now, including the 2024 Climate Change Amendment. Do not wait for the 2026 edition,  you gain no advantage from waiting and lose time in which your QMS could be delivering operational benefit. ISO 9001 certification is available today, and a well-implemented 2015 system will make your eventual 2026 transition straightforward. Explore our certification services to understand how to get started efficiently.

For Companies Already Certified

Conduct a gap analysis against the DIS changes now. Prioritize the climate change amendment compliance check, the quality culture and ethics awareness updates, and the risk-opportunity separation review. Begin updating training materials and leadership briefings. Schedule your transition audit well in advance of the 2029 deadline to avoid the bottleneck that typically develops in the final year of any ISO transition window.

For Individuals Considering Professional Certification

ISO 9001:2015 auditor and implementer certifications remain fully valid and highly valued. Obtaining them now gives you immediate credibility in the job market while positioning you to update your knowledge when the 2026 edition is published. The changes are not extensive enough to make current qualifications obsolete.

For Individuals with Existing Professional Certification

Monitor updates from the ISO/TC 176/SC 2 committee and from your certification body or professional association. Once the final standard is published, seek formal transition training. Focus your continuing professional development on the areas of change: quality culture, ethical behavior, risk-opportunity separation, and the sustainability and digital dimensions of the 2026 update.

When Is ISO 9001:2026 Coming Out?

Publication is targeted for September 2026. The DIS was approved by ISO member bodies in December 2025, and the Final Draft International Standard (FDIS) is expected in early 2026. Barring unexpected delays, the September 2026 timeline is considered reliable.

The confirmed changes in the DIS include: formal integration of the 2024 Climate Change Amendment into Clause 4.1; a new leadership requirement for promoting quality culture and ethical behavior in Clause 5.1.1; a new employee awareness requirement on quality culture and ethics in Clause 7.3; separation of risks and opportunities into distinct sub-clauses (6.1.2 and 6.1.3); and a substantially expanded Annex A providing clearer implementation guidance. The core requirements of Clauses 4–10 remain largely unchanged.

Not immediately. Certification bodies must complete accreditation training before they can issue certificates to the new standard. This process is expected to take approximately 12 months following publication, meaning very few ISO 9001:2026 certificates will be issued before late 2027.

Your ISO 9001:2015 certificate remains valid during the transition period, expected to run until approximately September 2029. You are not required to transition before that date, though transitioning earlier avoids a last-minute rush and gives your organization more time to embed the new requirements properly.

No. ISO 9001:2015, with the 2024 Climate Change Amendment, is the current standard and remains fully certifiable. Waiting delays both certification and the operational benefits it delivers. A well-implemented 2015 QMS will require only targeted updates to transition to 2026.

For most certified organizations, the transition is expected to be manageable. The core requirements are not changing. The work involves a gap analysis, documentation updates to reflect the new clause structure, training updates for quality culture and ethics awareness, and revisions to risk and opportunity planning. It is not comparable in scope to the 2008-to-2015 transition, which required organizations to adopt an entirely new structure and philosophy.

ISO reviews all management system standards every five years. The 2023 re-evaluation concluded that changes in sustainability expectations, digital technology, and stakeholder transparency since 2015 justified a revision. The goal is to keep ISO 9001 relevant and effective as a quality management tool without disrupting the enormous installed base of certified organizations worldwide. If you want expert support navigating the transition, whether you are starting from scratch or updating an existing system, contact us to discuss how we can help.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

Blog Highlights

Explore More Articles

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities.  What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

