Introduction
Clause 8 is where the quality management system (QMS) stops being a plan and becomes the product or service a customer receives. Clauses 4 through 7 set context, leadership, planning, and support. Clause 8 puts them to work.
It also prevents the failures that cost organizations the most: unclear customer requirements, uncontrolled suppliers, inconsistent service delivery, premature release, and nonconforming outputs that go undetected.
With 1,611,729 ISO 9001 certificates worldwide reported for 2025, auditors encounter Clause 8 weaknesses constantly.
This guide covers Clauses 8.1 to 8.7, the evidence auditors expect, implementation priorities, and how to separate required controls from needless paperwork.
Key Takeaways
- Clause 8 controls the flow from customer requirements to purchasing, delivery, release, and nonconformance handling.
- Tailor controls and documented information to your processes, risks, products, and services.
- Auditors want objective evidence: requirements understood, processes controlled, outputs verified, problems contained.
- Planning, support, evaluation, and improvement must back Clause 8, or operations controls fail on their own.
What Is ISO 9001:2015 Clause 8, and Why Does It Matter?
Clause 8 is the "Do" step of the Plan-Do-Check-Act cycle. According to ISO/TC 176, Clauses 4–7 are Plan, Clause 8 is Do, Clause 9 is Check, and Clause 10 is Act. What you plan earlier gets executed here, and what happens here feeds performance evaluation and improvement.
The operational sequence
The clause follows the life of an order:
- Understand and review customer requirements (8.2)
- Plan the work (8.1)
- Design where applicable (8.3) and manage external providers (8.4)
- Deliver the product or service (8.5)
- Release the output (8.6)
- Control anything that fails (8.7)
Manufacturing and services
Clause 8 applies to every organization type. A machine shop shows it through in-process and final inspection records.
A consulting or engineering firm shows it through a documented service completion review, where a qualified person confirms deliverables met the agreed scope before the client sees them. Different evidence, same control.
ISO 9001:2015 Clauses 8.1–8.4: Planning, Customer Requirements, Design, and External Providers
8.1 Operational planning and control
Plan, implement, and control the processes needed to meet requirements. Define:
- Acceptance criteria for processes and outputs
- Resources required to run those processes
- Process controls and related risk actions
Keep documented information to the extent needed to show that processes ran as planned.
8.2 Requirements for products and services
Before you commit to supply, you must know what you are committing to. This clause covers:
- Customer communication
- Customer, statutory, regulatory, and internal requirements
- Review of requirements before acceptance
- Control of changes to agreed requirements
Typical evidence includes quotations, contracts, purchase orders, statements of work, and change confirmations. Retain the review results and any new or changed requirements.
8.3 Design and development
When you design or develop products or services:
- Plan the design and development stages
- Define design inputs
- Run reviews, verification, and validation
- Control outputs and changes
- Keep the required records
Non-applicability must be defensible. Per ISO/TC 176 guidance, lacking design activity or responsibility can support exclusion. Outsourcing design alone does not, because you still need adequate control.
8.4 External providers
Controls should match the provider's effect on your ability to meet requirements. A janitorial vendor and a heat-treat subcontractor should not face the same scrutiny.
A risk-based example for a critical subcontractor:
- Approval: documented criteria covering capability, quality history, and certifications, not price alone
- Purchase requirements: specifications, inspection needs, and acceptance criteria on the purchase order
- Incoming verification: inspection or certificate review before use
- Monitoring: on-time delivery and defect rates tracked per provider
- Reassessment: scheduled re-evaluation with actions retained
ISO 9001:2015 Clauses 8.5–8.7: Delivery Controls, Release, and Nonconforming Outputs
8.5 Production and service provision
8.5.1 Controlled conditions. Provide:
- Current work instructions or service criteria
- Competent personnel
- Suitable infrastructure and equipment
- Monitoring and measurement resources
- Validation where results cannot be verified afterward, such as welding or real-time services
8.5.2 Identification and traceability. Identification shows output status, such as awaiting inspection or approved. Traceability goes further, tracing lots, serial numbers, or operators. Maintain it when customers, law, regulations, or your own controls require it.
