ISO 9001:2026 Is Published: What the Revision Asks of Manufacturers in Indonesia, and What It Cannot Do on Its Own

On 16 September 2026, the International Organization for Standardization published ISO 9001:2026, the first full revision of the quality management system standard since 2015 (LRQA, 2026). For many foreign-owned manufacturers in Indonesia, ISO 9001 is not a voluntary badge. It is written into parent company policy, supply agreements and tender requirements, and it often supports product certification for mandatory national standards. A new edition therefore starts a clock that quality and procurement teams cannot ignore.

The revision arrives in a year that has also shown how quality failures travel. Between late 2024 and late 2025, a contaminated ingredient moved from a single supplier into infant formula sold in 99 countries and territories, including Indonesia. This article reads the two developments together. The 2026 edition pushes organisations towards quality culture and sharper risk thinking, but those clauses only have substance when they rest on disciplined quality assurance and quality control on the shop floor and across the supply chain.

Background: why ISO 9001 matters in the Indonesian context

The 2015 edition of ISO 9001 introduced the harmonised clause structure shared with other management system standards and replaced the old preventive action clause with risk-based thinking (International Organization for Standardization, 2015). In February 2024, an amendment added the expectation that organisations consider whether climate change is a relevant issue and whether interested parties have climate-related requirements (International Organization for Standardization, 2024).

In Indonesia, standardisation and conformity assessment are governed by Law No. 20 of 2014 on Standardisation and Conformity Assessment, under which the National Standardisation Agency (BSN) adopts international standards as Indonesian National Standards (SNI) and the National Accreditation Committee (KAN) accredits conformity assessment bodies (Republik Indonesia, 2014). ISO 9001:2015 is in use nationally as SNI ISO 9001:2015.

The link to mandatory product standards is practical. Product certification schemes for mandatory SNI often follow certification type 5 under ISO/IEC 17067, which combines an audit of the factory's management system and production process with sample testing before a product certificate (SPPT SNI) is granted (IAPMO, n.d.). Scheme documents of this kind ask for the application of a quality management system based on SNI ISO 9001:2015 and its revisions, or another recognised quality management system (IAPMO, n.d.). The exact requirement differs between schemes, so it should be read in the scheme that applies to each product. A change in ISO 9001 therefore reaches, sooner or later, the evidence presented to product certification bodies.

Yet a certificate describes a system, not an outcome. The infant formula case illustrates the gap. Nestlé first identified cereulide, a heat-stable toxin produced by Bacillus cereus, in products at its Nunspeet plant in the Netherlands in late November 2025. A subsequent analysis of 65 batches of arachidonic acid (ARA) oil received from a Chinese producer between April 2023 and October 2025 traced the contamination back to October 2024, with the highest concentrations in deliveries from July 2025 (Food Safety News, 2026). The World Health Organization reported that affected products reached 99 countries and territories, that 144 suspected and confirmed cases were reported in ten countries between 1 January and 25 February 2026, and that the full root cause was still under investigation (World Health Organization, 2026).

In Indonesia, the Food and Drug Authority (BPOM) acted on 14 January 2026 after international alerts. It ordered PT Nestlé Indonesia to stop distribution and temporarily halt imports of two batches of S-26 Promil Gold pHPro 1, even though its own laboratory tests did not detect cereulide in samples, citing the vulnerability of infants (Badan Pengawas Obat dan Makanan, 2026; Bisnis.com, 2026). In July 2026, the United States Food and Drug Administration wrote to infant formula manufacturers and their supply chain partners, setting out its expectation of substantive oversight of suppliers, including supplier audits and verification activities (U.S. Food and Drug Administration, 2026). The lesson extends beyond food. An ingredient failure persisted through roughly a year of deliveries before it was caught downstream, which is a question of how incoming risk is assessed and verified, not of how well procedures are written.

The current issue: what ISO 9001:2026 changes

ISO presents the update as targeted, aimed at clarity and usability rather than a rewrite (International Organization for Standardization, 2026). Based on published summaries, the main changes are as follows. Clause references should be confirmed against the purchased text of the standard.

