Weekly Regulatory & Standards Newsletter

ISO Management System Standards | Week Ending Monday, August 31, 2026

Prepared for Mitchell Sevcik

This Week in Brief

This is a consequential fortnight for anyone holding or advising on ISO certifications. ISO 9001:2026 is now in its final pre-publication window, with the Final Draft International Standard settled and publication scheduled for September 16 — just over two weeks away. ISO 14001:2026 has been in force since April and its transition clock is already running. ISO 45001 has cleared its Draft International Standard stage and is tracking toward a 2027 publication that will put psychosocial risk squarely inside the certified management system. On the AI side, ISO/IEC 42001 certifications continue to accumulate at a steady clip while the supporting standards ecosystem fills in around the core requirement document.

The US state regulatory picture is more turbulent than the standards picture. California deferred its first Scope 1 and 2 greenhouse gas reporting deadline to November, its Standards Board closed comment on a general-industry workplace violence rule, and the federal push to preempt state AI legislation continues to run against states that keep legislating anyway. The practical consequence for most clients is that the standards are converging on a stable set of themes — climate, culture, ethics, and psychosocial risk while the statutory deadlines underneath them keep moving.

ISO 9001 — Quality Management

What changed. The Final Draft International Standard for ISO 9001 has been issued, and ISO has scheduled publication of the sixth edition for September 16, 2026. Technical consensus on Clauses 1 through 10 was reached at the working group meeting in Mexico City in February, attended by roughly 83 experts from 42 countries, and the DIS ballot that preceded it closed in December 2025 with approximately 97 percent approval. Nothing further is expected to change in the requirement text before publication.

The FDIS confirms a consistent set of headline changes. Climate change moves permanently into Clause 4.1 as part of the organizational context requirement, absorbing the 2024 amendment so that it is no longer a separate document appended to the standard. Clause 5.1.1 now explicitly requires top management to promote and demonstrate a quality culture and ethical behavior — the first time either concept has appeared as a requirement rather than as guidance. Risk and opportunity management, change management, and workforce awareness and engagement all receive strengthened language. The Annex SL harmonized structure is preserved, so the clause numbering your clients already know remains intact.

Why it matters. This is an evolutionary revision, but the culture and ethics requirements are qualitatively different from anything previously in ISO 9001 because they demand auditable evidence of something organizations have historically treated as intangible. Certification bodies will need a defensible way to sample for it, and organizations will need to produce artifacts rather than assertions. Expect this to be the dominant source of nonconformities in the first wave of transition audits.

Transition timeline. Organizations will have three years from publication, running to September 2029, to move certificates to the new edition. Certification bodies and their accreditation bodies are expected to complete training and scope extension between September 2026 and August 2027, which means the first ISO 9001:2026 certificates are unlikely to be issued before roughly August 2027. Note also that IAF ceased independent operation on January 1, 2026, and merged with ILAC into Global Accreditation Cooperation; ANAB has issued its own guidance covering both the ISO 14001:2026 and ISO 9001:2026 transition processes.

Action items. Do not begin gap assessments against the FDIS text as if it were final published text but do begin scoping. The useful work available right now is inventorying where climate change is or is not addressed in existing context analyses and identifying what evidence of quality culture and ethical conduct an organization could produce today if asked. Practical guidance on both appears later in this newsletter.

Sources: ISO.org standard page for ISO 9001; SGS, DNV, BSI, DQS and TÜV transition briefings; Quality Magazine FDIS analysis; ANAB management systems guidance.

ISO 14001 — Environmental Management

What changed. ISO 14001:2026 was published on April 15, 2026, and supersedes the 2015 edition. Nothing new was published this week; the item of consequence now is the transition schedule rather than the content.

The revision folds in the 2024 climate change amendment and updates environmental terminology to reflect current priorities — climate change, biodiversity, and resource efficiency. The stated design constraint for the revision was to clarify existing requirements rather than to introduce substantial new ones, and the harmonized clause structure is unchanged, so organizations certified to the 2015 edition will find the document familiar. The alignment with the forthcoming ISO 9001:2026 is deliberate and unusually clean: both editions now handle climate change, organizational context, risk, and interested parties in compatible language, which materially reduces the cost of running an integrated management system.

Transition timeline. Certificates must be transitioned by April 30, 2029. From October 1, 2027, recertification audits will incorporate transition requirements, which effectively compresses the practical window for organizations on a three-year cycle. Anyone with a recertification audit falling in late 2027 or 2028 should be planning the transition now rather than treating 2029 as the operative date.