8.5.3 Customer or provider property. Identify, verify, and protect customer materials, drawings, equipment, or data. If property is lost or damaged, tell the owner and keep a record.
8.5.4 Preservation. Cover handling, packaging, storage, contamination prevention, and transport. For service firms, that includes protecting service records.
8.5.5 Post-delivery activities. Warranty, maintenance, installation, and support obligations depend on the product's nature, use, and lifetime, plus customer feedback.
8.5.6 Control of changes. Review and authorize operational changes before they take effect. Update instructions, tell affected personnel, and record what changed, who approved it, and why.
8.6 Release of products and services
Finish planned inspections, tests, or service checks before release. Retain evidence of conformity against acceptance criteria, plus the identity of whoever authorized release.
8.7 Control of nonconforming outputs
When an output fails, work through these steps:
- Identify and segregate it so it cannot be used or delivered by mistake.
- Decide the disposition: correction, rework, return, suspension, or an authorized concession.
- Notify the customer when necessary.
- Verify conformity after correction.
- Record the nonconformity, actions taken, concessions, and the decision authority.
How to Implement Clause 8 and Prepare Evidence for an ISO 9001 Audit
Map the workflow first
Map your order-to-delivery or request-to-service flow. Mark where each Clause 8 requirement applies, document inputs and outputs for each step, and record justified non-applicability decisions, such as design and development.
Evidence checklist
- Requirement reviews and change records
- Operational plans with acceptance criteria
- Supplier evaluations and purchase requirements
- Work instructions and competency records
- Equipment and measurement records
- Change approvals
- Release records showing the authorizer
- Nonconformance records with disposition and verification
Avoid paperwork for its own sake
ISO 9001:2015 does not prescribe six universal procedures. That was a 2008-era idea. The ISO documented information guidance says the extent depends on organization size, activities, process complexity, and personnel competence.
Don't write procedures employees won't follow. An unused procedure creates audit findings, not control.
Common audit weaknesses
- Accepting orders without confirming capability
- Applying identical supplier controls at every risk level
- Releasing outputs with no objective evidence
- Failing to control changes
- Correcting nonconformities without recording or verifying the fix
Where Synergistic Systems fits
Synergistic Systems, a Plano, Texas ISO consulting firm founded in 2000, builds modular documentation, organizational, and training systems. The team works with your people to translate complex operations into practical documented processes. A cloud-based quality management intranet hosts controlled documents, records, audits, and corrective actions, so evidence stays accessible when the registrar arrives.
Conclusion
Clause 8 is the operational core of ISO 9001:2015. It turns customer requirements and QMS plans into controlled, verifiable results.
Assign process owners, scale controls to risk, keep records people actually use, and feed what you learn back into Clauses 9 and 10. Documentation should serve the work, not the other way around.
Frequently Asked Questions
What is clause 8 in ISO 9001:2015 (Operation)?
Clause 8 covers operational planning and control, customer requirements, design and development, external providers, production or service provision, release, and nonconforming outputs. It is the "Do" stage of the QMS.
What does clause 8.1 of ISO 9001:2015 address?
It requires you to plan, implement, and control the processes needed to meet product and service requirements. That includes resources, acceptance criteria, risks, and the documented information needed to show processes ran as planned.
What does clause 8.7 of ISO 9001:2015 require organizations to do?
You must identify and control nonconforming outputs and prevent unintended use or delivery. Determine and record the disposition, then verify conformity after any correction.
What are the 6 mandatory procedures for ISO 9001?
There are none under ISO 9001:2015. That checklist belongs to the 2008 edition. Required documented information now depends on your processes, risks, and applicable requirements.
When does ISO 9001:2015 Clause 8.3 apply?
It applies whenever you design or develop products or services. Exclusion needs a scope-based justification and cannot hide real design activity.
What evidence do auditors typically look for under Clause 8?
Expect requirement reviews, operational plans, supplier records, work instructions, and production or service records. Auditors also check change approvals, release authorization, and nonconformance records, ideally where the work happens.
