ISO 9001:2026 Is Under Publication: What CNC Buyers Should Check

ISO 9001:2026 remains at Stage 60.00, International Standard under publication, as of September 3, 2026. ISO lists Edition 6 for 2026 09 and says it will replace ISO 9001:2015. ISO TC 176 SC 2 has also announced a scheduled publication date of September 16, 2026.

The revision is not a new CNC inspection standard. DNV describes the FDIS changes as moderate, with stronger attention to quality culture, ethical behaviour, risks and opportunities, and management of QMS changes. BSI says Clause 8 receives only minor adjustments and the core Clause 9 performance evaluation requirements remain in place.

For a CNC buyer, the practical task is supplier qualification. Check whether the certificate covers the site and work you are buying, then follow one real order through drawing control, material traceability, inspection, external processing, release, and corrective action. This article separates confirmed 2026 changes from buyer requirements such as CMM reports, FAI, PPAP, and lot traceability.

1. ISO 9001:2026 Is at Stage 60.00

ISO has completed the FDIS approval stage. The lifecycle record shows Stage 50.60 closed on July 10, 2026, and the project moved to Stage 60.00 on the same date. Stage 60.60, International Standard published, is still pending. The ISO committee update dated August 7 says the FDIS was approved and the sixth edition is scheduled for publication on September 16, 2026.

Edition	6
Publication month	2026 09
Current stage	60.00
Stage description	International Standard under publication
Scheduled publication	September 16, 2026
Replacement	Will replace ISO 9001:2015

Do not describe ISO 9001:2026 as published while the official ISO page still shows Stage 60.00. Supplier certificates also remain tied to the edition stated on each certificate. A supplier cannot be treated as certified to ISO 9001:2026 until its certification record says so.

The edition change also does not turn every CNC quality document into a new 2026 requirement. CMM reports, FAI, PPAP, material certificates, and full lot traceability can come from the customer drawing, purchase order, sector rules, regulatory controls, or the supplier QMS. Keep those sources separate during qualification.

2. Four 2026 Changes That Affect Supplier Reviews

DNV and BSI both describe the revision as a targeted update. The 2024 climate change amendment is integrated into the revised standard, while the buyer side checks in this article concentrate on changes that can alter QMS behaviour or audit evidence.

2.1 Quality culture shows up in deviation records

The FDIS gives quality culture and ethical behaviour more explicit treatment in leadership, awareness, and the environment for process operation. In a supplier audit, test that idea with records. When a part misses tolerance near a ship date, check whether the deviation is recorded, the original result is retained, and release authority can stop shipment. Posters and training slides do not answer those questions.

2.2 Risks and opportunities are separated explicitly

Clause 6.1 now separates risks and opportunities more explicitly, with new subclauses and added guidance. For a 6061-T6 housing sent out for anodizing, a useful risk review should connect to the route being purchased: drawing revision, dimensional allowance before finishing, external provider approval, inspection timing, and acceptance after finishing. A corporate risk register with no link to the job adds little to the sourcing decision.

2.3 QMS changes need a stronger record trail

DNV identifies reinforced requirements in Clause 6.3 for management of QMS changes. CNC buyers see the consequence when a repeat order changes machining sequence, inspection equipment, work instruction, software, or external processor. Ask how the change was reviewed, approved, communicated, and connected to the production record. A stable part number does not prove a stable process route.

2.4 Clause 8 largely continues existing controls

BSI describes Clause 8 changes as minor and says the core monitoring, measurement, audit, and management review requirements in Clause 9 remain. That boundary matters. Traceability, inspection records, external provider control, product release, and nonconformance handling still belong in a CNC supplier review, but they should not be presented as inventions of ISO 9001:2026.

3. Start Supplier Qualification With Scope

Start with the certificate scope, not the certificate logo. Under the current ISO 9001:2015 framework, Clause 4.3 covers the QMS scope, and ISO guidance lists that scope as maintained documented information. The 2026 revision keeps the same high level clause structure.

