ISO 9001 Clause 8, Operation, is the largest clause: it controls how you make and deliver product, operational planning (8.1), customer requirements (8.2), design (8.3), external providers (8.4), production and service (8.5), release (8.6), and nonconforming outputs (8.7).
Clause 8 is where the quality management system meets the actual work. Everything before it, context, leadership, planning, support, exists to make Clause 8 run right. It is also the longest clause in the standard by a wide margin, because it walks the whole path a product takes from a customer inquiry to a shipped, conforming order. If your certificate covers manufacturing, most of your audit time is spent here.
What does ISO 9001 Clause 8 cover?
Clause 8 has seven sub-clauses, and they follow the flow of an order through the plant. Read as a value stream, they make sense: plan the work, agree what the customer needs, design it if you design, buy what you outsource, make it under control, check it before it ships, and handle anything that does not conform. Each sub-clause is a control point where quality is either built in or lost.
What do 8.1 and 8.2 require for planning and customer requirements?
Clause 8.1, operational planning and control, requires you to plan and control the processes needed to make product: set requirements and acceptance criteria, determine the resources, control the processes to those criteria, and keep enough documented information to show it was done as planned. It also requires you to control planned changes and review the consequences of unintended ones, and to control any outsourced processes. This is where the plan from Clause 6 becomes production reality.
Clause 8.2, requirements for products and services, is about getting the deal right before you commit. It covers customer communication, determining the requirements for the product (including statutory and regulatory ones and any the customer did not state but that are necessary), and reviewing those requirements before you accept the order to confirm you can meet them. The discipline here prevents the most expensive kind of defect: building exactly what was ordered when the order itself was wrong. Where requirements change, 8.2 requires the change to reach everyone affected, with documents updated.
What does Clause 8.3 design and development require?
Clause 8.3 applies only if your organization designs product. If you build strictly to customer prints, you can declare 8.3 not applicable in your scope statement with a justification. If you do design, 8.3 requires a controlled design process: planning the stages, defining inputs (requirements, regulations, prior similar designs), applying controls like design reviews, verification and validation, producing outputs that can be checked against inputs, and controlling design changes. The point is that a design gets checked at each stage against what it was supposed to do, so problems are caught on paper rather than in the field.
How do you control external providers (8.4)?
Clause 8.4 controls the processes, products, and services you get from outside, suppliers, contractors, and outsourced processes. The requirement is proportional control: the extent to which you control an external provider should match how much their output affects your product. You determine and apply criteria to select, evaluate, monitor, and re-evaluate providers based on their ability to meet requirements, and you keep records of the results.
Three things trip plants up here. First, you have to define what the provider must deliver and communicate it clearly, specs, approvals, competence, and any verification you will do at their site or yours. Second, you have to verify that what arrives actually conforms, whether by incoming inspection, a first article inspection or supplier data. Third, outsourced processes, heat treat, plating, calibration, are still your responsibility to control; sending work out does not send out the accountability. A structured supplier quality management program is how mature plants keep 8.4 under control instead of firefighting bad lots.
What does production and service provision (8.5) require?
Clause 8.5 is the heart of manufacturing control, and it packs several requirements. 8.5.1 controls production itself: available work instructions and specifications, suitable equipment, monitoring at the right points, competent people, and validation of any "special process" whose output cannot be fully verified after the fact (welding, sterilization, some coatings). 8.5.2 covers identification and traceability, being able to say what a product is and, where required, trace it through the process. 8.5.3 protects property belonging to customers or external providers. 8.5.4 covers preservation, so product does not degrade in handling and storage. 8.5.5 covers post-delivery activities like warranty and service. And 8.5.6 controls changes to production so they are reviewed and don't quietly introduce defects.
This is the sub-clause where paper-based plants lose the most ground. When work instructions live in a binder that may or may not be current, when traceability depends on a handwritten log, when a process change reaches one shift but not the next, 8.5 is nominally met and actually leaking. Digital, current instructions and captured production records at the station are how the control the clause describes becomes the control that actually happens.
How do release (8.6) and nonconforming outputs (8.7) work?
Clause 8.6, release of products and services, requires that you verify product meets acceptance criteria before it is released to the customer, and that you keep records showing it was released by an authorized person against those criteria. Nothing ships until the planned checks pass, and you can prove who released it. This is the gate at the end of the line.
Clause 8.7, control of nonconforming outputs, is what happens when something fails, at incoming, in process, or at release. The requirement is to identify and control nonconforming output so it cannot be used or delivered by mistake, then take appropriate action. The standard names the options: correct it, segregate/contain/return it, inform the customer, or obtain authorization for use under concession. You keep records of the nonconformity, the action, any concession, and who decided. A disciplined non-conformance report process is how 8.7 stays a control rather than a scramble.
How do you walk an order through Clause 8 in control?
The cleanest way to see Clause 8 is to follow one order from inquiry to shipment and name the control at each step.
- Review the requirements before accepting (8.2). Confirm you understand what the customer needs, including unstated and regulatory requirements, and that you can meet it. Do not accept an order you cannot fulfill.
- Plan the job (8.1). Determine the acceptance criteria, resources, and process controls, and set what records you will keep.
- Control what you buy (8.4). Order from evaluated providers against clear specs, and verify incoming material conforms before it enters production.
- Make it under control (8.5). Run with current work instructions, competent operators, monitoring at the right points, traceability where required, and controlled changes.
- Verify before release (8.6). Confirm the product meets acceptance criteria and record authorized release. Nothing ships on assumption.
- Handle anything nonconforming (8.7). Contain it, disposition it, record it, and route recurring failures into corrective action.
Walk any real order against those six steps and gaps show up fast: the order accepted without a proper review, the supplier nobody re-evaluated, the release with no record. Closing them is what turns Clause 8 from a document into control.
The numbers behind the operation clause
Clause 8 is where most audit time and most real risk live.
- Clause 8 is by far the largest clause in ISO 9001:2015, with seven sub-clauses covering the entire product realization path from customer requirements to control of nonconforming outputs (ISO 9001:2015).
- Control of externally provided processes, products, and services (8.4) consolidated and expanded the purchasing and outsourcing requirements of earlier versions, reflecting how much modern quality depends on the supply base (ASQ, ISO 9001).
- ISO 9001 is held by organizations across manufacturing and services in more than 180 countries, and Clause 8 is where the sector-specific reality of each certificate is controlled (ISO, The ISO Survey).
The consistent lesson from Clause 8 findings is that control described on paper and control that happens on the floor are two different things, and the gap is widest wherever the plant runs on binders and handwritten logs. Harmony's operations intelligence closes that gap: current work instructions, captured production and quality records, and traceable exceptions at the station, without ripping out the systems you already run. See a plant that did it in our customer story. Clause 8 depends on the resources and competence from Clause 7 and its nonconformities feed the corrective action of Clause 10. Automotive suppliers face stricter versions of all of this, covered in our IATF 16949 guide, and most plants manage the records in dedicated QMS software.