Why it matters. The integration argument is the strongest it has been in a decade. Organizations holding both 9001 and 14001 that transition the two separately will do substantial duplicate work on context, climate, and interested-party analysis. The efficient path is a single combined transition project sequenced so the 14001 work, which can start immediately, produces artifacts the 9001 transition can reuse after September.

Sources: DNV publication announcement for ISO 14001:2026; ANSI/ANAB blog transition guidance; DQS, DEKRA, SGS and SLR Consulting transition briefings.

ISO 45001 — Occupational Health & Safety

What changed. The revision reached Draft International Standard stage in mid-April 2026, following the first Committee Draft in July 2025 and a revised committee draft in January 2026. Publication is anticipated in 2027. No new balloting milestone was reported this week, but the DIS content is now stable enough to plan against.

The draft focuses on mental health and psychosocial risk, hybrid and remote work arrangements, climate-related risks to workers, organizational resilience, and supply chain responsibility. The most significant shift is that psychosocial risk — including burnout and harassment — moves from the advisory posture of ISO 45003:2021 into explicit expectation within the certified management system. Worker participation requirements are also sharpened. If publication lands in 2027, the customary three-year transition would put the conformance deadline at approximately 2030.

Why it matters. Psychosocial hazards are the first category of occupational risk in decades that most organizations have no existing measurement infrastructure for. Physical hazards have exposure limits, monitoring equipment, and incident data. Psychosocial hazards require survey instruments, confidentiality protections, and a governance model for acting on what the data reveals — none of which can be stood up in the final year of a transition. Organizations that begin building the assessment capability now, using ISO 45003 as the framework, will be positioned to demonstrate conformance when the requirement becomes auditable. Those that wait will be attempting to establish a baseline and a trend line simultaneously.

Action items. Treat ISO 45003:2021 as the working blueprint. It is guidance rather than a certifiable standard, which makes it an unusually low-risk way to build the required capability ahead of the requirement. Concrete steps are outlined in the practical steps section below.

Sources: Smithers ISO 45001 revision briefing; DQS revision facts summary; ISO.org page for ISO 45003:2021; MSI and ICExperts Academy revision analyses.

ISO/IEC 42001 — AI Management Systems

What changed. No revision or amendment to ISO/IEC 42001:2023 itself was announced. The activity is in the surrounding ecosystem and in the certification market, both of which moved this month.

Certification announcements continue at a steady pace. Bandwidth Inc. announced ISO/IEC 42001 certification on August 20 covering its products, processes and operations worldwide; Mokkup.ai announced certification on August 19 covering platform governance and lifecycle management including personnel, processes, applications and cloud infrastructure; NeenOpal announced certification on August 11; and CSM Technologies announced certification during the month. Both Mokkup.ai and NeenOpal were certified by InterCert. The pattern across these announcements is worth noting — scopes are being drawn broadly, covering infrastructure and personnel rather than narrow product boundaries.

On the standards side, ISO/IEC 42001 was approved as a European Standard, EN ISO/IEC 42001:2026, by CEN on March 13, 2026. Six supporting publications have now closed significant gaps in the assurance architecture around the core standard: ISO/IEC 42005 on AI system impact assessment, ISO/IEC 42006 on requirements for certification bodies, ISO/IEC 42007 on conformity assessment schemes, ISO/IEC 12792 on transparency taxonomy, ISO/IEC TS 6254 on explainability, and ISO/IEC TR 20226 on environmental sustainability. ISO/IEC 42006 in particular is what allows accreditation of certification bodies to mature, which should improve consistency across certificates issued from here forward.

Why it matters. ISO 42001 has crossed from a signaling exercise into a procurement gate. Reporting from mid-2026 indicates the question of whether a vendor is certified or implementing appears in roughly 40 percent of enterprise AI vendor RFPs in the EU and around 25 percent in North America. For clients selling AI-enabled products or services into enterprise or public sector buyers, the certification is increasingly the price of being considered rather than a differentiator. The European Standard adoption also makes 42001 the natural conformity anchor for organizations navigating EU AI Act obligations.

Sources: GlobeNewswire and Bandwidth investor announcements, August 2026; ISO.org ISO 42001 explainer; CEN adoption of EN ISO/IEC 42001:2026; ISO/IEC JTC 1/SC 42 catalogue.

