Quality Culture Shifts from Recommendation to Requirement: What ISO 9001:2026 and the FDA Demand, and How to Implement it in a Medical Device Company

On September 16, 2026, ISO 9001:2026 was published. For the first time, the world's most popular quality management standard requires management to promote quality culture and ethical behavior. The FDA said this even before. In this article: what exactly is written, why it is important for medical device companies, and how to translate it into actions, metrics, and evidence.

Three Factors, One Direction

In May, I wrote here about Quality culture: What is not seen in an audit. (Hebrew) The argument there was that it's possible to meet all the requirements of ISO 13485 and still not produce safe products, and that culture is revealed in people's daily habits, long before it appears in folders.

In June, I wrote about What the FDA is Really Looking For: Risk Management and Quality Culture in the QMSR Era. (Hebrew) At the RAPS conference, a CDRH representative explained that findings under the QMSR primarily stem from companies that have processes but do not implement them, and that senior managers are asked during audits how they measure quality in their company.

This week, a third factor joined.

ISO 9001:2026 introduced quality culture and ethics into a "shall" requirement.

When the FDA and the international standards organization reach the same conclusion, I call it the beginning of a trend.

I estimate that we will see this in additional standards and regulatory requirements we work with, and whoever starts now will get there prepared.

What Exactly Is Written

In the preamble to the Final Rule of the QMSR, in response to public comments, the FDA wrote that it expects medical device manufacturers, led by those with management responsibility, to adopt a quality culture as a central component in producing safe and effective devices. Quality culture is described there as a set of behaviors, attitudes, activities, and processes (89 FR 7496).

The QMSR came into effect on February 2, 2026.

According to the publicly quoted FDIS text of ISO 9001:2026, the topic appears in three places:

• Section 5.1.1: Top management shall demonstrate leadership and commitment with respect to the quality management system, including by promoting quality culture and ethical behaviour.

• Section 7.3: Persons working under the organization’s control shall be aware of the organizational quality culture and ethical behaviour.

• Note to Section 7.1.4 (Environment for the operation of processes): Some of the factors in the environment are influenced by the quality culture and ethical behaviour.

Annex A, which is informative, explains that quality culture and ethical behavior are expressed in shared values, attitudes, and actual behaviors, and refers to ISO 10010:2022. This is the guiding standard for understanding, evaluating, and improving quality culture, and it defines it as shared beliefs, behaviors, and values that support the organization's quality policy and objectives.

Two things to note:

1. The standard does not require a document, a written ethics policy, or a dedicated record.

2. And the verb chosen is "to promote," an ongoing action that is difficult to prove with a single signed document.

ISO 13485:2016 does not explicitly mention quality culture, but those who sell to the US market operate under the QMSR, which incorporates ISO 13485 by reference and adds this expectation.

And those whose component suppliers and subcontractors are certified to ISO 9001 will encounter the new requirement in the supply chain.

Why This Is Not Just an Audit Matter

The easy way is to write a "Quality Culture Policy," have the CEO sign it, and tick a box.

An auditor might accept this.

But the company will gain nothing from it.

Culture determines whether the data management receives is accurate. If employees are afraid to report a non-conformance, trends in management review look good but do not reflect reality. Decisions about resources, suppliers, and product release are made based on incomplete information. What is not reported today comes back later as a customer complaint, a recurring CAPA, or a recall, at a much higher cost.

Culture determines whether a problem is resolved or recurs. A CAPA closed with "employee re-trained" will recur, because the real cause remains: time pressure, unclear work instruction, unsuitable equipment. I wrote about this extensively in The Dirty Dozen: Twelve Factors Hiding Behind Human Error in Every CAPA. (Hebrew) Each such recurrence means another investigation, more engineering hours, and sometimes another batch under quarantine.

Culture determines how much trust is received from outside. Trust from a customer, an OEM partner, or a Notified Body in your people and processes is an intangible thing. Its return is very tangible: fewer extensive audits, fewer requests for additional evidence, shorter approval cycles, and less management time spent on explanations.

MedTech and the Bonus that Rewarded Silence

MedTech (full name withheld), manufactures a Class IIb device and sells it to Europe and the USA. It has ISO 13485 certification, MDR certification, and an organized CAPA procedure.

In the third quarter of 2025, the percentage of rejected products on the assembly line dropped to an exceptionally low level, which was presented in the management review as an achievement.

The Quality Manager decided to investigate and found that line operators were repairing defective parts themselves and not opening non-conformance reports.

The team's quarterly bonus was calculated based on output and rejection rate, so no one intentionally lied; rather, the system rewarded those who did not report.

What MedTech did:

• Removed the rejection rate from the bonus formula and replaced it with a metric of reported and timely closed non-conformances.

• The CEO stated at a team meeting, in the presence of the line managers, that reporting a problem is part of the job and no one would be penalized for reporting.

• In the following quarter, the number of non-conformance reports tripled. Management anticipated this and presented it in the management review as an improvement in transparency.

• Analysis of the reports pointed to one supplier responsible for most of the defects. The supplier underwent an audit, and the actual percentage of defects decreased within six months.

None of this required a new procedure.

It required a management decision, a change in one metric, and a line in the management review report.

This is the behavior that ISO 9001:2026 describes with the word "promote," and this is the evidence the FDA will look for when it asks management how it measures quality.

What I See in the Field

In audits, I encounter the same signs in different companies and of different sizes:

• Management review postponed several times because "now is not a good time." The entire organization understands the priorities.

• A CAPA closed repeatedly with "re-training," without anyone asking why the employee erred in the first place.

• A deviation documented as "one-time" for the third consecutive time.

• An employee explains an incorrect action with "that's how we've always done it and never received a comment."

• A manager searches for the relevant procedure during the audit, and it turns out they never opened it.