• Quality culture and ethical behaviour. Top management is expected to promote and demonstrate a quality culture and ethical behaviour, and personnel are expected to be aware of them. The ANSI summary describes this as leaders modelling honesty and encouraging people to speak up (Schirn, 2026).
• Risks and opportunities treated separately. Planning now addresses risks and opportunities as distinct considerations, so that organisations look for improvement as deliberately as they manage threats, including when adopting new technologies (Schirn, 2026).
• Climate change integrated. The 2024 climate amendment is carried into the context clauses of the new edition (International Organization for Standardization, 2024).
• A new informative Annex A. The annex clarifies terminology, structure and the intent of requirements, which should reduce disputes over interpretation (Schirn, 2026).

On timing, LRQA states that organisations certified to ISO 9001:2015 have three years to transition, until 30 September 2029, after which 2015 certificates expire or are withdrawn, and that existing certificates remain valid during the transition (LRQA, 2026). DQS adds that binding transition rules are set by the Global Accreditation Cooperation (Global ACI), the body that has taken over the work of the International Accreditation Forum, and that certification to the 2015 edition will remain available only for a limited period (DQS, 2026). Certification bodies may set their own cut-off dates for new certificates to the 2015 edition, so confirm the dates with your certification body. At the time of writing, we found no public information on when BSN will adopt the 2026 edition as an SNI, or how product certification schemes will reference it.

The two substantive changes map onto the failure pattern described above. A culture in which an operator, analyst or buyer raises an anomaly early, and is thanked for it, is the first line of detection. A risk process that treats supplier risk as a live analysis, not a template filled in once, is the second. The danger is that both become paperwork, a new line in the quality policy and a renamed risk register.

Recommendations: giving the new clauses substance

• Start the transition with a clause-by-clause gap assessment against the 2026 text, and agree a transition audit date with the certification body early. LRQA notes that audit capacity tends to be tightest in the final year of a transition (LRQA, 2026).
• Make quality culture observable. Count and review a few behaviours, such as holds raised by operators, time from detection of an anomaly to escalation, and the share of nonconformities found by the front line rather than by customers.
• Separate the risk register from the opportunity register, and connect both to process analysis. A process FMEA following the AIAG and VDA approach gives the register technical depth and shows where controls are weak (AIAG & VDA, 2019).
• Translate FMEA results into a control plan that specifies, for each critical characteristic, the method, sample size, frequency and reaction plan.
• Apply statistical process control to critical characteristics. Control charts and capability indices separate common cause from special cause variation (Montgomery, 2019). Indonesian studies show the value of combining tools. In furniture finishing, SPC and FMEA were used together to monitor stability and prioritise failure modes (Fadhil & Khoiroh, 2025). In railway component manufacturing, FMEA on nonconformance data identified eight defects above a critical risk priority number of 209, and fault tree analysis traced them mainly to material and personnel causes (Prastyabudi et al., 2024).
• Manage suppliers by risk. Audit high-consequence suppliers on site, verify critical incoming materials by independent testing rather than certificates of analysis alone, require notification of source changes, and test lot traceability through mock recalls.
• Close the loop through CAPA. Root causes should be evidenced, actions should have owners and due dates, and effectiveness should be verified before closure.
• Protect measurement integrity through calibration and measurement system analysis, so that SPC data can be trusted.
• Use management review to decide, not to report. Bring culture indicators, supplier performance, opportunities and the transition plan into one meeting and record the decisions.

How this connects with Nusa Safety's work

Several of these steps sit within work Nusa Safety already performs. Our ISO gap assessment and internal audit service can measure the distance between an existing system and the 2026 requirements, and our integrated ISO management systems consulting helps organisations that run ISO 9001 alongside ISO 14001 and ISO 45001 plan one transition instead of several. Reaction plans only work when written for the people who use them, which is the purpose of technical guidelines and SOP development. Incident investigation and RCA training builds the root cause skills that CAPA requires, and HSE digitalization can move inspection records out of spreadsheets.

On the digital side, APEX Risk allows teams to run FMEA and other assessments within projects and carry every finding into a corporate risk register and a corrective action register with owners and targets. This gives management review a single, current view rather than a collection of files.