US State Regulatory Activity

Artificial Intelligence — Bearing on ISO 42001

The federal preemption effort and state legislative activity are now running in open tension. The December 2025 executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" directs a minimally burdensome approach by states and established an AI Litigation Task Force within the Department of Justice, operative from January 10, 2026, to challenge state AI laws in federal court on interstate commerce, preemption, and other grounds. States have not slowed materially in response: as of July 1, states had enacted 109 AI laws and 28 data center laws, against 121 and 27 respectively at the same point the prior year.

Three state regimes matter most for compliance planning. Texas HB 149, the Responsible Artificial Intelligence Governance Act, took effect January 1, 2026, and operates as a prohibited-uses statute rather than a high-risk framework — it bans AI intentionally developed or deployed to incite self-harm or criminal activity, AI-generated child sexual abuse material and nonconsensual deepfake imagery, and government social scoring, with tiered civil penalties. California SB 53, the Frontier AI Transparency Act, and AB 2013 both took effect January 1, 2026, and the CPPA automated decision-making technology regulations are in force with significant-decision obligations beginning January 1, 2027. Colorado repealed and replaced its 2024 AI Act with SB 26-189, signed May 14, 2026, narrowing the framework to cover automated decision-making technology used for consequential decisions, with substantive obligations commencing January 1, 2027.

Why it matters for ISO 42001. The January 2027 cluster of California CPPA and Colorado effective dates gives clients a natural implementation deadline. An ISO 42001 management system does not by itself satisfy any of these statutes, but the AI system inventory, impact assessment process, and role-and-responsibility documentation the standard requires are the same artifacts these laws demand. Building once against 42001 and mapping outward to the state regimes is materially cheaper than building separately against each. The preemption litigation adds uncertainty about which statutes survive, which is an additional argument for anchoring compliance to the standard rather than to any single state law.

Environmental and Climate — Bearing on ISO 14001 and ISO 9001 Clause 4.1

California moved its first greenhouse gas reporting deadline. On June 24, 2026, CARB deferred the deadline for reporting Scope 1 and Scope 2 emissions under SB 253 from August 10, 2026, to November 10, 2026, providing additional time ahead of formal adoption of the implementing regulation. Scope 3 reporting is expressly not required for the 2026 reporting year; a limited five-category approach is proposed to begin with the 2027 cycle. SB 253 applies to US-based companies with more than $1 billion in annual revenue doing business in California.

SB 261, which requires biennial public reporting on climate-related financial risks by companies with over $500 million in revenue, remains paused. The Ninth Circuit issued a preliminary injunction applying only to SB 261, and CARB has stated it will not enforce the January 1, 2026, statutory deadline while the appeal proceeds, with an alternate reporting date to be provided after resolution. The underlying challenge was brought by the US Chamber of Commerce and other business groups.

Why it matters. The November 10 date is now the operative one for in-scope clients, and it is roughly ten weeks out. The emissions inventory work required for SB 253 is substantially the same work required to demonstrate climate change consideration under ISO 14001:2026 and the new ISO 9001 Clause 4.1 — organizations doing both should be running one data collection effort, not two.

Workplace Safety — Bearing on ISO 45001

The California Occupational Safety and Health Standards Board released a revised draft workplace violence prevention regulation for general industry on July 22, 2026, with public comment closing August 17. The revised draft narrows employer-provided transportation to transportation under the employer's control, removes the previous exception to the definition of "threat of violence" for texts, electronic messages, and personal social media, and clarifies that an employee assistance program satisfies the requirement to make individual trauma counseling available. A vote on the final draft is expected in fall or winter with an implementation date of January 1, 2027. This builds on the general industry workplace violence prevention requirements already in effect under California Labor Code since July 1, 2024.

On heat, the federal picture has stalled while states have moved. OSHA's heat-related illness National Emphasis Program was set to expire April 8, 2026, and the proposed permanent federal heat standard has no target date for finalization following the January 2025 regulatory freeze; OSHA updated the NEP in April to prioritize inspections across 55 high-risk industries. California's indoor heat illness standard, effective July 23, 2024, applies where indoor temperatures reach 82°F and requires water, cool-down areas, training, emergency response procedures, and acclimatization. Nevada began enforcement April 29, 2025, requiring employers with ten or more employees to complete a one-time written job hazard analysis identifying classifications with heat exposure exceeding 30 minutes per hour.

Why it matters. Both the workplace violence rule and the psychosocial risk direction in the ISO 45001 revision point at the same organizational capability: identifying hazards that are behavioral rather than physical and providing support pathways for affected workers. The trauma counseling and EAP provisions in the California draft are a preview of what the 45001 revision will expect more broadly. Multi-state employers should also be maintaining a state-by-state heat matrix rather than defaulting to federal minimums, since the federal floor is not moving and the state ceilings are.

