Quality culture in ISO 9001:2026: what the standard requires and how to evidence it

ISO 9001:2026 turned a soft topic into a hard requirement. Quality culture now sits in the leadership clause, addressed to top management, and awareness of it is auditable at any level of the organization. Here is exactly what the standard asks for, what it does not ask for, and how to evidence it without writing a single new procedure.

For thirty years, quality culture was something quality professionals talked about at conferences and left out of the management system. The 2026 edition, published on 16 September 2026, changed that. Quality culture and ethical behaviour appear nowhere in the requirements of ISO 9001:2015. They appear in three places in ISO 9001:2026, and one of them is a shall.

Where quality culture appears in ISO 9001:2026

Three clauses, plus a note that does most of the explaining.

• Clause 5.1.1 i). Top management shall demonstrate leadership and commitment with respect to the quality management system by promoting quality culture and ethical behaviour. This sits in the same list as customer focus, resourcing and accountability.
• Clause 7.1.4. In the clause on the environment for the operation of processes, a note now says that some environmental factors can be influenced by the organizational quality culture and ethical behaviour.
• Clause 7.3 e). People doing work under the organization's control shall be aware of the organizational quality culture and ethical behaviour. That is a new fifth item in the awareness clause.

The foreword of the standard lists the introduction of quality culture and ethical behaviour as one of its six main changes. See the full list on our key changes page.

Notice that two of the three are addressed to people other than the quality manager. Clause 5.1.1 belongs to top management. Clause 7.3 reaches every person working under the organization's control, including contractors.

The only definition you get, and why its wording matters

The standard does not define quality culture as a term in Clause 3. It describes it in Note 2 to clause 5.1.1:

Read that sentence slowly, because four words in it do all the work. Values. Attitudes. Practices. Actions.

The first two are invisible. You cannot audit a value or measure an attitude. The second two are entirely visible. Practices are what people repeatedly do. Actions are what somebody did on a specific difficult day.

Then look at the two words in the middle: reflected in. Not consists of. Culture is inferred from evidence, in the same way you infer that a process is capable from the data it produces. That single grammatical choice is what makes culture auditable at all, and it tells you where to look. You look at behaviour, and behaviour leaves records.

What the standard asks for, and what it does not

This is where most of the early confusion sits, so it is worth being blunt about the boundaries.

What it requires:

• Top management promotes quality culture and ethical behaviour. Promotes is an active verb. It implies visible, repeated action, not a statement.
• People are aware of the organizational quality culture and ethical behaviour, and can say what it means for their work.
• Environmental factors, including social and psychological ones, are determined and provided, with the recognition that culture influences some of them.

What it does not require:

• A good culture. The requirement is to promote it, not to achieve a particular score. An organization with a weak culture that can evidence genuine promotion and awareness meets the clause.
• A defined target culture, a culture policy, or a values statement. None of these appears in the text.
• Documented information. Not one of the three clauses requires a document or a record. Nothing has to be written down.
• A culture survey. The standard never mentions one.

That last point surprises people. There is no requirement to measure culture at all. Measuring it is useful, and we come back to that, but it is your choice rather than the auditor's expectation.

What an auditor will actually look for

Clause 5.1.1 i) is a shall, and shalls get sampled. Since no documented information is required, the evidence is going to come from conversations.

With top management. Expect the question: how do you promote quality culture and ethical behaviour? Expect a follow-up asking for a specific example, with a date. A good answer describes something that happened: a decision where a stop on quality grounds cost money and was backed anyway, a change to what gets asked first in the operations review, a public acknowledgement of somebody who raised a problem. A weak answer describes the values on the wall.

With everybody else. Clause 7.3 e) lets an auditor ask anyone. The useful question is not "are you aware of the quality culture", which invites a yes. It is closer to "what does this organization expect of you when something is not right?" People answer that question honestly, in their own words, and the answers at the front line either match what top management described or they do not.

In the records, for corroboration. Behaviour leaves a trail, and an experienced auditor knows where it is. Concession and deviation records, and how the wording of their reasons drifts over three years. Corrective actions that name a person as the root cause. Audit findings that repeat year after year. The time it takes for a raised concern to reach a decision. None of these is required evidence for clause 5.1.1 i), but all of them corroborate or contradict what the interviews found.

Our internal audit checklist includes a page of interview prompts for exactly this, structured by level so you can compare the answers.

