> ISO 9001:2026 customer communication on contingencies and disruptions (8.2.1) and new requirements for external providers (8.4.3): changes, steps, evidence.

Source: [https://docxpert.io/en/guides/iso-9001-2026/customers-and-external-providers](https://docxpert.io/en/guides/iso-9001-2026/customers-and-external-providers)

# ISO 9001:2026 customer communication (8.2.1, 8.4.3) | docxpert

## What changes

Our own summary; the licensed text of the standard prevails.
| Clause | Change compared with 2015 | Type |
| --- | --- | --- |
| 8.2.1 Customer communication | Communication includes information on contingency actions, explicitly including disruptions to the provision of products or services. | changed |
| 8.4.3 Information for external providers | Requirements communicated also cover the providers' interactions with customers and other relevant interested parties. | changed |

Back in 2015, 8.2.1 already required organizations to establish specific requirements for contingency actions where relevant. What is new is the explicit link to disruptions: what does a customer learn if you cannot deliver as agreed because of a fire, a cyber attack, a supplier failure or a pandemic? Who informs them, how quickly and through which channel?

Clause 8.4.3 highlights a gap in many supplier contracts. External providers often deal directly with your customers: installers, logistics providers, call centres, subcontractors. Their behaviour shapes your company's image. The 2026 edition requires you to cover these interactions too.

## Customer communication during disruptions

A good arrangement answers in advance the questions nobody can settle calmly in an emergency:

-   **Scenarios:** which disruptions are realistic, such as IT outage, loss of a key supplier, fire, staff shortage?
-   **Triggers:** when do you communicate, for example when a delivery delay of more than two days becomes likely?
-   **Responsibility:** who decides on the information and who talks to which customers?
-   **Content:** what is communicated: cause, impact, workaround, next update?
-   **Channels and contacts:** are customer contacts up to date and reachable even when your own systems are down?
-   **Contractual duties:** are there customer requirements for notification deadlines, for example in the automotive industry or for critical services?

Connect to existing plans

Many companies already have contingency plans for IT, for the supply chain or under NIS2. Add the customer communication section there instead of writing a new plan.

## Extend requirements for external providers

1.  1
    
    Identify providers in contact with customers
    
    Flag every provider in your supplier list who comes into contact with your customers or other relevant parties.
    
2.  2
    
    Define expectations
    
    Describe how these providers should act: availability, handling complaints, passing on customer information, data protection, identifying themselves as acting on your behalf.
    
3.  3
    
    Communicate
    
    Include the expectations in purchase orders, framework contracts or service provider handbooks.
    
4.  4
    
    Monitor
    
    Include behaviour towards customers in your [supplier evaluation](https://docxpert.io/en/glossary/supplier-evaluation), for example through complaints and customer feedback.
    

## A practical example

An IT service provider manages the networks of around a hundred mid-sized customers. A subcontractor handles part of the on-site work. When a ransomware attack takes down the ticket system, many customers only learn of the problem because promised call-backs never come, and the subcontractor gives contradictory answers on site.

Under the 2026 edition, the provider would have decided in advance that customers are informed within a few hours through a channel independent of the ticket system, who does this and which workarounds exist. The subcontractor would have received a requirement in the framework contract on how to speak to customers in such cases and where to pass on questions. Both are easy to arrange and easy to show in an audit.

## Evidence for the audit

-   an arrangement or contingency plan with a section on customer communication during disruptions,
-   an up-to-date customer contact list that is also available offline,
-   evidence from exercises or real disruptions, such as customer notices sent,
-   supplier contracts or purchase conditions with requirements for interactions with customers,
-   supplier evaluations that take this behaviour into account.

## Common mistakes

-   Thinking of contingency plans only technically and forgetting customer communication.
-   Keeping contact data in the system that fails in an emergency.
-   Limiting supplier contracts to price, date and quality of the goods.
-   Not carrying customer complaints about service providers into the supplier evaluation.

## Implementation in docxpert

The [template library](https://docxpert.io/en/features/template-library) includes templates for order handling from enquiry to delivery, for suppliers and external providers, for supplier evaluation and for contingency plans for supply continuity. There you add the sections on communication during disruptions and interactions with customers.

You distribute the approved arrangements with [read acknowledgement](https://docxpert.io/en/features/read-acknowledgement) to the people who act in an emergency. You record customer complaints about service providers in [deviation management](https://docxpert.io/en/features/deviation-management). The [transition check](https://docxpert.io/en/tools/iso-9001-2026-transition-check) shows how far you are on all changes.

## Frequently asked questions

Do I need a contingency plan because of 8.2.1?

The standard requires information on contingency actions in customer communication where relevant. A short section in an existing contingency or continuity plan is often enough.

Which suppliers does 8.4.3 affect?

Mainly external providers who come into contact with your customers or other relevant parties, such as installers, logistics providers, call centres or subcontractors.

Do I have to change supplier contracts?

Not necessarily the contracts. The requirements must, however, be communicated to the provider, for example in purchase orders, framework agreements or a service provider handbook.

How does 8.2.1 relate to NIS2?

NIS2 governs notifications to authorities and, in some cases, to recipients of services. If you are in scope, you can combine customer communication under 8.2.1 with your NIS2 processes.

## Read next

[ISO 9001:2026 transition checkRate the 17 changes, see your priorities and get the result as PDF – no sign-up.Learn more](https://docxpert.io/en/tools/iso-9001-2026-transition-check) [ISO 9001:2026 transitionClause-by-clause changes, transition dates to 2029 and a transition plan.Learn more](https://docxpert.io/en/guides/iso-9001-2026-transition) [Supplier evaluationCriteria, process and evidence for external providers under ISO 9001 8.4.Learn more](https://docxpert.io/en/glossary/supplier-evaluation) [Template library65 templates for 20 standards and regulations – tailored to your company, in English and German.Learn more](https://docxpert.io/en/features/template-library) [Planning of changesFour new planning points in 6.3 and a lean change procedure.Learn more](https://docxpert.io/en/guides/iso-9001-2026/planning-of-changes)

Free tool

## ISO 9001:2026 transition check

Rate the 17 changes, see your priorities and get the result as PDF – no sign-up.

[ISO 9001:2026 transition check](https://docxpert.io/en/tools/iso-9001-2026-transition-check)[Or try docxpert for 14 days](https://docxpert.io/en/trial)