Sources: King & Spalding, Cooley, Paul Hastings and Latham & Watkins AI law alerts; TechPolicy.Press mid-year state legislation review; Mayer Brown and Sidley CARB updates; Ogletree and OH&S coverage of the Cal/OSHA workplace violence draft; Cal/OSHA heat illness resources.

Practical Steps to Meet the New Requirements

The following are concrete, auditable approaches to the requirements, gaining emphasis across the four standards. Each is written so that the output is evidence an auditor can sample, not an intention.

Quality Culture — ISO 9001 Clause 5.1.1 and Clause 7.3

The difficulty with quality culture is that it is a state, not an activity, and auditors sample activities. The workable approach is to define the culture in terms of observable behaviors and then generate records of those behaviors. Start by writing a short quality culture statement — one page, approved by top management, naming four to six specific behaviors the organization expects, such as stopping work on a suspected nonconformity without seeking permission, or reporting a near miss without attribution of blame. Vague virtues like "we value quality" are not auditable; "any employee may halt a process and will not face consequences for doing so" is.

Measure it. A short annual or semi-annual culture survey with a stable question set produces the trend data that demonstrates that the culture is being monitored rather than asserted. Ask whether employees feel able to raise quality concerns, whether they believe concerns get acted on, and whether they have seen schedule pressure override a quality decision. Retain the results and, critically, retain the record of what management did in response to them — the response is the evidence of leadership commitment, not the survey itself.

Build the behaviors into existing records. Add a standing quality culture item to management review with defined inputs: survey trend, near-miss reporting rate, stop-work events, and repeat nonconformity rate. Incorporate the named behaviors into onboarding and into the competence and awareness records required under Clause 7.3, so that awareness training explicitly covers the culture statement and each employee's record shows it. Where performance reviews exist, include a quality behavior element for supervisors and above. The audit trail is then: statement approved, awareness delivered and recorded, behavior measured, results reviewed by management, actions taken and tracked.

Ethics — ISO 9001 Leadership and Awareness Clauses

Ethical behavior enters ISO 9001 through the same Clause 5.1.1 language that carries quality culture, and the evidence pattern is similar. Most organizations already have a code of conduct; the gap is usually that it lives with HR or Legal and has never been connected to the quality management system. Connect it explicitly. Reference the code of conduct in the quality manual or equivalent documented information and make sure the code addresses the ethics questions that actually arise in a quality context: falsification or selective reporting of inspection and test data, pressure to release nonconforming product, misrepresentation of certification scope or test results to customers, and conflicts of interest in supplier selection.

Provide a reporting channel and prove it works. A confidential or anonymous route for raising ethical concerns, with a documented non-retaliation commitment, is the single most auditable ethics control. Keep a log of reports received, how each was handled, and the timeline to closure — with identities protected. An empty log invites the question of whether the channel is known to exist, so track awareness of the channel in the culture survey. Deliver ethics awareness as part of the Clause 7.3 awareness program with retained attendance and comprehension records and include an ethics and integrity item in management review inputs. For organizations with meaningful supply chain exposure, extend the expectation into supplier agreements and supplier evaluation criteria, which also anticipates the supply chain responsibility direction in the ISO 45001 revision.

Climate Change — ISO 9001 Clause 4.1 and ISO 14001:2026

The requirement is to determine whether climate change is a relevant issue in the organization's context — and to be able to show the determination that was made. The most common failure is silence: an existing context analysis that simply does not mention climate, leaving the auditor unable to tell whether it was considered and dismissed or never considered. Fix that first. Update the context register or equivalent so climate change appears as an explicit line item with a documented conclusion, including the reasoning where the conclusion is that it is not material.

Address both directions of the relationship. Physical risk is how a changing climate affects the organization's ability to deliver conforming products or service — extreme heat affecting workforce availability and process control, water availability, flooding or wildfire exposure at owned and supplier sites, and utility interruption. Transition risk is regulatory, market, and customer pressure: emissions disclosure obligations such as California SB 253, customer sustainability requirements flowing down through procurement, and carbon pricing exposure. Assess supplier and single-source exposure, since climate disruption to a sole supplier is a quality risk regardless of where the supplier sits.

