ISO 9001:2026 knowledge management: what to do in the next 90 days
A 90-day plan for ISO 9001:2026 knowledge management: keep, use and share what your teams know, and collect the evidence an auditor will ask for.
ISO 9001 knowledge management, in the 2026 edition, comes down to three verbs: clause 7.1.6 asks for the knowledge your processes need to be retained, applied and shared. An operations team can prepare in 90 days, with one 30-day block per verb. Each block ends with one artefact and the evidence an auditor can sample.
The plan is written for the quality director or operations lead of a 1,000-person operation with several sites and shifts.
What changed, briefly
ISO 9001:2026 was published on 16 September 2026. Under the mandatory transition rules of Global Accreditation Cooperation (Global ACI), certificates to the 2015 edition stop being valid on 30 September 2029, and from 31 March 2028 new certifications are issued only against the 2026 edition. AFNOR Certification adds that your audits stay on the 2015 text until you ask to transition, so the date of your first 2026 audit is yours to choose, within that window.
Organisational knowledge is not among the six main changes listed in the standard's foreword, and ISO's explainer puts it among the "smaller refinements". The clause still changed in four ways:
- Scope: the knowledge needed to achieve the intended results of the quality management system, where the 2015 edition said the conformity of products and services.
- Verbs: "maintained and made available" became retained, applied and shared.
- Forms: one note now names four forms of knowledge, replacing the 2015 notes on internal and external sources (used in the first block below).
- Intent: a new annex entry, A.7.1.6, calls knowledge dynamic, updated through use and experience, and points to ISO 30401, the standard for knowledge management systems.
Most published guides skip the clause: 56 of the 76 guides to the revision that rank in Google's top 20 never mention it, as our review of the 2026 guides shows. Our reference page on ISO 9001:2026 and organisational knowledge explains what it asks. This post is the practical part.
Where audits already find weak points
The AFNOR group analysed 14,000 ISO 9001 audit reports before the new edition. Its summary, published in March 2026, says that managing competence and organisational knowledge is the area some organisations handle best, and the one that produces the most nonconformities in others. It names three recurring weak points:
- critical competences are sometimes poorly identified;
- quality documentation is not always accessible;
- responsibilities are sometimes unclear.
The three blocks of the plan answer them in that order.
What an auditor can check under 7.1.6
The ISO 9001 Auditing Practices Group, made up of experts from ISO's quality committee and from the accreditation side, published its guidance on organisational knowledge in January 2016. When we checked in October 2026, it had not been revised for the new edition. The group's paper on auditing competence (2022) suggests four questions about any activity:
- What knowledge does this activity need?
- How do people reach it?
- How is it kept current?
- How is knowledge gained by experience captured?
Evidence does not have to be a document: the group's paper on evidence (2016) says so, and the 2026 annex (A.4.4) leaves it to the organisation to decide which processes need documented information. Auditors also collect evidence where the work takes place, across shifts and sites. Your knowledge is tested on the night shift at your third site, as much as in a folder.
The 90 days at a glance
| Days | Verb | Artefact | Evidence an auditor can sample |
|---|---|---|---|
| 1–30 | Retained | Evidence map, first version: critical knowledge, its form, holders, owners, risk of loss | An owner for each item; a retention plan for each item held by one person (7.1.6, A.7.1.6, 7.2) |
| 31–60 | Applied | Point-of-use check for each critical item | Test results by shift and site; procedures in use, with an owner, a version and a review date (8.5.1 a, 7.5) |
| 61–90 | Shared | Sharing model: what is group, what is local, what goes to partners | Access by role; review dates met; one source per document (7.1.6, 7.4) |
| From day 1 | Improvement loop | A log of requests from missed searches, unanswered questions and flagged errors | Requests with an owner, a status and a closing date; monthly notes (6.3, 10.1) |
Days 1 to 30: retained, so knowledge stays when people move
Pick five to 10 processes inside your certificate scope where losing knowledge would hurt first: one or two people hold the know-how, a nonconformity was traced to a missing instruction, or a line, product or site will change within a year.
For each process, spend 30 minutes with the team leader and ask one question: what do you need to know to run this that a new person would not know? Record each answer as one row of the evidence map (template below). Then use the four forms from the 7.1.6 note to say what form the item is in today:
- Held by people through experience: the technician who hears when a seal is about to fail.
- Learned from education, training or others: the induction module, the mentor's explanation.
- Embedded in methods, processes and products: the machine presets, the checklist built into the line.
- Captured in documents, digital systems and other media: the procedure, the record, the knowledge base article.
The first form is the most at risk. Give every item an owner: one person who keeps it current. For each item held by one person who may retire, move or leave within a year, write a retention plan: shadowing, writing the procedure with them, a recorded walk-through, a named successor. A.7.1.6 calls this retaining knowledge so that it is not lost. It also supports competence (7.2), which the standard now defines as the ability to apply knowledge and skills (3.9). Our guide to knowledge transfer covers the methods, and the lessons learned process shows how to turn failures and near misses into new items.
