Here is a number that should make you uncomfortable. In the 2015 transition cycle, over 60% of certified organizations waited until the final twelve months to begin meaningful transition work. More than 20% waited until the final six months. A non-trivial number lost their certification entirely because they could not complete the transition before the deadline.

Three years sounds like a long time. It is not. I want to show you why, with actual math, and then give you the project plan I use to avoid the rush.

The real timeline math

ISO publishes the final standard. The clock starts. You have 36 months. Here is where those months go.

Months 1-6: Awareness and reading. Someone in the quality department downloads the standard. Reads it. Produces a summary for leadership. Leadership discusses it in a management review. Decisions about scope, budget, and approach are made. If your organization is fast, this takes three months. If it is typical, it takes six. If leadership does not see urgency, it takes twelve — and you have already burned a third of your window.

Months 6-12: Gap analysis. A proper gap analysis — not a desktop review, but a real assessment of your current QMS against the new requirements — takes two to three months for a mid-size manufacturing operation. You need to review documentation, interview process owners, assess system capabilities, and produce a findings report with prioritized actions. Add another month for leadership to review and approve the action plan.

Months 12-24: Implementation. This is where the real work happens. New processes designed and deployed. Existing processes modified. People trained. Systems updated or replaced. For a multi-site operation, this phase is measured in months, not weeks. At SNOP, where I built a greenfield QMS for 900+ employees, the design and deployment phase alone took fourteen months — and we were building from scratch with no legacy system to dismantle.

Months 24-30: Internal audit and corrective action. You audit your transition. You find gaps. You fix them. The internal audit cycle for a full QMS assessment takes two to three months, and the corrective actions it generates take another two to three months to close.

Months 30-36: Certification audit. Stage 1 documentation review. Stage 2 compliance audit. Nonconformities identified. Corrective actions submitted. Certificate issued. In a clean scenario, this takes four to six months. In a backed-up scenario — which is what happens when every other company is also trying to certify in year three — it takes longer.

Add it up. Six months awareness. Six months gap analysis. Twelve months implementation. Six months internal audit. Six months certification. That is 36 months. There is no slack. None.

If you start in year two, you are not starting in year two. You are starting in year three — because the first six months will be spent in the same awareness loop that proactive companies finished in year one.

The hidden cost multiplier

Consulting rates during peak transition periods are brutal. I tracked this during the 2015 cycle. A gap analysis that cost 15,000 euros in year one cost 28,000 in year two and 42,000 in year three. Same work, same consultant, different demand curve. Certification bodies were booking eight to ten months out. Training providers were full. The market punishes late movers, and the punishment is entirely predictable.

The project plan I use

Here is the transition plan I have used across multiple organizations. It works because it front-loads the hard decisions and leaves slack where slack is needed most — at the certification stage.

Phase 1 — Gap Analysis (Start: Month 1 after DIS publication)

  • Read the DIS. Identify structural versus documentation changes.
  • Map current QMS against new requirements. Produce heat map.
  • Estimate implementation effort per gap. Prioritize by risk and complexity.
  • Present findings to leadership with budget request. Get approval before the standard is even final.

Phase 2 — Design and Planning (Months 3-6)

  • Redesign processes that require structural change. Risk management expansion, digitalization scope, sustainability integration, leadership engagement mechanisms.
  • Build the transition project plan with milestones, owners, and resource allocation.
  • Lock certification body dates for year two — before the rush.
  • Begin training key personnel on new requirements.

Phase 3 — Implementation (Months 6-18)

  • Deploy new and modified processes. Train the organization.
  • Update documented information. Digitize where the standard now expects it.
  • Run pilot internal audits on transitioned processes to catch issues early.

Phase 4 — Verification and Certification (Months 18-24)

  • Full internal audit cycle. Close findings. Verify corrective actions.
  • Management review with transition evidence.
  • Stage 1 and Stage 2 certification audits — completed with a full year of slack before the deadline.

Notice the end date. Month 24. Not month 36. You finish a full year before the deadline, which means if anything goes wrong — a key person leaves, a system implementation slips, an audit reveals a major gap — you have twelve months of recovery time. The companies that start in year three have zero recovery time. Every slip is a crisis.

The one question to ask yourself today

If your organization is ISO 9001 certified, ask this question in your next management review: "What is our ISO 9001:2026 transition plan?"

If the answer is "we're waiting for the final version," you are already behind. The DIS tells you enough. The gap analysis can start now. The certification body dates can be reserved now. The budget conversation can happen now.

Three years is a lie. You have twelve months of real working time. The clock is already running.