Six things you can evidence without creating a document

If you want to be ready without adding paperwork, these are the highest value moves. Every one of them is a change to what already happens.

1. Change the first question in a recurring meeting. Whatever a leader asks first defines the priority for everyone in the room. Make one of your regular meetings open with a quality item, hold it for a quarter, and the meeting minutes become your evidence.
2. Record one leadership decision that cost something. The single strongest piece of evidence available is a decision where a hold or a stop on quality grounds was backed by management even though it hurt the schedule. Note the date, the decision and who made it.
3. Thank somebody by name, in public, for raising a problem. Then say what changed as a result. This is free, it takes two minutes, and it does more for awareness than a training module.
4. Add the expectation to your induction, in plain words. Not a values statement. One or two sentences about what is expected when somebody sees something that is not right, and what will happen when they raise it.
5. Count how many corrective actions name a person as the root cause. If the number is high, your investigation practice is telling everybody in the organization something about how problems are handled here. Reducing it is both a culture improvement and an auditable trend.
6. Look at the concession trend by reason code. Three years of concession records, plotted by month, is the single richest culture document most organizations already hold and almost nobody reads as a time series.

None of these requires a budget, a consultant or a new procedure.

Ethics is culture under pressure

ISO 9001:2026 never uses the phrase quality culture on its own. Every time it appears, ethical behaviour is attached to it, at 5.1.1, 7.1.4 and 7.3. Annex A.5.1 explains the reasoning: ethical behaviour supports confidence in the organization's ability to consistently deliver conforming products and services. It is framed as a commercial argument, not a moral one.

In practice the two are the same thing at different temperatures. On an ordinary Tuesday, culture and ethics are indistinguishable. The difference only appears when something is at stake: a deadline that was already late when the problem was found, a number somebody's bonus depends on, a senior person who has already said which answer they want. Those three conditions explain most ethical failures in quality, and none of them is about dishonest people.

If you want guidance, the standard points you at it. Annex A.5.1 and A.7.3 both reference ISO 10010, Quality management, Guidance to understand, evaluate and improve organizational quality culture. Annex A.7.3 also references ISO 10018 on people engagement. Neither is mandatory, and neither is needed to satisfy the requirement, but citing them makes an internal business case considerably easier to defend.

A ninety day start

If you are transitioning to the 2026 edition anyway, fold this into the plan rather than running it separately.

Days 1 to 30. Find out where you are. Ask ten people at three levels the same question: what does this organization expect of you when something is not right? Pull three years of concession records and plot them. Count how many corrective actions named a person. Announce nothing this month.

Days 31 to 60. Change three things. One measure or recognition practice. One first question in a recurring meeting. One point of friction that makes the compliant path harder than the workaround. Three, not ten.

Days 61 to 90. Make it visible. Tell one story properly, with named people, told by a leader, in a forum that already exists. Then pick the next three.

That is also a defensible answer to an auditor asking how top management promotes quality culture, because it describes actions with dates rather than intentions.

Four mistakes to avoid

• Launching a values campaign. Espoused values with no mechanism behind them change nothing, and they raise cynicism, because now there is a visible gap on the wall that everyone can point at.
• Treating it as a training problem. Awareness is required by 7.3 e) and it is nowhere near sufficient on its own. People can be entirely aware of what they should do and still do something else.
• Writing a quality culture procedure. No documented information is required. A procedure will not impress an auditor who is asking your production manager what happened the last time somebody raised a problem.
• Giving it to the quality manager alone. Clause 5.1.1 is addressed to top management. If the answer to who owns this is the quality manager, the clause is not being met, whatever the documents say.

What to do this week

Ask five people, at three different levels, what the organization expects of them when something is not right. Write the answers down word for word and compare them. That takes an afternoon, it needs nobody's approval, and it will tell you more about your readiness for clause 5.1.1 i) than any survey.

Then check your timing. The transition to ISO 9001:2026 ends on 30 September 2029, and from 31 March 2028 new certifications are issued to the 2026 edition only. Full dates are on our FAQ page, and the clause-by-clause detail is on our requirements page.

Quality culture stopped being a soft topic the day it became a shall. The organizations that handle it well are not the ones with the best values statement. They are the ones where a person three levels down can stop something on a Friday afternoon and be confident about what happens next.