In practice. At the Département de l'Orne, a French local authority whose 25 IT staff support 1,800 council employees, procedures sat in Word files, Alfresco and OneNote, and when a colleague went on leave, their solutions went with them. Every procedure now has an expiry date and an annual review, and nothing stays active without being verified.
We're building lasting knowledge instead of losing it.
Days 31 to 60: applied, so the right version reaches the work
The 2026 edition asks for this twice: 7.1.6 asks for knowledge to be applied, and 8.5.1 a) now asks for documented information for production and service to be available and used.
For each item on the map, note where it is used: on the line, at the shift handover, during maintenance, on a customer call. Then run a short test. Ask three to five people per process, on at least two shifts and two sites, to find what they need for a task you name. Record how long it took, where they looked, and whether they found the current version.
Fix what fails:
- One place per procedure. Retire local copies and link to the current page. The informative annex (A.7.5) explains that obsolete documented information, if you keep it, is subject to controls that prevent its unintended use.
- One structure. Purpose, scope, steps, owner, review date. Our page on what a standard operating procedure (SOP) is explains how it differs from a work instruction, the guide to writing SOPs that teams actually use covers the writing, and the process flowchart template helps when steps branch.
- A review date on every procedure, and approval before publishing where an error is costly (7.5.2).
The standard never names AI. If your teams ask an AI assistant, our reading is that the same test applies: its answer is only as current as the procedure it reads, so check that it shows which procedure it used.
In practice. SPIE ICS runs IT service desks under contract, and its teams once worked across up to 20 knowledge bases, one per client. Since moving to one platform, technicians who find a wrong step flag it in the procedure itself, and its owner decides on the change. SPIE also measured how long it took to reach the right knowledge, before and after the move.
We measured how long it took to reach the right knowledge in the old tools. It was a minute to a minute and a half. With Elium it is 15 to 20 seconds.
Days 61 to 90: shared, so every site works from one source
"Shared" replaced "made available": the knowledge has to reach the people who need it. Multi-site operations often lose control at this step: the same procedure exists in two languages and in last year's version, and nobody is sure which one applies. Decide three things:
- What is group and what is local. Group standards are written once. Sites add only what is specific to them and link to the group standard for the rest.
- Who owns each area. Organise by process family, with one owner per area and a review frequency set by risk: for example six months for safety-critical steps, 12 for stable ones.
- What goes outside. Suppliers, subcontractors and customers who need a procedure get a link to the current page, not an attachment that goes out of date in an inbox. Clause 7.4 already asks you to decide what you communicate, to whom and how.
Write the result on one page, the sharing model: who can see what, who keeps it current, and how a local variant relates to the group standard. The quality control checklist template is a good first case: one group checklist, local additions, one owner.
In practice. L'Oréal Opérations covers production, sourcing, supply chain, quality and finance: 22,000 people across some 40 factories and 150 distribution centres. Its procedures sit in 113 spaces, grouped into about 15 families by business area, with a named owner for every change. Each document is stored once, and everything else links to it.
I ran the migration in three waves. First corporate: the group standards, the rules everyone has to follow. Then the zones and divisions publish what is specific to their scope. Then the countries complete it.
The improvement loop: evidence for planning of changes and continual improvement
A.7.1.6 says knowledge is updated through use and experience. The loop is how that happens in practice, so start it on day 1. It collects three signals:
- searches that return no result;
- questions an AI assistant could not answer from a source;
- wrong or missing steps that people flag in a procedure.
Each signal becomes a request with an owner, a status and a date, and the area owners review the most frequent ones each month.
The loop also gives evidence for two clauses. Planning of changes (6.3) now lists seven considerations, including whether information is available, how the change will be communicated, how its effectiveness will be monitored and evaluated, and how its results will be reviewed. When a procedure changes, the request log shows why, who changed it, who was told, and whether the question stopped coming back. For continual improvement (10.1), the informative annex (A.10.1) explains that improvement can involve adapting processes, knowledge and resources to internal and external changes, and the log shows that in numbers.
Two limits. The loop does not prove that your knowledge is correct: it shows that you look for gaps, act on them and check the result. And the list of management review inputs (9.3.2) does not name knowledge; bringing the loop's numbers under "opportunities for improvement" or "adequacy of resources" is our suggestion, not a requirement.
In Elium. The parts of this loop exist today. The search export lists every search with its number of results, AI answer feedback shows the question, the answer and its sources, and content requests carry an assignee and a status. Turning a missed search into a request is still a person's decision. At L'Oréal Opérations, user feedback leads to corrections, and a person, not the AI, approves each one.
