ISO 22301 revision enters the pipeline: what business continuity teams should know

ISO is revising its international standard for business continuity management systems (BCMS). Its public ISO/CD 22301 project page identifies the next edition as a committee draft under development, intended to replace ISO 22301:2019. The project reached the close-of-comment-period stage on 10 May 2026. ISO does not show a confirmed publication date or a final set of changes on that page.

For organisations planning or maintaining certification, the published ISO 22301:2019, together with Amendment 1:2024 on climate action, remains the reference. A committee draft is an early stage in standards development, so it does not start a transition to a new edition. The useful response is to keep the current BCMS working and watch the ISO project for the next formal stage.

What is the status of the ISO 22301 revision?

ISO's project record shows a specific sequence: the revision project was approved in December 2025, the committee draft was registered on 12 March 2026, consultation began the following day, and the comment period closed in May 2026. As of this review, ISO lists the project at stage 30.60, within the committee phase. Later draft, approval and publication steps remain ahead if the project progresses normally.

The draft's existence is a signal to monitor, not a reason to advertise “ISO 22301:2026 certification” or announce a transition deadline. Organisations should wait for an official publication and the applicable certification-body or accreditation arrangements before setting an upgrade schedule. A final revision may differ from the committee text.

What should a current ISO 22301 BCMS already do?

ISO 22301:2019 sets requirements for an organisation to establish, operate, maintain and improve a system that prepares for, responds to and recovers from disruption. A BCMS connects management decisions to day-to-day capability: the team defines what is in scope, identifies time-sensitive products and services, studies the impact of an outage, assesses disruption risks, selects workable continuity arrangements and tests the plans.

Consider a UAE service provider that depends on a data centre, a subcontracted call centre, a building and a small number of key staff. Its business impact analysis should identify what must keep running, what interruption would mean for customers, which dependencies could fail together and what recovery priorities management has approved. A continuity plan then needs named decision makers, communications and feasible alternate arrangements. An exercise can reveal whether those arrangements actually work under the chosen scenario.

This is also where the 2024 climate action amendment belongs. The amendment is already published; it is separate from the future revision. A BCMS team should review whether climate-related conditions are relevant to its own operations or interested parties, and reflect relevant findings in its existing risk and continuity work. For one business, that might mean heat-related power interruptions; for another, severe weather affecting a warehouse or a critical supplier. The organisation should document its assessment, including when it judges a particular issue irrelevant to its BCMS scope.

How does this affect integrated resilience programmes?

Business continuity often shares owners, systems and evidence with information security, quality, health and safety, and UAE-specific resilience work. An outage caused by a cyber incident, for example, may involve an information security incident process and a business continuity response with different responsibilities. Keeping the handoff between those processes clear is useful now, regardless of how the revision eventually reads.

Organisations with more than one management system can review a few common terms: critical activities, service priorities, incident escalation, recovery objectives, suppliers and exercise outcomes. Agreeing who owns each record and how it is maintained can reduce contradictions between plans. This is sensible maintenance of an existing system; it is not a claim that the unpublished draft requires those particular changes. ISO's management system standards list identifies ISO 22301:2019 as using its harmonised structure, which supports integration with other management systems.

UAE organisations may also consider how their BCMS relates to national continuity expectations where these apply. Qdot has separate guidance for ISO 22301 consultancy and NCEMA 7000 consultancy. They should be mapped against each organisation's actual commitments rather than treated as the same certification route.

What should certified organisations do next?

1. Keep working to the published edition. Maintain ISO 22301:2019 requirements and the 2024 climate amendment. Continue agreed surveillance, internal audits, exercises, management review and corrective action under the current certification arrangements.

2. Refresh the business impact analysis. Check priority services, dependencies, key people, sites, suppliers, acceptable disruption and recovery targets against how the organisation operates today.

3. Test response arrangements. Use exercises to check decision rights, communications, alternate resources and recovery steps. Record gaps, owners and follow-up actions.

4. Align shared records. Where a BCMS connects with security, quality or national resilience programmes, confirm that roles and terminology are consistent and that changes to one plan reach the others.

5. Track the official project. Revisit ISO's draft status page as it moves through later stages. Ask the certification body about any transition only once an approved edition and relevant arrangements exist.

Qdot supports ISO 22301 BCMS implementation and certification readiness in the UAE, including impact analysis, response planning, exercises and internal review. An independent certification body performs the external audit and makes the certification decision. The immediate priority is a BCMS that works during disruption; the future edition can be assessed when ISO publishes it.

---

Sources: ISO, ISO 22301:2019 current published edition and revision link; ISO, ISO 22301:2019/Amd 1:2024 climate action amendment; ISO, ISO/CD 22301 stage 30.60 and lifecycle; ISO, management system standards list and harmonised structure; ISO, ISO 22313:2020 guidance on ISO 22301.