None of these signs will appear as a finding under a "quality culture" clause.

They will appear as findings in management review, CAPA, training, and document control.

What they have in common is the management decision behind them, or the decision that was not made.

From Requirement to Action

The best way is to work according to a method:

What is the requirement, is there already a suitable mechanism, what is the minimum that addresses it, and what evidence will exist in the end.

In companies with a quality system based on ISO 13485, most of the infrastructure already exists, and the main missing piece is its connection to culture.

 There is no need for a separate "quality culture" procedure, and I recommend not writing one.

A separate procedure turns culture into another process of the Quality department, and the requirement is explicitly directed at top management.

One document is worth the investment, and it is not a procedure.

Code of Conduct: The Document that Defines How to Behave

In large companies, it's called a Code of Conduct, an ethical code, or business conduct principles. At Philips, for example, it's called General Business Principles: every new employee receives it, commits to it, and undergoes training on it, and it also applies to suppliers.

This is a policy document that defines what the organization expects from everyone working within it, from the CEO to the line worker.

A small medical device company doesn't need 40 pages. 2-4 pages are sufficient, written in simple language with examples.

For a medical device company, I would include the following topics:

• Data integrity: Do not change, omit, or "arrange" test results, production records, or clinical data.

• Problem reporting: Every employee is allowed and expected to raise a quality or safety issue, and no one will be harmed for reporting in good faith. With the name of a person to contact.

• Product release: A product that does not meet requirements is not released due to customer pressure, sales targets, or management.

• Reporting to authorities and Notified Bodies: Report truthfully, timely, and completely, including when the information is inconvenient.

• Conflict of interest and relations with medical professionals, distributors, and suppliers: Gifts, payments, and benefits.

• Information retention: Medical information, personal information, and trade secrets.

The document is approved by the CEO, signed upon new employee onboarding, and refreshed annually.

It meets the ethics requirement in section 5.1.1, provides concrete content for the awareness requirement in section 7.3, and serves as a good basis for supplier requirements.

Quality Culture Starts with Onboarding

A new employee understands what is truly important in the company during their first few weeks.

If all they hear about quality is a presentation from the Quality department and signing a list of procedures, that's the message they take with them.

Most companies already have a documented onboarding program (ISO 13485 Section 6.2), and a quality culture chapter can be added without building something new:

• A conversation with the direct manager, not just the Quality department. The manager explains what quality looks like in the employee's specific role.

• A real company story. A complaint, a CAPA, or a shipment stop that prevented a problem. One such story will be remembered more than any slide.

• How to raise a problem and what happens next. Whom to contact, through which channel, and within what timeframe a response is received.

• Review of the Code of Conduct and signing it.

• Check after 30 days. One question to the employee along the lines of: "If you see a problem with a product tomorrow, what will you do?" The answer shows if the onboarding worked, and it is also good evidence for an audit.

At MedTech, for example, a single line was added to the onboarding form: "Quality culture discussion with direct manager," with a date and signature. After 30 days, the Quality Manager asks the employee the above question and records the answer on the same form.

Metrics Worth Starting to Measure

Quality culture cannot be measured directly. The behaviors it produces can be measured.

These are the metrics I recommend choosing from, and 3 are sufficient for the first year:

• % of non-conformance reports opened by employees outside the Quality department.

• Time from problem discovery to reporting.

• Percentage of corrective actions closed with re-training as the sole action.

• Recurrence rate of problems already closed.

• How many procedures were updated this year due to field feedback, versus due to an audit finding.

• How many management reviews or planned review meetings were postponed.

• How many preventive actions were opened based on trend analysis, without a preceding failure.

Metrics presented in management review that do not lead to a decision promote nothing.

I wrote about this in Every Topic in the Management Review Must Conclude with a Decision.(Hebrew)

Self-Assessment: What Level Are You At?

In the article on the FDA, I presented the five levels of quality culture described by Kari DiPietro, Chief Quality Officer of Integra LifeSciences, at the RAPS conference.

41% of participants rated themselves at level 2, and only 3% at level 5. Here is a version you can work with, with a test question for each level:

 How to use: Go through the questions from bottom to top (from question 5 to question 1).

Your level is the highest one where you can answer "Yes" with an example from the last six months, provided that the levels below it also exist.

And one request: don't answer alone.

Give the questions to the R&D manager, the production team leader, and the CEO, and compare the answers.

A large gap between the answers is a finding in itself, and it's worth presenting it in the management review.

Where to Start in the Coming Quarter

1. Add a "Quality Culture" section to the upcoming management review, with three metrics from the list and at least one decision.

2. Write a short Code of Conduct, or update the existing one to cover data integrity, problem reporting, product release, and reporting to authorities.

3. Add a quality culture chapter to the onboarding program: a discussion with the direct manager, signing the Code of Conduct, and a check after 30 days.

4. Review CAPAs closed in the last year and count how many were closed with re-training only.

5. Examine team objectives and reward mechanisms to ensure there is no incentive to conceal problems.

6. Administer the self-assessment to three people outside the Quality department and compare answers.

Each of these steps relies on a mechanism already existing in the system.

The Code of Conduct is the only one that requires writing a new document, and even that is a matter of a few days' work.

What About the Audit?

In an FDA audit, senior managers will be asked how they assess and measure quality in the company and what their plan for improvement is.

If you are preparing for such an audit, there is a chapter on it in The Guide to a Successful FDA Audit in the QMSR Era – The Ultimate How-To with a Cheat Sheet for Every Topic.(Hebrew)

In an ISO 9001:2026 audit, the auditor will interview employees about their awareness of culture and ethics and look for evidence that management is promoting them.

In both cases, companies that follow the table above will be able to show reports, metrics, and examples, and will not need to prepare anything special.

If you'd like to review this together for your company, I am available.