ISO 9001 documented information: the full list, clause by clause

ISO 9001:2015 states its documented information requirements with two verbs. The organization must maintain documented information on its scope, quality policy and quality objectives, and on its processes to the extent necessary. It must retain documented information as evidence in the twenty entries listed below. Clause 7.5.1 adds whatever else the organization determines is necessary for the system's effectiveness.

Amendment 1:2024 does not change the list: its climate change additions to clauses 4.1 and 4.2 add no documented information.

Maintain and retain, as the standard uses them

Clause 7.5 sets the rules for all documented information: what the system includes (7.5.1), creating and updating it (7.5.2), and controlling it (7.5.3), including control of changes, and retention and disposition.

Clause 7.5 does not define the two verbs. The explanation is in the informative Annex A, at A.6. Where ISO 9001:2008 asked for documents, documented procedures, a quality manual or a quality plan, the 2015 edition requires the organization to "maintain documented information". Where the 2008 edition asked for records as evidence of conformity, it requires the organization to "retain documented information".

In the clauses that use it, maintained information describes the system: scope, policy, objectives, process information. Retained information is evidence, such as evidence of competence. Both are controlled under 7.5.3.2, including control of changes; retained evidence of conformity must also be protected from unintended alterations. A.6 leaves it to the organization to decide what is retained, for how long and on what media. ISO 9001 sets no retention period.

Documented information to be maintained

• 4.3: the scope of the quality management system, available and maintained, stating the types of products and services covered and the justification for any requirement determined not applicable.
• 4.4.2 a): to the extent necessary, information that supports the operation of the processes.
• 5.2.2 a): the quality policy, available and maintained.
• 6.2.1: the quality objectives.
• 8.1 e): to the extent necessary, information that gives confidence that processes have been carried out as planned and demonstrates the conformity of products and services. This entry asks the organization to determine, maintain and retain.

Documented information to be retained

• 4.4.2 b): to the extent necessary, information that gives confidence that processes are carried out as planned.
• 7.1.5.1: evidence that monitoring and measuring resources are fit for their purpose.
• 7.1.5.2 a): where measurement traceability applies and no international or national measurement standard exists, the basis used for calibration or verification.
• 7.2 d): evidence of competence.
• 8.1 e): as above.
• 8.2.3.2: as applicable, the results of the review of requirements for products and services, and any new requirements.
• 8.3.3: design and development inputs.
• 8.3.4 f): the design and development control activities, including reviews, verification and validation.
• 8.3.5: design and development outputs.
• 8.3.6: design and development changes, the results of reviews, the authorization of the changes, and the actions taken to prevent adverse impacts.
• 8.4.1: the evaluation, selection, performance monitoring and re-evaluation of external providers, and actions arising from the evaluations.
• 8.5.2: where traceability is a requirement, the information needed to enable it.
• 8.5.3: what occurred when property of a customer or external provider was lost, damaged or found unsuitable for use.
• 8.5.6: the results of the review of changes to production or service provision, who authorized the change, and actions arising.
• 8.6: the release of products and services, with evidence of conformity with the acceptance criteria and traceability to whoever authorized the release.
• 8.7.2: for nonconforming outputs, the nonconformity, the actions taken, any concessions obtained, and the authority deciding the action.
• 9.1.1: appropriate evidence of the results of monitoring, measurement, analysis and evaluation.
• 9.2.2 f): the implementation of the audit programme and the audit results.
• 9.3.3: the results of management reviews.
• 10.2.2: the nature of nonconformities, the actions taken, and the results of any corrective action.

Mentioned without either verb

• 8.5.1 a): controlled conditions include, as applicable, documented information defining the characteristics of the products, services or activities and the results to be achieved.
• 8.2.4: relevant documented information is amended when product and service requirements change.
• 8.3.2 j): design and development planning considers the documented information needed to show that design and development requirements have been met.
• 7.5.3.2: documented information of external origin that the organization needs for planning and operating the system is identified and controlled.

Where the standard says "information" rather than "documented information", A.6 says there is no requirement to document it, and gives clause 4.1 as its example. For clause 6.1, A.4 leaves it to the organization whether to retain documented information on how it determined its risks.

The extent depends on the organization

Several entries carry their own limits. Clauses 4.4.2 and 8.1 e) say "to the extent necessary". Clauses 7.1.5.2 a), 8.5.2 and 8.5.3 apply only when their condition arises, and 8.2.3.2 applies "as applicable". The design and development entries apply where clause 8.3 applies, under the applicability conditions in clause 4.3.

ISO 9001:2026

ISO 9001:2026, the sixth edition, was published in September 2026 and replaces ISO 9001:2015 including Amendment 1:2024. Under the transition requirements issued by Global ACI, ISO 9001:2015 certificates remain valid until 30 September 2029 at the latest.

The list above is the 2015 edition's. CAS will update it against the published 2026 text when its accredited certification moves to that edition.

What this means for you

If you are a quality manager: an auditor uses these clause numbers. Read each entry against your system.

If you are preparing for first certification: one objective of stage 1, under ISO/IEC 17021-1 §9.3.1.2.2 a), is to review your management system documented information.

If you are certified to ISO 9001:2015: this list stays the one your audits use until your transition to the 2026 edition.

This is generic information about the requirement, not advice on any particular management system.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch