Clause 6: Planning

Requirement
When planning the QMS, the organisation must consider the issues from 4.1 and requirements from 4.2, and determine the risks and opportunities needed to give assurance the QMS can achieve its intended results, prevent or reduce undesired effects, achieve continual improvement, and enhance desired effects.

How to Implement
Run a structured risk and opportunity identification exercise covering your QMS as a whole, not just product-level risks. Use your context analysis from 4.1 and interested party requirements from 4.2 as direct inputs, so the exercise isn’t done in isolation.

Mandatory Documents
There is no explicit documentation requirement for 6.1.1 itself (the mandatory evidence comes from 6.1.2 and 6.1.3 below, via the broader 4.4 documentation requirement). No stand-alone mandatory document is required for 6.1.1.

Requirement
The organisation must determine, analyse, and evaluate risks that could have an undesired effect on its ability to consistently provide conforming products and services and enhance customer satisfaction, then plan actions to address those risks, how to integrate them into QMS processes, and how to evaluate their effectiveness.

New in 2026: actions taken must be proportionate to the potential impact of the risk.

How to Implement
For each identified risk, assess likelihood and consequence, then select a proportionate response: avoiding the risk, taking on more risk to pursue an opportunity, eliminating the source, changing likelihood or consequence, sharing the risk, or retaining it through an informed decision. The proportionality requirement means you should be able to justify why your response to a high-impact risk is more rigorous than your response to a minor one, rather than applying the same level of control uniformly.

Mandatory Documents
There is no explicit “shall be available as documented information” statement tied specifically to 6.1.2 in isolation, though the broader 4.4 requirement for process documentation and the 9.3 management review input on risk effectiveness mean a risk register is, in practice, essential. It is strongly recommended, though not explicitly named as mandatory, to maintain:

• A risk register showing identified risks, planned actions, and proportionality rationale

Requirement
The organisation must determine, analyse, and evaluate opportunities that could have a desired effect on its ability to consistently provide conforming products and services and enhance customer satisfaction, then plan actions to address them, how to integrate them into QMS processes, and how to evaluate effectiveness. Actions must be appropriate to the organisation’s context and support the achievement of desired results.

How to Implement
Treat opportunity identification as a distinct exercise from risk management, not an afterthought. Examples given by the standard itself include adopting new practices, launching new products or services, creating new partnerships, leveraging emerging technologies, and responding to changing customer needs. Review these at the same cadence as risks, typically at management review.

Mandatory Documents
As with 6.1.2, there is no explicit stand-alone mandatory document named for 6.1.3. An opportunities log or register is good practice, especially since 9.3 management review now explicitly requires reporting on the effectiveness of actions taken to address opportunities as a separate line item from risks.

Requirement
The organisation must establish quality objectives at relevant functions, levels, and processes.

New in 2026: objectives must simply “be measurable,” with the 2015 qualifier “if practicable” removed, meaning measurability is no longer optional or conditional. Objectives must also be consistent with the policy, take applicable requirements into account, be monitored, communicated, updated as appropriate, documented, and relevant to product/service conformity and customer satisfaction.

How to Implement
Since objectives must now be measurable without exception, avoid vague aspirational objectives (“improve customer service”) and replace them with quantified targets (“reduce average response time to customer complaints to under 24 hours by Q2”). For each objective, define what will be done, resources required, responsibility, timeline, and evaluation method.

Mandatory Documents
Yes, explicitly mandatory. ISO 9001:2026 states objectives “shall be available as documented information.” You must produce and maintain:

• A documented set of measurable Quality Objectives with associated action plans

Requirement
When the organisation determines the need for changes to the QMS, changes must be carried out in a planned manner. 

New in 2026, the standard now requires the organisation to consider seven factors, up from four in 2015: (a) the purpose of the changes and potential consequences, (b) the potential impact on QMS integrity, (c) availability of resources and information, (d) allocation or reallocation of responsibilities and authorities, (e) communication of the changes, (f) how the effectiveness of the changes will be monitored and evaluated, and (g) how the results of the changes will be reviewed.

How to Implement
Build a formal change request process for any significant QMS change (a new process, a restructured responsibility, a new system) that walks through all seven considerations before the change is approved, not just the resourcing and responsibility questions covered in 2015.

Critically, don’t treat the change as finished once implemented: schedule a follow-up review (30, 60, or 90 days out, depending on the change’s scale) to confirm the change actually achieved its intended effect, since this review is now an explicit requirement rather than good practice left to the organisation’s discretion.

Mandatory Documents
There is no explicit “shall be available as documented information” statement for 6.3 itself. No mandatory document is formally required, but given how much more detailed this requirement now is, a Change Management Log or Change Request Form covering all seven considerations is strongly recommended as the practical mechanism for demonstrating compliance.