Quality culture and ethical behavior in ISO 9001:2026. What the new standard requires.

Every summary of ISO 9001:2026 mentions the same phrase: the new edition introduces "quality culture and ethical behavior." Almost none of them goes further than that sentence. This article does, because the requirement is more interesting than the summaries suggest, and because how you respond to it will determine whether your next audit is a conversation or an awkward silence.

I write this as a management systems auditor and the founder of a certification body, which means I have a practical stake in the question: in the coming years, our auditors will have to assess this requirement in real organizations, and your organization may have to demonstrate it. So, let's look at what the standard actually says, what it does not say, and what evidence will separate the organizations that took it seriously from the ones that didn’t.

Where the requirement actually lives

Quality culture and ethical behavior appear in three places in ISO 9001:2026.

The first is in the subclause titled Leadership and commitment. 

Top management must demonstrate leadership and commitment with respect to the quality management system by, among other things, promoting a quality culture and ethical behavior in the organization. 

The standard does not ask top management to create a culture, or to develop a measurable culture score. It asks them to promote it.

Second time is in the subclause on Awareness. 

Persons doing work under the organization's control must now be aware of the organization's quality culture and of expectations regarding ethical behavior, alongside the familiar items (quality policy, relevant objectives, their contribution, the implications of not conforming). Awareness, in ISO 9001 terms, has never meant recitation. An operator who can explain, in their own words, why reporting a defect honestly matters more than hitting today's output number is aware. 

The third time is a note in subclause 7.1.4, Environment for the operation of processes, stating that the factors making up a suitable work environment can be influenced by the organizational quality culture. A note is guidance, not requirement. 

That is the entire footprint: one leadership duty, one awareness item, one explanatory note. Anyone telling you that ISO 9001:2026 requires a culture transformation program, a culture manual, or an ethics management system is selling you something the standard does not ask for.

What "quality culture" means when it is not a slogan

ISO has, in fact, already defined the territory, in a standard almost nobody reads: ISO 10010:2022, Quality management — Guidance for understanding, evaluating and improving organizational quality culture. It describes quality culture as the values, beliefs, and behaviors, shared across an organization, that shape how quality is actually treated when no one is watching. ISO 10010 is a guidance standard, it does not include requirements, and ISO 9001:2026 does not make it mandatory. But if you want a structured way to think about the subject, it is a useful reference.

The practical definition I prefer is simple. 

Quality culture is the answer to one question: “What happens in your organization when quality and convenience point in different directions?” When the shipment is due and the final inspection finds a problem. When the metric looks better if the rework is not recorded. When a junior employee notices that the approved supplier is sending marginal material and has to decide whether saying so is welcome. Culture is not what the quality policy says; it is what the organization predictably does in those moments. The policy is relevant only to the extent that behavior matches it.

Ethical behavior, in the QMS context, is the twin of that answer. It covers honest measurement and honest records, claims about products that the products actually meet (including, in 2026, the growing family of sustainability and carbon claims, which the new edition treats like any other claim: if you state it, you must meet it), fair dealing with suppliers and customers, and the absence of pressure on people to look the other way. 

None of this is exotic. Most of it was always implicit in ISO 9001; falsifying an inspection record was never acceptable, of course. What the 2026 edition changes is that the expectation is now explicit, and it is attached to top management by name.

What auditors can ask, and what they should not

Culture cannot be audited the way, say, calibration can. There is no certificate for it, and an auditor who demands "evidence of culture" as a document is asking the wrong question. But that does not make the requirement unauditable; it makes it auditable through triangulation, the method auditors already use everywhere else. What the documents say, what people describe, and what the auditor observes should tell the same story. Where they diverge, that gap is the finding.

Expect assessment of this requirement to draw on evidence such as:

• How leadership communicates. Not whether a "quality culture statement" exists, but whether management reviews and everyday decisions give quality visible weight. Minutes and communications are evidence of behavior.
• How nonconformities are treated. This is, in my experience, the single most revealing indicator. An organization where problems are reported early, investigated for causes, and closed without hunting for a person to blame has a quality culture, whatever its posters say. An organization where "the operator was told to be more careful" is a standing corrective action has answered the culture question too, but in the other direction.
• Whether the data is honest. Scrap rates, complaint figures, and audit results that look implausibly clean invite the obvious question. A metric nobody ever misses is either a triumph or a fiction, and auditors are paid to find out which.
• What people say when asked simply. For example, an auditor may ask an employee what ethical behavior means in their work. "If I find a defect, I record it, even on a bad day" is a passing answer. Reciting a code of conduct is not required, and a rehearsed answer is worth less than an honest, plain one.
• What happens to the person who speaks up. Whether there is a way to raise a concern, whether anyone has used it, and what happened next. One real example outweighs any written policy.

How to prepare without creating bureaucracy

The wrong response to this requirement in my opinion is a new document called Quality Culture Procedure. Of course the company can create such a procedure, but is it really useful? There are a few other aspects where I suggest they should focus:

1. Have top management decide what they actually expect: how quality decisions are made under pressure, what is never acceptable, how concerns get raised. If this already exists inside a code of conduct (for example) then the work is done.
2. Put culture and ethics on the management review agenda at least once: what the nonconformity data, complaint handling, and internal audit results say about how the organization actually behaves. ISO 9001 does not require the quality culture to be an input to the management review, but what is there to lose if it is added to the list of inputs to this review?
3. Fold the awareness item into existing training and onboarding, as scenarios rather than definitions. Ten minutes on "here is what we do when the test fails on shipping day" does more than an hour of definitions.
4. Check incentives. If bonuses, targets, or scheduling quietly reward hiding problems, no training will outweigh them.

A word on the transition to ISO 9001:2026

Organizations certified to ISO 9001:2015 have a transition period to move to the 2026 edition, and transition audits will naturally give attention to what is new, which puts this requirement on the agenda. The organizations that will handle it comfortably are the ones that treat it as a question about how they already behave, answered with existing evidence, rather than as a documentation project. 

Frequently asked questions

Does ISO 9001:2026 require a documented quality culture procedure?
No. The requirement in clause 5.1.1 is for top management to promote a quality culture and ethical behavior. The standard does not require a documented procedure, program, or culture metric.

Can an auditor issue a nonconformity on quality culture?
Yes, but against the requirements, not against impressions. A nonconformity would cite objective evidence, for example, that top management cannot show any way in which it promotes quality culture and ethical behavior. "I didn't like the atmosphere in the organization" is not a finding.

Is ISO 10010 mandatory now?
Of course not. ISO 10010 is a guidance standard on understanding and improving quality culture. ISO 9001:2026 does not require conformity to it. It is useful background for organizations that want a structured approach.

Want to master the full 2026 edition of ISO 9001, clause by clause and requirement by requirement, with the auditor's perspective built in?

Our ISO 9001:2026 QMS Lead Auditor course covers every requirement.

Additionally, our QMS Practitioner and QMS Auditor certifications support you in demonstrating your competence in quality management, auditing and ISO 9001.