Clause 8: Operation

Requirement
The organisation must plan, implement, and control the processes needed to meet product and service requirements, including determining those requirements, setting acceptance criteria, controlling the process itself, and making sure the right resources are available. Documented information must show that processes ran as planned. Unchanged from 2015.

How to Implement
Turn your risk treatment plan into everyday working procedures, and make sure someone is clearly responsible for each process. Keep a simple record whenever a process changes, whether that change was planned or happened unexpectedly, so you can look back later and check what effect it had.

Mandatory Documents
Yes, conditionally mandatory. Documented information “shall be available to the extent necessary to have confidence that the processes have been carried out as planned” and “as evidence of the conformity of products and services.” How much you need depends on how complex your operations are.

Requirement
8.2.1 Customer Communication covers giving customers information about your products and services, handling enquiries and orders, collecting feedback (including complaints), and looking after customer property. 

New in 2026: a fifth item, (e), requires the organisation to tell customers about contingency actions, where relevant, including anything related to disruptions in delivering products or services.

8.2.2 through 8.2.4 (working out requirements, reviewing them, and handling changes to them) are unchanged from 2015.

How to Implement
In practice, this is mostly about having a simple communication habit, not a complex system. Identify the two or three disruption scenarios most likely to affect your business (a key supplier failing, a system going down, a transport delay), and agree in advance who contacts the customer, what they say, and how quickly. A short email template and a clear “who calls the customer” rule is often enough for a small or mid-sized organisation; larger organisations with formal business continuity plans can simply link this customer communication step into that existing plan.

Mandatory Documents
Documented information is required (as applicable) as evidence of the results of requirement reviews and any new or changed requirements (8.2.3.2). There’s no separate mandatory document tied specifically to the new contingency communication item, but it’s worth writing down, even briefly, which disruption scenarios you’ve planned for and who’s responsible for notifying customers, since this is the kind of thing an auditor is likely to ask about directly.

Requirement
Unchanged from 2015 across all six sub-clauses (8.3.1 General through 8.3.6 Changes): planning, inputs, controls (reviews, verification, validation), outputs, and change control.

How to Implement
Follow the same staged design process familiar from 2015: define what the design needs to achieve, check it at the right points through reviews, verification, and validation, and keep control over any changes so they don’t quietly undo something that was already approved.

Mandatory Documents
Yes, explicitly mandatory at several points: documented information must be available as evidence of design inputs (8.3.3), design and development activities (8.3.2 j), outputs (8.3.5), and changes including who authorised them (8.3.6).

Requirement
Unchanged from 2015. The organisation must decide what controls to apply to anything it gets from external providers, with clear criteria for evaluating, selecting, monitoring, and re-checking those providers over time.

How to Implement
Keep a simple supplier evaluation and monitoring process running, applying tighter controls to suppliers whose failure would actually hurt your product or service quality, and lighter checks to low-risk ones.

Mandatory Documents
Yes, explicitly mandatory. You need documented evidence of supplier evaluation, monitoring, and re-evaluation, plus any actions that came out of those checks.

Requirement
Unchanged from 2015 across all six sub-clauses (8.5.1 through 8.5.6): working under controlled conditions, identifying and tracing outputs, looking after customer or supplier property, preserving outputs, post-delivery activities, and controlling changes.

How to Implement
Make sure production or service delivery happens under clearly defined conditions: the right documented information, the right monitoring, the right environment, and people with the right competence. Pay particular attention to preventing human error (8.5.1 g), since this is explicitly called out as something you need to actively guard against, not just hope doesn’t happen.

Mandatory Documents
Yes, explicitly mandatory at multiple points: traceability evidence (8.5.2 d), records of what happened if customer or supplier property was lost or damaged (8.5.3), and change review records including who authorised the change (8.5.6).

Requirement
Unchanged from 2015. Before anything is released to a customer, you need to check it meets requirements, and keep a record showing it passed that check and who signed off on the release.

How to Implement
Build a clear release sign-off step, whether that’s a physical checklist or a digital approval, into your delivery process, and make sure it captures both what was checked and who approved it.

Mandatory Documents
Yes, explicitly mandatory. You need documented evidence of release, showing the product or service met its acceptance criteria and who authorised the release.

Requirement
Unchanged from 2015. When something doesn’t meet requirements, you need to identify it and control it so it doesn’t accidentally get used or shipped, and keep a record of what the problem was, what you did about it, any concessions given, and who made that call.

How to Implement
Set up a simple nonconformance process: correct the problem, keep it separated or contained so it can’t be used by mistake, tell the customer if needed, and get proper sign-off if you’re accepting it anyway under concession. Once corrected, check it again before it moves on.

Mandatory Documents
Yes, explicitly mandatory. Keep a Nonconforming Output Register recording the nature of each nonconformity, what was done about it, any concessions, and who decided.