You can get a SaaS company ready for a SOC 2 audit in six weeks, but you’ll feel every one of them. Most published timelines say three to six months. For a company with no project owner, no identity provider, and nothing written down, that’s about right. A cloud-native startup that already has the basics in place and can protect some time is a different story, and it can fit the work into six hard weeks. This plan walks through that route one week at a time. Each week has an owner, an hour estimate, and a clear test for when it’s finished. The free Google Sheet version turns the plan into a tracker you can hand out to owners and update in your weekly standup. Before you start, know what you’re signing up for. At the end of week 6 you’ll be audit-ready, which isn’t the same as holding a Type II report. Nobody can get you a Type II in six weeks. This is also the do-it-yourself route, and it takes a lot of hours. We’ll show you where those hours go and what the faster option looks like. Is Six Weeks Realistic for Your Company? Six weeks works when most of the plumbing already exists and your job is to formalize it, fill the gaps, and prove it all works. It falls apart when you’re building the foundations and documenting them at the same time. Go through this table honestly before you promise a customer a date. Six weeks is realistic if… Plan for 10 to 16 weeks if… Your product runs on a major cloud provider You host on-premise or across several data centers You already use an identity provider with SSO Every tool has its own login and password You have fewer than about 50 employees You have multiple offices, subsidiaries, or products in scope One named person owns the project with 10 to 15 hours a week Compliance is “everyone’s job,” so in practice nobody owns it An engineer can give you 15 to 20 hours in weeks 3 and 4 Engineering is fully committed to a launch You only need the Security criteria You need Availability, Confidentiality, or Privacy on day one Landing mostly in the right-hand column doesn’t mean you should throw the plan out. Give each week two weeks instead of one and follow the same order. What “SOC 2 Ready” Means at the End of Week 6 SOC 2 doesn’t give you a certificate. An independent CPA firm examines your controls against the AICPA Trust Services Criteria and writes a report, and which of the two report types you go for decides what you can show a buyer after week 6. A Type I report checks whether your controls are designed properly on a single date. Once you’re ready, a Type I audit can start almost right away. A Type II report checks whether those controls kept working over an observation period of at least three months, and usually six to twelve. Most enterprise procurement teams want Type II in the end. Being “ready” at the end of this plan means your in-scope controls are in place, you can pull evidence for any of them on request, and your auditor is booked. From there you either start a Type I audit or open your Type II observation window. Plenty of buyers will sign with a Type I report plus a letter from your auditor saying the Type II period is underway. Important: The Type II clock doesn’t start until your controls are running. If readiness slips by a week, your Type II report slips by a week too. Founders who tell a prospect “we’ll have SOC 2 in Q3” often forget this and end up renegotiating the deal. Before Week 1: Four Decisions to Make First Settle these before the clock starts. If you change any of them halfway through, you’ll redo work. Scope. Decide which systems, teams, and data the report covers. For most SaaS companies that’s the production environment, the code repository, the identity provider, customer data stores, and any support tools that touch customer data. Corporate systems that never see customer data can usually stay out. Trust Services Criteria. Security (also called the Common Criteria) is mandatory. Availability, Confidentiality, Processing Integrity, and Privacy are optional. Report type. Pick Type I if a deal is blocked right now and the buyer will accept it. If there’s no deadline, go straight to Type II. You’ll need it eventually, and skipping Type I saves you an audit fee. Owner and tooling. Name one person who’s accountable for the plan, and decide where your controls and evidence will live. The tooling choice gets its own section below. Pro Tip: Adding Criteria Only add optional criteria when a customer contract or security questionnaire asks for them. Each one brings more controls to set up and more evidence to collect, and you can widen the scope in next year’s audit. Spreadsheet or Compliance Software: Choosing Your Tracking Tool Every SOC 2 program needs a system of record, meaning one place where each control, its owner, its status, and its evidence live. You can run it yourself in a spreadsheet or a GRC platform, or have a consultant implement it for you. The right choice depends mostly on which report you’re after and how much of your team’s time you can spare. A spreadsheet is free and familiar. It also makes you understand your own environment before you automate any of it. For a Type I, or for a small team with a tight scope, a well-built spreadsheet can take you all the way to the audit. Axipro’s free GRC workbook for SOC 2 and ISO 27001 covers all 33 SOC 2 Common Criteria plus the optional criteria, with evidence, risk, policy, and gap trackers built in. It has no macros and opens straight in Google Sheets or Excel. A GRC platform connects to your cloud, identity provider, code repository, and HR system.