The 7.1.6 evidence map: the knowledge audit template, extended
Our knowledge audit template checks five areas: content quality, coverage, ownership, findability and governance. For ISO 9001:2026, add one row per critical knowledge item with the fields below. The last column names the clause each field gives evidence for.
| Field | What to record | Example from a packaging line | Clause |
|---|---|---|---|
| Knowledge item | One piece of knowledge a process needs | Changeover settings for the 50 ml filling line | 7.1.6 |
| Form today | Which of the four forms, and where it lives | Held by people: two senior technicians, a notebook | 7.1.6 note |
| Owner | The person who keeps it current | Line manager, site 2 | 5.3 |
| Retained | How it is kept: procedure, mentoring, successor | Procedure written with both technicians; recorded walk-through | 7.1.6, A.7.1.6, 7.2 |
| Applied | Where it is used, and the last point-of-use test | Night shift found the current version in under a minute | 7.1.6, 8.5.1 a) |
| Shared | Who has access: sites, shifts, languages, partners | Sites 2 and 4, in French and Polish; contract maintenance by link | 7.1.6, 7.4 |
| Review | Frequency, next date, what was retired | Every six months; old version archived | A.7.1.6, A.7.5 |
| Open requests | Requests from the loop linked to this item | One: missing step for the new cap size | 6.3, 10.1 |
Keep the map short: 50 rows that are kept current are worth more than 500 that nobody reads.
What this plan leaves to other systems
Controlled documents and records (clause 7.5) stay in your document control system or electronic quality management system (eQMS), and competence records (7.2) with human resources. Elium is a European knowledge management platform, not an eQMS: it holds the procedures and know-how people work from, and links to the controlled record where one exists.
Where to go next
- Use a template: knowledge audit, process flowchart, quality control checklist.
- Read the reference: ISO 9001:2026 and organisational knowledge.
- Do it in Elium: see how operations teams use Elium, then the help articles on verification dates, article ownership and transferring articles when someone leaves.
Common questions about ISO 9001:2026 and knowledge management
Clause 7.1.6 asks you to determine the knowledge your processes need, and to retain, apply and share it to the extent necessary. That knowledge serves the intended results of your quality management system, not only the conformity of products and services. The clause is not among the six main changes in the foreword, but its scope, its verbs and its note on forms of knowledge all changed.
An auditor can ask what knowledge an activity needs, how people reach it, how it is kept current and how experience is captured. Answers can come from observation and interviews on the shop floor as well as documents.
No, clause 7.1.6 does not ask for documented information, and the annex (A.4.4) says the organisation decides which processes need it. Document what is critical, held by few people or used across sites.
Until 30 September 2029, when certificates to the 2015 edition stop being valid under Global ACI's transition rules. From 31 March 2028, new certifications are issued only against the 2026 edition, and your audits stay on the 2015 edition until you ask to transition.
Examples include changeover settings, work instructions, process and product specifications, the experience of the people who run a line, and lessons from failures and near misses.
ISO 30401 is the standard for knowledge management systems: its first edition dates from 2018, and a second edition was at the draft stage in October 2026. ISO 9001:2026 points to it in annex entry A.7.1.6 but does not require it. ISO 30401's own annex presents a knowledge management system as one way to meet the knowledge clause of ISO 9001, so its records can be shown as evidence under 7.1.6.
Sources
- ISO. ISO 9001:2026, Quality management systems: Requirements, sixth edition, September 2026. Clauses 3.9, 4.4, 5.3, 6.3, 7.1.6, 7.2, 7.4, 7.5, 8.5.1, 9.3.2 and 10.1, and Annex A, read in a licensed copy and paraphrased.
- ISO. "ISO launches update to world’s most widely used quality management standard for a new era of business", 16 September 2026.
- ISO. "ISO 9001:2026: What businesses need to know", checked 19 October 2026.
- Global Accreditation Cooperation. "Transition Requirements for ISO 9001:2026", Global ACI-TECH-3-TR 2029-09-30 (M), version 1.0, 4 September 2026.
- AFNOR Certification. "FAQ transition ISO 9001 vers la version 2026", checked 19 October 2026.
- AFNOR International. "ISO 9001 & ISO 14001 : les enseignements clés de 20 000 audits pour anticiper les versions 2026", 5 March 2026.
- ISO 9001 Auditing Practices Group. "Guidance on Organizational Knowledge", edition 1, 13 January 2016.
- ISO 9001 Auditing Practices Group. "Guidance on Auditing Competence", edition 2, 1 June 2022.
- ISO 9001 Auditing Practices Group. "Guidance on Evidence Collection", edition 1, 13 January 2016.
- ISO/TC 176. ISO 9001 Auditing Practices Group, checked 19 October 2026.
- ISO. ISO 30401:2018, Knowledge management systems and ISO/DIS 30401, checked 19 October 2026.
