ISO 9001:2026 and ISO 14001:2026 bring moderate changes, not a revolution. If you are already certified, you have most things in place. A gap analysis is more of a verification exercise than the start of major change work.
This guide helps you confirm what you already meet and identify the few areas that may need adjustment. Most organisations find the gaps smaller than expected. Allow 4-8 hours for a complete review.
ISO 14001:2026 was published April 15, 2026. ISO 9001:2026 is at FDIS stage and expected in October. Running more than just these two standards? A broader revision wave is underway. See the overview of all four standards.
AmpliFlow and the gap analysis
For existing AmpliFlow users, the transition will be smooth. Your processes and documentation are already in the system. We have reviewed the changes in ISO 14001:2026 and the FDIS draft for ISO 9001:2026, and the tool will be updated to cover the new requirements.
Contact your consultant if you need help reviewing what needs updating in your management system.
Step 1: Verify existing documentation
Documentation you likely already have:
- Quality policy or environmental policy (latest approved version)
- Stakeholder analysis (clause 4.2)
- SWOT analysis or equivalent context analysis (clause 4.1)
- Environmental aspects assessment (ISO 14001)
- Risk register and risk assessments (clause 6.1)
- Supplier assessments
- Latest internal audit report
- Latest management review
People to involve:
- Quality or Environmental Manager (process leader, can often complete the verification alone)
- Management team (if needed for climate and culture)
- Procurement Manager (if the supply chain needs reviewing)
- HR Manager (if quality culture is a gap)
Step 2: Verify status per requirement area
ISO 9001:2026
Clause 4: Organisational context - climate change
Requirement: Climate change must be considered in context analysis (applicable since Amendment 1:2024, now integrated into the 2026 edition).
Check questions:
- Have we analysed how climate change affects our operations?
- Have we identified climate-related stakeholders (customers with climate requirements, authorities)?
- Are climate risks included in our SWOT analysis?
- Have we documented how climate change affects customer requirements or the supply chain?
Status:
- Green (verified): Climate analysis already carried out and documented. Nothing to do.
- Amber (supplement): Climate is discussed but not systematically documented. 2-4 hours.
- Red (missing): No climate analysis carried out.
Tip: Many organisations already have climate aspects in their risk analysis without calling it a climate analysis. Check your existing SWOT and risk documents first.
Clause 5: Leadership - quality culture and ethical behaviour
New requirement: Management must demonstrate how they promote quality culture and ethical behaviour.
Check questions:
- Can management describe how they work with quality culture?
- Are there employee surveys, development reviews, or other feedback demonstrating the culture?
- Are quality and improvement discussed in management review?
- Does the quality policy mention values or behaviours?
Status:
- Green: Management can point to concrete culture activities and follow-up. Nothing to do.
- Amber: Culture work is ongoing but not systematically documented. 2-4 hours.
- Red: No conscious culture work. 8-12 hours for simple survey, first measurement, analysis.
Tip: This is the genuinely new area in ISO 9001:2026. The requirement is about being able to show how you work with culture, not about implementing a comprehensive culture programme. Keep it simple.
Clause 6: Planning - supply chain risks
Clarified requirement: Strengthened guidance on supply chain risks. Most certified organisations already have supplier assessments.
Check questions:
- Have we identified critical suppliers?
- Do we assess suppliers on an ongoing basis?
- Do we have contingency plans for our most critical suppliers?
Status:
- Green: Structured supplier assessment exists. Nothing to do.
- Amber: Supplier assessments exist but documentation could be improved. 2-4 hours.
- Red: No systematic supplier assessment. 4-8 hours.
ISO 14001:2026
Clause 4: Organisational context - biodiversity
Strengthened guidance: Biodiversity is now explicitly part of context analysis. ISO 14001:2026 published April 15, 2026. Certificates must transition by May 2029.1
Check questions:
- Have we identified whether our operations affect biodiversity?
- Does some form of natural impact appear in our environmental aspects assessment?
- Is the operation located in or near protected natural areas?
Status:
- Green: Natural impact included in environmental aspects assessment. Nothing to do.
- Amber: Environmental aspects assessed but biodiversity not explicit. 1-2 hours.
- Red (relevant gap): Operations have natural impact but it is not analysed. 4-6 hours.
Tip: For most office and service companies, biodiversity impact is minimal and can be handled with a simple note. Manufacturing companies with direct raw material chains need a closer look.
Clause 5: Leadership - environmental policy
Strengthened guidance: Clearer connection to ecosystems and natural resources.
Check questions:
- Does the environmental policy mention natural resources or ecosystems?
- Do we have objectives related to resource efficiency?
Status:
- Green: Policy covers natural resources and ecosystems. Nothing to do.
- Amber: Policy is general but can be supplemented with one sentence. 1-2 hours.
Clause 6: Planning - change management (6.3)
New requirement: Structured change management for the environmental management system.2
Check questions:
- Do we assess environmental consequences of major changes?
- Do we document changes affecting the environmental management system?
Status:
- Green: Change management already exists. Nothing to do.
- Amber: Changes are managed but not systematically documented. 1-2 hours.
- Red: No change management. 2-4 hours.
Tip: If you have an integrated management system with ISO 9001, you likely already have change management in place. Verify that it covers environmental aspects.
Step 3: Compile results and plan
Most certified organisations get 3-4 green, 1-2 amber and 0-1 red.
Quality culture (ISO 9001) is often the only genuinely new area. Other requirements are clarifications of things you likely already do.
Priority logic:
- If you have red requirements, start with quality culture. It takes the longest to build up data for trend analysis.
- Amber requirements can often be handled in parallel with ordinary operations. They need supplementing, not new development.
- Green requirements need no action. Just verify that documentation is up to date.
Step 4: Estimate supplementing effort
Typical effort for certified organisations: 10-30 hours total.
- Small (1-50 employees): 10-20 hours, 1-2 amber
- Medium (51-250 employees): 15-30 hours, 2-3 amber, possibly 1 red (quality culture)
- Large (250+ employees): 25-50 hours, more coordination
If you have multiple red requirements (2-3: 40-80 hours, 4+: 80-150 hours) it may indicate that your current management system needs strengthening regardless of ISO 2026. But this is uncommon for certified organisations.
Step 5: Plan the supplementing work
Quality culture is the only area that may require longer lead time:
- Create a simple culture survey (2-4 hours)
- Run the first measurement (1-2 hours)
- Analyse results and document (2-4 hours)
- Wait 6-12 months for follow-up measurement (for trend)
Verification before certification:
- Internal audit includes ISO 2026 requirements (can be done as part of regular audit)
- Management review confirms gaps are addressed
- Documentation is updated
Summary
A gap analysis for ISO 2026 is a verification exercise, not the start of a major change project. Most certified organisations find they already meet most requirements.
The only genuinely new element: Quality culture (ISO 9001:2026). Other requirements are clarifications.
Frequently asked questions
How long does the verification take? 4-8 hours for an experienced quality or environmental manager to go through the checklists and compile the results.
Are the ISO 2026 changes significant? No. ISO describes the changes as moderate. DNV confirms: less extensive than the 2015 transition.3
Do we need to do the verification now or can we wait? Do a simple verification now to identify any gaps. Then you have plenty of time for supplementing work before the certification audit.
What is the most likely gap? Quality culture (ISO 9001). It is the only genuinely new requirement where you need to show how management works with culture.
Next steps
For existing AmpliFlow users, the transition will be smooth. Your processes and documentation are already in the system. Contact your consultant if you need help reviewing what needs updating in your management system.