3.1 Match the legal entity, site, and work

Standard edition	Which edition is stated on the current certificate?
Legal entity	Is this the entity receiving the order?
Certified site	Does the machining site fall inside the certified organization?
Scope	Does the scope cover the work you are qualifying?
Certification body	Who issued the certificate?
Validity	Are the issue date, expiry date, and status current?

EPOC CRAFTER publishes its current certificate number, issuing body, validity period, and certification scope on its quality and certification records. The public page currently lists ISO 9001:2015 and a scope covering design, development, and production of prototype models, rapid samples, plastic parts, and hardware parts.

3.2 Walk one completed order through the QMS

Pick a finished CNC order and follow the route from drawing review through material receipt, machining, inspection, any external process, final inspection, and release. Ask for the record that proves each controlled step was applied. ISO guidance gives organizations flexibility in how much documented information they use, so the audit should test evidence for the process you are buying instead of demanding one universal document package.

3.3 Ask for job evidence behind the certificate

A procedure explains the system. A completed record shows what happened on the job. Ask for one controlled drawing, its material record, the inspection result, and the release record for the same part or batch. Under current ISO guidance, retained records include monitoring resources, external provider evaluation, traceability where required, production changes, product release, nonconformity, and corrective action.

The CNC machining quality control flow published by EPOC CRAFTER shows one company specific path from incoming material checks through in process inspection, final inspection, and lot based record retention.

4. Trace One CNC Lot Back to Its Drawing

Manufacturing traceability becomes useful when you can start with a shipped part and move backward to the records that governed it. ISO 9001 does not impose the same traceability depth on every product. Current ISO guidance calls for retained unique identification when traceability is a requirement. The customer, product, regulatory context, and contract define how deep that linkage needs to go.

Approved requirement	Controlled drawing, model, specification, and revision
Material	Grade, heat or lot number, certificate, receiving identity
Production	Batch, router, work instruction, process record
Inspection	Feature result, lot or part identity, measuring equipment
External process	Provider, purchase requirement, returned certificate
Release	Acceptance evidence and release authorization

4.1 Lock drawing and model precedence

Ask one direct question: Which drawing revision made this batch? Production and inspection should point to the same approved requirement set. The question gets harder when a supplier receives both a 3D model and a 2D drawing. The order review should define which source controls dimensions, GD&T, threads, surface finish, and notes. A clean dimensional report checked against the wrong revision is still the wrong evidence.

EPOC CRAFTER addresses drawing precedence and finishing callouts in its CNC drawing tolerance guidance, including the need to define dimensions that apply after anodizing, plating, or coating.

4.2 Link the material lot to the production batch

A material certificate proves that a certificate exists. It does not prove which stock became the part in your hand. Where material traceability is required, start with the shipped batch and trace backward to the stock identity, heat or lot number, and certificate. That reverse path tests the linkage a buyer needs during a defect investigation.

4.3 Use traceability to define containment

Suppose one bore fails receiving inspection. The supplier needs enough identity to decide which parts share the same production condition, material lot, inspection record, or external process. Strong linkage narrows the population that needs review. Weak linkage expands the containment search because the supplier cannot prove where the affected condition starts and ends.

5. Inspection Records Must Prove Release

A dimensional report should let the buyer identify the requirement checked, the measured result, the lot or part covered, and the release decision. Under the current ISO 9001 framework, Clause 7.1.5 covers monitoring and measuring resources and Clause 8.6 covers product release records. BSI reports no major operational rewrite in the 2026 FDIS.

5.1 Match the report to the drawing and lot

Part number	Matches the purchase order and shipped part
Drawing revision	Matches the approved production requirement
Characteristic	Links the result to a drawing requirement
Acceptance limit	Shows what defined pass or fail
Measured result	Records the result without rewriting failed data
Lot or part identity	Defines what population the record covers
Release authorization	Identifies who accepted the product for shipment

5.2 Trace one result back to the measuring equipment

Select one reported dimension and ask which gauge or CMM produced it, whether the equipment was within calibration or verification status at the time, and whether the method fits the tolerance and feature. This reverse check is stronger than reviewing a calibration folder by itself because it connects the measurement resource to the result used for release.

