ISO 26000:2010 is ISO's guidance on social responsibility, built on seven principles and seven core subjects, and it cannot be certified because it contains no requirements. ISO last reviewed and confirmed it in 2025, so the first edition of 2010 is still current.
This guide is for sustainability, compliance and HR leads who want to use ISO 26000 properly and need to explain how it differs from a certifiable standard such as SA8000.
What is ISO 26000 and who is it for?
The ISO 26000:2010 catalogue page describes it as guidance for every type of organisation, whatever its size or location. It runs to 106 pages and was published in 2010 after five years of negotiation. About 500 experts from government, industry, labour, consumer groups and NGOs drafted it.
The aim is to help organisations contribute to sustainable development and go beyond legal compliance, which the standard treats as a basic duty. It is meant to complement other social responsibility tools, not replace them.
Gulf readers can buy it as GSO ISO 26000:2021. The GSO store lists this Gulf Standard, approved on 1 July 2021, as an adoption of ISO 26000:2010.
What does ISO 26000 contain?
ISO's brochure "Discovering ISO 26000" sets out seven clauses and two annexes. Clauses 1 to 3 give the scope, terms and background, including guidance for small and medium-sized organisations. Clause 4 explains the seven principles.
Clause 5 covers two basic practices: recognising your social responsibility and identifying and engaging your stakeholders. Clause 6 explains the seven core subjects and their issues, each with related actions and expectations. Clause 7 covers putting it all into practice. Annex A lists voluntary initiatives and tools.
The seven principles are accountability, transparency, ethical behaviour, respect for stakeholder interests, respect for the rule of law, respect for international norms of behaviour and respect for human rights. ISO's training material places respect for the rule of law at 4.6 and respect for human rights at 4.8.
What are the seven core subjects, and what evidence shows you have addressed them?
Each core subject has its own subclause and a set of issues. The evidence column is AGS's suggestion of what an organisation using the guidance might keep. It is not text from the standard.
| Core subject | Subclause | Examples of issues | Evidence you might keep |
|---|---|---|---|
| Organizational governance | 6.2 | Decision-making processes and structures | Board or committee terms of reference, minutes, assigned responsibilities |
| Human rights | 6.3 | Due diligence, avoiding complicity, resolving grievances, discrimination | Due diligence assessments, grievance log |
| Labour practices | 6.4 | Conditions of work, social dialogue, health and safety, training | Employment policies, consultation records, training records |
| The environment | 6.5 | Pollution prevention, resource use, climate change, biodiversity | Aspects and impacts register, energy and waste data |
| Fair operating practices | 6.6 | Anti-corruption, fair competition, social responsibility in the value chain | Anti-bribery policy, supplier evaluations |
| Consumer issues | 6.7 | Fair marketing, health and safety, data protection, complaint resolution | Complaint records, privacy notices, product safety checks |
| Community involvement and development | 6.8 | Education and culture, employment creation, health, social investment | Community programme plans and results |
Why can't you be certified to ISO 26000?
ISO says plainly that ISO 26000 is not a management system standard. It is not meant for certification, regulation or contracts. ISO treats any offer to certify against it, or any claim to be certified, as a misuse of the standard.
So if a provider offers you an "ISO 26000 certificate", it is not certifying anything ISO recognises. The same applies when you assess suppliers who claim one.
ISO 26000's post-publication group issued a communication protocol on wording. It accepts phrases such as "based on", "inspired by" or using ISO 26000 as guidance. It advises against "certified", "verified", "in compliance with" or "meets the requirements of" ISO 26000.
How is ISO 26000 different from SA8000?
SA8000 is a certifiable standard for decent work. Its current edition, SA8000:2026, has requirements that certification bodies audit, and SAAS accredits those bodies. ISO 26000 covers far more ground, from governance to consumers and communities, but only as guidance.
Many organisations use both. ISO 26000 shapes the wider programme and SA8000 gives an audited result for labour conditions. Our SA8000:2026 guide explains its requirements and certification, and our SA8000 and ISO 26000 guide covers running the two together.
ISO also published IWA 26:2017 on using ISO 26000 inside ISO management systems. ISO now lists it as withdrawn.
How do you apply ISO 26000 in practice?
ISO's brochure suggests an order. Start with the background and the principles in clauses 3 and 4. Then recognise your social responsibility within your sphere of influence and identify your stakeholders (clause 5).
Next, decide which core subjects and issues are relevant and significant for you (clause 6). A food factory and a bank will weigh the environment and consumer issues very differently. Record the reasons for each decision.
Then integrate the priorities, using clause 7. That means building them into policies, culture and operations, building staff competence, communicating inside and outside, and reviewing progress regularly.
Two practical points help. Treat health and safety under labour practices with the same rigour as an ISO 45001 system, which our ISO 45001 guide covers. Write public statements with the protocol's wording, because a careless "ISO 26000 certified" claim undoes the credibility the work was meant to build.
How AGS can help
ISO 26000 Management System: 33 editable Microsoft Word documents. There is a social responsibility manual and ten procedures: one for each core subject, plus stakeholder engagement, document control, and communication and review. Forms include a stakeholder register and a materiality assessment. Eight checklists, two guidance notes and awareness training complete the set.
Frequently asked questions
Is a new edition of ISO 26000 on the way?
Not at the time of writing. ISO confirmed the 2010 edition in March 2025 after a systematic review, and it reviews standards about every five years.
Does ISO 26000 replace ESG or sustainability reporting?
No. It is guidance on behaviour, not a reporting framework. ISO publishes papers linking it with the GRI guidelines, the OECD Guidelines for Multinational Enterprises and the UN Sustainable Development Goals.
Can a small organisation use ISO 26000?
Yes. Clause 3 includes guidance for small and medium-sized organisations, and you decide which issues are significant for you.
What should we say in a tender or annual report?
Say that you use ISO 26000 as guidance, or that your programme is based on it. Avoid any wording that suggests certification, verification or compliance.
AGS provides independent documentation toolkits. This guide and the kit listed are not affiliated with, endorsed by or approved by ISO, GSO or SAI. Using them does not lead to any certification, because ISO 26000 cannot be certified.
Reviewed October 2026. Facts checked against the sources current at publication.