Certification is granted by an independent certification body chosen by the client. Nusa Safety prepares the system and the people, but it is not a certification body and does not certify management systems. Certified training programmes are delivered together with licensed partners.

Conclusion

ISO 9001:2026 asks leaders to show, not just state, a commitment to quality culture and ethical behaviour, and to treat risks and opportunities as separate decisions. These are sound directions, and the three-year transition gives time to adopt them properly. The infant formula recall shows what is at stake when they exist only on paper. A supplier failure ran undetected for months and crossed borders before it was caught downstream, and regulators, including BPOM, had to act on a precautionary basis. Manufacturers in Indonesia that use the transition to strengthen FMEA, control plans, SPC, supplier verification and CAPA will gain more than a renewed certificate. They will gain a system that detects problems earlier.

This article is general information and not legal advice. For questions on how specific regulations apply to your company, please consult a qualified advocate.

References

1. AIAG & VDA. (2019). Failure mode and effects analysis: FMEA handbook (1st ed.). Automotive Industry Action Group.
2. Badan Pengawas Obat dan Makanan. (2026, January 14). Penarikan produk formula bayi impor [Penjelasan publik]. https://www.pom.go.id/penjelasan-publik/penarikan-produk-formula-bayi-impor
3. Bisnis.com. (2026, January 14). BPOM perintahkan Nestle tarik susu bayi terkait toksin cereulide. https://ekonomi.bisnis.com/read/20260114/12/1944198/bpom-perintahkan-nestle-tarik-susu-bayi-terkait-toksin-cereulide
4. DQS. (2026). ISO 9001:2026 telah hadir. https://www.dqsglobal.com/id/wawasan/blog/transisi-iso-9001-2026
5. Fadhil, M. N., & Khoiroh, S. M. (2025). Analisis pengendalian kualitas produk furniture dengan metode SPC dan FMEA pada PT. Multi Manao Indonesia. Surya Teknika, 12(1), 430-438. https://doi.org/10.37859/jst.v12i1.9387
6. Food Safety News. (2026, February 20). Infant formula contamination dates back to 2024. https://www.foodsafetynews.com/2026/02/infant-formula-contamination-dates-back-to-2024/
7. IAPMO. (n.d.). Skema sertifikasi SS5-76 Rev01, SNI 594:2022 polipropilena. https://iapmo.org/media/5gxkxndl/ss5-76-rev01-sni-594-2022-polipropilena.pdf
8. International Organization for Standardization. (2015). ISO 9001:2015 Quality management systems, requirements. ISO.
9. International Organization for Standardization. (2024). ISO 9001:2015/Amd 1:2024 Quality management systems, requirements, amendment 1, climate action changes. ISO.
10. International Organization for Standardization. (2026). ISO 9001:2026 Quality management systems, requirements. ISO. https://www.iso.org/9001
11. LRQA. (2026, September 16). ISO 9001:2026 is live: The transition period has begun. https://www.lrqa.com/en/latest-news/iso-9001-2026-live/
12. Montgomery, D. C. (2019). Introduction to statistical quality control (8th ed.). Wiley.
13. Prastyabudi, W. A., Faharga, R. A., & Chandra, H. (2024). Systematic risk analysis of railway component quality: Integration of FMEA and FTA. Spektrum Industri, 22(2), 77-89. https://doi.org/10.12928/si.v22i2.223
14. Republik Indonesia. (2014). Undang-Undang Nomor 20 Tahun 2014 tentang Standardisasi dan Penilaian Kesesuaian.
15. Schirn, A. (2026, October 2). What is new in the 2026 edition of ISO 9001? ANSI Blog. https://blog.ansi.org/ansi/iso-9001-2026-new-changes/
16. U.S. Food and Drug Administration. (2026, July 13). FDA calls on infant formula industry to better safeguard against contaminants introduced through their supply chain. https://www.fda.gov/food/hfp-constituent-updates/fda-calls-infant-formula-industry-better-safeguard-against-contaminants-introduced-through-their
17. World Health Organization. (2026, March 13). International food safety event: Infant formula and products containing arachidonic acid oil contaminated with cereulide toxin, multi-country. Disease Outbreak News. https://www.who.int/emergencies/disease-outbreak-news/item/2026-DON596