Then close the loop into the rest of the system. Where climate is determined to be material, the risks and opportunities register under Clause 6.1 should carry the corresponding entries with owners and treatment actions and interested-party requirements under Clause 4.2 should reflect the parties raising climate expectations — regulators, customers, insurers, investors. Feed climate-related risk into business continuity planning and into management review. For clients also in scope for SB 253, run the greenhouse gas inventory as one exercise serving both the statutory report and the ISO 14001 evidence, and note that the November 10, 2026 deferred deadline is the operative near-term date.

Psychosocial Risk — ISO 45001 Revision and ISO 45003 Guidance

Because ISO 45003:2021 is guidance rather than a certifiable standard, it can be adopted now without triggering a certification obligation — which makes it the right vehicle for building capability ahead of the 45001 revisions. Begin with hazard identification. Extend the existing OH&S hazard identification process to cover psychosocial hazards explicitly: workload and work pace, role clarity and role conflict, degree of job control and autonomy, quality of supervisory support, bullying and harassment, exposure to traumatic events for relevant roles, job insecurity, and the boundary conditions of remote and hybrid work. Use the ISO 45003 categories directly so the mapping to the eventual requirement is obvious to an auditor.

Assess with an instrument, not with intuition. A validated psychosocial risk survey — HSE Management Standards Indicator Tool, COPSOQ, or an equivalent — run at a consistent cadence produces comparable data over time. Report results at the group level with a minimum group size that protects individual confidentiality and combines survey data with objective indicators the organization already holds: absence patterns, turnover by team, grievance and harassment complaints, overtime concentration, and EAP utilization rates where the provider reports them in aggregate.

Control at the organizational level first. The hierarchy of controls applies to psychosocial hazards as it does to physical ones, which means workload redesign, clarifying role boundaries, adjusting shift patterns, and training managers to recognize and respond to distress all rank above individual resilience training. Resilience and mindfulness offerings are legitimate but sit at the bottom of the hierarchy, and an auditor who finds them presented as the primary control will read that as a gap. Provide support pathways — EAP or equivalent, with a clear route to individual trauma counseling for roles with traumatic exposure, which is also what the pending California workplace violence rule will require. Ensure worker participation in identifying and evaluating psychosocial hazards, since strengthened worker participation is one of the revision's stated themes. Finally, integrate the results into management review and incident investigation, so that psychosocial factors are considered as contributing causes rather than treated as a separate HR workstream.

Workplace Violence Prevention — Emerging, ISO 45001 and California General Industry

This is the newly emphasized requirement surfaced by this week's research, and it sits at the intersection of the California rulemaking and the psychosocial direction of the 45001 revision. Organizations with California operations should be preparing now for a January 1, 2027, implementation date. The auditable core is a written workplace violence prevention plan covering hazard identification specific to the workplace, procedures for responding to and reporting incidents including threats, a violent incident log, employee training with retained records, and a defined route to individual trauma counseling — which the revised draft confirms an employee assistance program can satisfy. Note the two narrowing changes in the July draft: employer-provided transportation is limited to transportation under the employer's control, and the exception previously carved out for texts, electronic messages, and personal social media has been removed, which broadens what counts as a threat of violence. Organizations outside California should treat the standard as a reasonable template, since the direction of travel in the 45001 revision points the same way.

Heat Exposure — ISO 45001 and State Standards

With the federal heat standard stalled and the National Emphasis Program in an uncertain posture, the operative obligations are state ones and they differ materially. Maintain a state-by-state matrix of heat obligations for every location where the organization has workers and drive the ISO 45001 hazard identification and controls to the most stringent applicable requirement rather than to a federal baseline that may not exist. California's indoor standard triggers at 82°F and requires water, cool-down areas, training, emergency response procedures, and acclimatization; Nevada requires a one-time written job hazard analysis from employers with ten or more employees, identifying classifications with more than 30 minutes of heat exposure per hour. Both are straightforward to fold into an existing OH&S hazard register, and the written job hazard analysis in particular is exactly the kind of artifact an ISO 45001 auditor will look for.

Looking Ahead

The dates worth marking are September 16 for ISO 9001:2026 publication, November 10 for the deferred California SB 253 Scope 1 and 2 reporting deadline, and the fall or winter Standards Board vote on the California workplace violence regulation ahead of a January 1, 2027, implementation. January 1, 2027, is shaping up as a significant cluster date generally, carrying the California CPPA significant-decision obligations, the Colorado SB 26-189 substantive obligations, and the likely California workplace violence effective date. Next week's edition will cover the ISO 9001:2026 publication itself if it lands on schedule.

SQC Advisory · Weekly Regulatory & Standards Newsletter · August 31, 2026

Compiled from publicly available sources. Informational only; not legal advice.