Guide
How long does ISO certification take? Typical timeline for 2026
Updated
The audits themselves take days. The months are the implementation before them, and the calendar time depends mostly on how much working process you already have and how much attention the project gets.
The typical path, start to certificate
- Gap analysis (week 1–2): compare what you do now against the standard. Output: a task list, and a realistic view of how far you are from ready.
- Implementation (months 1–4): close the gaps, document processes, train staff, run the system long enough to generate records. Auditors certify evidence, not intentions, so the system needs weeks of real operation behind it.
- Internal audit and management review: both are required by ISO 9001 before certification; they also catch the problems the external auditor would otherwise find.
- Stage 1 audit: the certification body reviews documentation and readiness, and books stage 2, typically a few weeks later.
- Stage 2 audit: the full audit. Minor findings get a corrective-action plan; the certificate is normally issued within a few weeks of a successful stage 2 (timescales vary by certification body).
Typical calendar times
| Starting point | Typical time to certificate |
|---|---|
| Small business, decent existing processes, dedicated project owner | 3–4 months |
| Small business, starting from scratch | 4–6 months |
| 50+ staff or multi-site | 6–12 months |
| Renewal or transfer between certification bodies | Weeks, driven by the new body's diary |
What actually sets the pace
- A named owner. Certification projects stall when they are everyone's second job; firms that assign real hours hit the short end of every range.
- Evidence accumulation. Records of the system operating cannot be rushed retroactively; this is the hard floor under any honest timeline.
- Auditor lead times. Certification bodies book stage 2 audits weeks ahead; if you have a tender deadline, tell providers up front, via the form, so they can confirm diary space before you commit.
- Findings at stage 2. Major nonconformities mean a follow-up before certification. The internal audit exists to make that unlikely.
Offers of accredited certification in days should be treated with the caution described in the UKAS accreditation guide: genuine certification requires real audits, and real audits take real time.