ISO 26000:2010 is guidance on social responsibility that cannot be certified, while SA8000:2026, in force since 1 January 2026, is a certifiable decent work standard. Used together, ISO 26000 maps what social responsibility covers across the whole organisation and SA8000 provides audited proof of how workers are treated.
This guide is for HR, compliance and CSR managers who want one documented system that serves both.
What is the difference between ISO 26000 and SA8000?
The two documents come from different owners and do different jobs. ISO 26000:2010, "Guidance on social responsibility", is published by ISO and runs to 106 pages. ISO last reviewed and confirmed it in 2025, so the 2010 edition is still current. It explains seven principles of social responsibility in clause 4 and seven core subjects in clause 6, and clause 7 covers how to integrate them across an organisation.
SA8000 is not an ISO standard. Social Accountability International (SAI) owns it, and SA8000:2026 is the fifth issue since 1997. It has five foundational criteria (F1 to F5), ten management system clauses (M1 to M10) and seven decent work clauses (D1 to D7). SAI publishes the text on its SA8000 Standard page.
In short, ISO 26000 is wide and advisory. SA8000 is narrow, focused on workers, and audited.
Why can't an organisation be certified to ISO 26000?
ISO 26000 contains no requirements, so there is nothing for an auditor to check conformity against. ISO's own ISO 26000 page states that it is not a management system standard and is not intended for certification, regulatory or contractual use. ISO also treats any offer to certify to ISO 26000, or any claim to be certified, as a misuse of the standard.
If a body offers you an "ISO 26000 certificate", treat that as a warning sign. ISO publishes a Communication Protocol with suitable wording for describing how you use the guidance. A safe form is to say that your organisation uses ISO 26000 as guidance for its social responsibility programme.
How do ISO 26000's core subjects map to SA8000:2026?
SA8000 covers part of ISO 26000 in depth and leaves the rest untouched. The table shows where each core subject meets SA8000:2026. The mapping and the right-hand column are AGS's interpretation, not wording from ISO or SAI.
| ISO 26000 core subject (clause) | Where SA8000:2026 covers it | What SA8000 does not audit |
|---|---|---|
| Organizational governance (6.2) | M1 leadership commitment, M4 policy, M10 review | Board decisions on topics other than decent work |
| Human rights (6.3) | F1 to F5, M5 impacts and risks, M9 grievance mechanisms | Rights of people outside your operations and business relationships |
| Labour practices (6.4) | D1 to D6: children, association, recruitment, hours and wages, discrimination, health and safety | Career development and training beyond awareness (6.4.7) |
| The environment (6.5) | Not covered | Pollution, resource use, climate change and biodiversity (6.5.3 to 6.5.6) |
| Fair operating practices (6.6) | Partly, through due diligence on business relationships | Anti-corruption, political involvement, fair competition, property rights |
| Consumer issues (6.7) | Not covered. D7 privacy applies to personnel data only | All seven consumer issues, including consumer data protection |
| Community involvement and development (6.8) | M3 stakeholder involvement | Social investment, employment creation, education and culture |
The overlap is strongest on human rights and labour practices. That is where one set of records can serve both documents.
How do you run one system for ISO 26000 and SA8000?
Build the system on SA8000's management system clauses, because they are the part an auditor will test. SAI says it reorganised these clauses in 2026 to align with ISO Annex SL and the OECD due diligence guidance. That makes them a workable backbone for the wider ISO 26000 programme too.
Then widen three things rather than running two parallel systems:
- Your M5 context, impact and risk assessment. Add the ISO 26000 core subjects you judge relevant and significant, using the method in ISO 26000 clause 7.3.2, and record why you left any out.
- Your M3 stakeholder log. Include communities, consumers and suppliers, not only workers and their representatives.
- Your M10 management review. Report on the wider objectives as well as SA8000 performance, while keeping the SA8000 evidence separate.
Keep one grievance mechanism, one risk register and one document control procedure. A single grievance channel, open to workers and outsiders, avoids conflicting records.
Be strict about what you claim. The certificate covers SA8000 only. Your public reporting can describe ISO 26000 as guidance you follow, never as a standard you meet. For the environmental subject, our guide to ISO 17298 and biodiversity covers one area that ISO 26000 clause 6.5.6 points to.
What will an SA8000 auditor check in a combined system?
The auditor checks SA8000 only, but will see your whole system. SAI says the evaluation covers documents, working practices, worker interviews and operational records. Expect requests for payroll reconciled with time records, age verification files, recruitment fee records, social performance team election records, and the grievance log with outcomes.
ISO 26000 material does no harm in an SA8000 audit, as long as it does not contradict SA8000 records. A community investment policy is fine. A wage policy in your ISO 26000 programme that differs from the D4 living wage commitment would be a problem. Health and safety overlaps with ISO 45001, which our guide to ISO 45001 in the UAE covers.
Who certifies SA8000, and what changed in 2026?
SAI does not certify organisations or accredit certification bodies itself. Certification bodies are accredited by Social Accountability Accreditation Services (SAAS), which SAI describes as its independently managed division. SAI recognises only certificates issued by SAAS-accredited bodies, and lists them on its SA8000 accreditation page.
SA8000:2026 replaced SA8000:2014 on 1 January 2026. From 1 January 2027 every new certification and recertification must be to the 2026 edition, and remaining 2014 certificates are withdrawn on 1 June 2029. The switch happens only at a recertification audit. Our guide to SA8000:2026 requirements sets out the full transition timeline and the clause changes.
How AGS can help
The SA8000 and ISO 26000 Documentation and Training kit contains 73 editable Microsoft Word documents. A compliance matrix maps the set to ISO 26000:2010 and SA8000:2026. It also includes a manual, a scheme document and 20 procedures, two of them for the ISO 26000 subjects SA8000 does not audit. There are 27 forms, a records register, 15 checklists, 4 guidance notes and 3 training documents.
Frequently asked questions
Does SA8000:2026 refer to ISO 26000?
No. SA8000:2026 names the UN Guiding Principles, the OECD due diligence guidance and ISO Annex SL among the frameworks it draws on, but not ISO 26000.
Is ISO 26000 being replaced by a new edition?
Not at the time of writing. ISO confirmed the 2010 edition at its 2025 review, so it remains current.
Can a small organisation use both?
Yes. Both apply to organisations of any size. A small organisation can start with SA8000 and add the ISO 26000 core subjects that are significant for it.
Does buying documentation mean the organisation will be certified?
No. Documents are a starting point. Certification depends on how the system works in practice and on the certification body's audit findings.
AGS provides independent documentation toolkits. This guide and the referenced documents are prepared to support SA8000:2026 requirements and the use of ISO 26000:2010 as guidance. They are not affiliated with, endorsed by or approved by ISO, Social Accountability International, Social Accountability Accreditation Services or any certification body, and they do not guarantee any certification outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
