Today the body must run preventive action. The FDIS foreword replaces this clause with actions to address risks and opportunities, but the new wording is not public.
What applies today
Under the 2012 edition the body must have procedures for preventive action that remove the causes of potential nonconformities. The action must be in proportion to the likely harm of the possible problem. The procedure must define how the body identifies potential nonconformities and their causes, evaluates whether action is needed to prevent occurrence, determines and implements the action, records the results and reviews the effectiveness of what was done. The procedure for preventive action does not have to be separate from the corrective action procedure.
Why it matters
This is the one clause where the public FDIS record states a substantive change. The foreword says that preventive actions are replaced by actions to address risks and opportunities, and the title appears in the public contents. The new requirement text is not held, so this page does not invent it. What a body can do now is keep the current preventive action process compliant and prepare the evidence that a risk and opportunity process will need: a method, a register, decisions, actions and a review of effectiveness. The transition should not wait for the published wording, because the management review, internal audit and procedure changes take time.
The FDIS foreword states that the 2012 clause on preventive actions is replaced by a clause on actions to address risks and opportunities, and the public contents carries that new title at 8.8. The new requirement wording is not held. This page states the 2012 requirement and the preparation a body can do now; it does not invent the replacement text.
Where this clause lands in the revision
This is the one clause the public foreword says is replaced. The 2012 requirement above stays live until the new edition is published, and a risk and opportunity register is the preparation that can start now. A first artefact an assessor commonly asks for here is preventive action procedure covering the five steps. The party this touches first is Top management and the management system owner, with every process owner as a contributor.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Current procedure | Preventive action procedure covering the five steps |
| Current records | Preventive actions with cause, action and effectiveness review |
| Preparation | Risk and opportunity register with method, owner and review date |
| Decision trail | Management review and audit records that treat the replacement as transition work |
One common question. The assessor under the current edition commonly asks for a preventive action and its effectiveness review. After publication the same assessor is likely to ask for the risk and opportunity method and how actions were chosen. A register with no decisions will not be enough.
Common failures
- Preventive action is a sentence in the manual and no live record
- The risk register is a commercial risk register and does not touch certification
- The transition plan waits for the published text and does nothing
Prepare before publication
Open the current preventive action file and add a risk and opportunity register beside it. Record the first three risks, the actions and the review dates.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 8.8 has no separate date.
Cross-references
8.1 Management system options · 8.5 Management review · 8.6 Internal audits · 8.7 Corrective actions · 4.2 Management of impartiality
Source
Source for 8.8: ISO/IEC 17065:2012, Clause 8.8, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.