Climate change
New sub-clauses on climate change, matching the amendment applied across the management-system standards in 2024.
ISO 37001:2025
The ISO 37001:2025 transition, in dates.
ISO 37001:2025 replaces ISO 37001:2016. The most urgent of the three. Published February 2025 with a two-year transition, so every accredited certificate must be transitioned by 28 February 2027 — and new certifications have had to be to the 2025 edition since 31 August 2026.
Key timescale
The dates that govern your certificate.
From the Global ACI transition requirements, mandatory for its accreditation body signatories and the certification bodies they accredit. Dates marked as passed are given because they explain where the transition already stands, not because anything remains to be done about them.
- February 2025 passed
ISO 37001:2025 published
Replaces ISO 37001:2016.
- 30 November 2025 passed
Accreditation bodies ready, CABs self-declare
Nine months from publication. Both the AB readiness date and the CAB self-declaration deadline fell here.
- 28 February 2026 passed
AB transitions of CABs complete
One year from publication.
- 31 August 2026 passed
New certifications to the 2025 edition only
Eighteen months from publication. This date has passed: initial certification and recertification may no longer be to ISO 37001:2016.
- 28 February 2027 deadline
All certificates transitioned
Two years from publication — not three, which is why this transition is tighter than the others. Transition happens at a scheduled audit such as a surveillance visit, or at a special transition audit, before this date.
What changed
What moved between editions.
The transition document describes the overall impact as minimal. The descriptions below say what moved; the standard’s own text is copyrighted and is not reproduced here.
Compliance culture
New content stressing the importance of compliance culture — the anti-bribery equivalent of the quality-culture addition in ISO 9001:2026, and the same kind of requirement in that it has to be evidenced in behaviour rather than asserted in a policy.
Conflicts of interest
Addressed explicitly, where the 2016 edition left more to interpretation.
The anti-bribery function
The concept has been clarified. If your anti-bribery function's authority, independence and reporting line were ever ambiguous, this is where that gets tested.
Harmonized structure
The latest harmonized structure introduced, and wording aligned with the other management-system standards where reasonable.
What to do
A transition is a gap assessment, not a rebuild.
Book the audit early
Certification bodies have to move a much smaller population than ISO 9001 or ISO 14001 certificates inside the same window, and audit capacity is finite. Organizations that wait until the deadline compete for slots with everyone else who waited. Folding the transition into a surveillance or recertification audit you were already having is the cheapest route.
Assess against the changes, not the whole standard
A system that conforms to the previous edition already meets most of ISO 37001:2025. The work is in the deltas listed above, not in re-reading the standard from clause 4.
Evidence culture, do not assert it
Both compliance culture and the newer behavioural requirements are evidenced in what people actually do. An auditor will look for it in practice, not for a policy statement saying the organization has it.
Check what else you hold
Three transitions are running at once, on different clocks. If you hold more than one certificate, the cheapest plan is usually a single combined transition planned against the earliest deadline — which is rarely the one you are thinking of.
Questions
Questions to resolve early.
When is the ISO 37001:2025 transition deadline?
28 February 2027. Unlike ISO 9001 and ISO 14001, which carry three-year transitions, this one is two years from a February 2025 publication — so the runway is considerably shorter and a good deal of it has already gone.
Can we still certify to ISO 37001:2016?
No. That date passed on 31 August 2026. Initial certification and recertification have had to be to ISO 37001:2025 since then. If you are certified to the 2016 edition, the remaining question is when your transition audit is booked, not whether.
What happens if we miss 28 February 2027?
The certificate against ISO 37001:2016 ceases to be valid. Recovering means a new certification rather than a transition, which costs more and takes longer. With a two-year window that is largely spent, the practical advice is to book now rather than to wait for the next scheduled surveillance visit and hope it falls in time.
How big are the changes?
Contained, but two need real attention. Compliance culture is new and, like quality culture in ISO 9001:2026, is evidenced in behaviour rather than in a policy statement. The clarified anti-bribery function tests whether that role's authority, independence and reporting line stand up. Climate change and the harmonized structure are mechanical by comparison.
Why is this transition shorter than the others?
Transition periods are set per standard, weighing the scale of the change against the number of certificates in circulation. ISO 9001 and ISO 14001 have more than a million and around 700,000 accredited certificates respectively and were given three years; ISO 37001's certified population is far smaller, and it was given two.
Other transitions running now
ISO 9001:2026Deadline 30 September 2029ISO 14001:2026Deadline 30 April 2029Source: Global Accreditation Cooperation Incorporated, Transition Requirements for ISO 37001:2025, Global ACI-TECH-3-TR-2027-02-28 (M), version 1.0, issued 10 July 2026. Dates are as that document states them. Other accreditation forums publish equivalent requirements — confirm the position with your own certification body, which is the only party that can commit to your audit dates.
Begin with context
Plan the transition against your audit calendar.
Tell us which certificates you hold, who certifies you and when your next surveillance or recertification audit falls, and we will tell you what the transition actually costs you.