EPOC CRAFTER currently publishes a company inspection rule calling for CMM measurement on drawing tolerances tighter than ±0.05 mm in its CNC quality control flow. That ±0.05 mm threshold is an EPOC CRAFTER practice, not an ISO 9001 requirement.

5.3 Define CMM, FAI, and PPAP before production

CMM report	Complex geometry, GD&T, specified reporting, or customer request	ISO 9001 controls monitoring and measurement; it does not require a CMM for every part
FAI	New part, new production approval, or applicable customer or sector requirement	The governing customer or industry requirement defines the FAI format and scope
PPAP	A customer or sector production approval process requires it	PPAP is not a universal ISO 9001 deliverable
Material certificate	The order requires material verification or traceability	The required document and linkage come from applicable purchase and QMS controls

EPOC CRAFTER also maps measurement tools to feature types in its tolerance and inspection standards reference. For purchasing, the larger point is simple: put required inspection deliverables in the RFQ or purchase order before production begins.

6. Control Heat Treatment, Anodizing, and External Work

Heat treatment, anodizing, plating, passivation, grinding, EDM, coating, and outside testing can sit outside the machining facility while still affecting conformity. Clause 8.4 controls externally provided processes, products, and services. BSI reports only minor Clause 8 adjustments in the 2026 FDIS, so this remains a core supplier qualification check.

6.1 Flow down the requirements that apply

The purchase document sent to an external processor should carry the requirements that apply to that order. An official ISO interpretation of Clause 8.4.3 confirms that every listed communication item does not apply to every supplier or every purchase. For a heat treatment order, the applicable set may include material identity, process specification, hardness requirement, lot identity, and certificate requirements. An anodizing order needs a different set.

6.2 Qualify the provider for the process being bought

Check who approved the processor, what process was evaluated, how performance is monitored, and how reevaluation is recorded. An approved supplier list with a company name alone tells you less than a qualification record tied to the outsourced process. The audit should also show how a provider change is reviewed when that change can alter product conformity.

6.3 Link the returned certificate to the production lot

A process certificate has more value when it identifies the lot or batch that received the external work and can be reconciled with the drawing or purchase requirement. After the parts return, the CNC supplier still needs the applicable verification and final release evidence. Outsourcing changes who performs the process. It does not erase the supplier control needed for the delivered product.

The EPOC CRAFTER surface finishing process controls page describes incoming checks, in process coating measurement, batch records, and final inspection as company practices. Multi process programs are documented on the end to end manufacturing workflow page.

7. Use a Failed Part to Test Corrective Action

A supplier quality system is easiest to test after a part fails inspection. ISO 9000:2026 defines correction as action that removes a detected nonconformity and corrective action as action that removes the cause and prevents recurrence. Reworking one oversize bore is a correction. Removing the cause that produced the oversize bore is corrective action.

7.1 Define the affected population before release

Start with containment. Which batch contained the failed part? Which other parts share the setup, tool, material lot, measuring equipment, or external process? Did any of them ship? The supplier should explain why the containment boundary was chosen. Traceability from Section 4 determines whether that review stays narrow or expands to a larger inventory population.

7.2 Cause analysis must explain the control failure

A corrected part may pass inspection while the cause remains. The ISO 9001 Auditing Practices Group notes that corrective action requires determination of cause and lists root cause analysis, fishbone analysis, and 5 Whys as possible tools. Those tools are examples, not mandatory ISO methods. For a CNC defect, the evidence may point to tool wear, offset error, fixture movement, thermal drift, drawing revision control, or an inspection method that missed the drift.

7.3 Verify the action on later production

Close the loop with evidence from the failed process. A fixture change should be checked against later dimensional results. A drawing control failure should be checked against later revision records. Training evidence has value when competence was part of the established cause. Match the closure evidence to the cause instead of accepting a generic training sheet for every nonconformance.

8. Run the Supplier Audit on One Real Order

ISO 9001 Clause 9.2 covers the supplier internal audit program. A customer audit is a different activity. ISO 19011:2026 identifies audits performed by customers, or by people acting on their behalf, as second party audits. Use that buyer audit to test one completed CNC order from shipment back to its approved requirements.

8.1 CNC supplier audit checklist

Certification scope	Does the QMS cover this site and work?	Current certificate, scope, site identity	Scope matches the order
Drawing control	Which approved revision governed this batch?	Controlled drawing, revision record, order review	Production and inspection use the same requirement set
Material traceability	Which material lot became these parts?	Certificate, heat or lot number, receiving and batch linkage	Traceability depth matches the order
Production	Which controlled route made the batch?	Router, work instruction, process record	Supplier can reconstruct the route
Inspection	What was checked and against which limit?	Inspection plan, dimensional report, CMM report when required	Results link to requirements and lot
Measuring equipment	Which equipment produced the result?	Equipment ID, calibration or verification status	Equipment evidence links to the released result
Product release	Who authorized shipment?	Final inspection and release record	Acceptance and authorization are recorded
External processing	Who performed outsourced work?	Approval record, purchase requirement, process certificate	One external step traces from requirement to acceptance
Nonconformance	How was the last rejected lot controlled?	NCR, affected population, disposition	Containment boundary is supported by records
Corrective action	What cause was found and what changed?	Cause analysis, action record, revised control	Action matches the established cause
Effectiveness	How was recurrence checked?	Later inspection, audit, or process record	Closure evidence comes from the affected process
Change control	How are drawing, process, or provider changes controlled?	Review, authorization, revised information	Affected production records show the approved change

8.2 Keep three sources of requirements separate

ISO 9001 QMS control	External provider control, release records, corrective action	Verify how the supplier QMS handles the applicable control
Customer or contract	CMM report required with shipment	State the deliverable in the RFQ, purchase order, or quality clause
Industry or program	FAI or PPAP required by an applicable program	Identify the governing requirement before production

This split prevents two sourcing errors. One is claiming ISO 9001 universally requires a document that came from the customer quality plan. The other is assuming ISO certification automatically supplies every project record. Define the evidence package before the quote is released.

9. Prepare the QMS Before September 16

The ISO committee has scheduled publication for September 16, 2026. Before that date, a CNC supplier can review the FDIS changes without rebuilding the whole QMS. DNV describes the revision as moderate and says substantial technical changes are not expected between FDIS and publication because this stage permits editorial changes.

Revised requirements	Map each confirmed change to the affected QMS process and owner
Controlled documents	Identify procedures, audit checklists, and references that need a real technical update
Evidence	Run the revised control on completed records, not blank templates
External providers	Check approval, purchase requirements, monitoring, and returned process records
Internal audit and management review	Schedule review of the changed controls after they are put into use

A training attendance sheet does not prove that a changed control reached production. Use operating records. After ISO reaches Stage 60.60, update the standard reference, transition plan, and certification statements to match the published edition and the certification body requirements that apply to the organization.

10. Buyer Questions Before Supplier Approval

10.1 Is ISO 9001:2026 published yet?

No. On September 3, 2026, ISO still lists Edition 6 at Stage 60.00, International Standard under publication. ISO TC 176 SC 2 says publication is scheduled for September 16, 2026. Check the ISO lifecycle again on the day this article is posted because the status is time sensitive.

10.2 Does ISO 9001 require full material traceability for every CNC part?

No universal full traceability model applies to every CNC part. Under the current ISO 9001 framework, identification records are retained when traceability is a requirement. The customer, product, regulatory context, and purchase requirements set the needed depth. State material certificate, heat or lot linkage, serial identity, or other deliverables in the order when they are required.

10.3 Does every CNC order need CMM, FAI, or PPAP?

No. ISO 9001 controls monitoring, measurement, conformity evidence, and release. It does not prescribe a CMM report, FAI package, or PPAP for every CNC order. The buyer should call out those deliverables when the drawing, customer requirement, sector program, or quality plan requires them.

10.4 Can a buyer audit an ISO 9001 certified supplier?

Yes. ISO 19011:2026 treats a customer audit as a second party audit. Third party certification establishes one form of QMS assurance. A buyer audit can go deeper into the records that matter for the specific order, including drawing revision, material linkage, inspection, external processing, nonconformance, and release.