Continuous Audit Evidence for UK Manufacturers in 2026

Every quality director in a UK plant knows the week before a certification or customer audit. Engineers stop engineering. Someone exports the calibration register, someone else chases the last three corrective actions, and a shared drive fills with folders named by date. The evidence existed all along, in the maintenance system, the quality system, the ERP and the inspection sheets on the shop floor. It just was not in one place, in the auditor's order, with the gaps already found. That scramble is a tax on the plant's scarcest resource, which is skilled people. The Health and Safety Executive's 2025 manufacturing statistics put around 2.7 million working days a year lost in manufacturing to work-related illness and injury alone, before a single hour of audit preparation is counted.

This guide is a worked plan for turning ISO 9001 and customer audit evidence, plus the safety records that sit beside it, into a standing pack generated continuously from systems the plant already runs. It is written for the COO or Operations Director who owns line efficiency, and for the Head of Quality measured on audit outcomes, first pass yield and retailer or OEM scorecards. The timing matters: ISO published the sixth edition of the standard, ISO 9001:2026, in September 2026, so every certified plant now has a transition audit somewhere ahead of it.

Scope, stated plainly. Our AI for manufacturing hub maps where AI pays across a plant, including downtime root cause and knowledge capture, and it deliberately left the worked version of a standing audit pack to this post. This post does not cover product-safety duties to consumers, which our guide to the product recall hotline under GPSR treats, and it does not cover governed agent teams for scheduling, which belong to Cognibl. It covers the evidence, and nothing makes a quality or safety decision on anyone's behalf.

This guide is shipped by the team behind DATS, the five-stage AI consulting system from DILR.AI, delivered by senior practitioners who ship code, not decks. Or see our AI operating model work, which covers governance, RACI and lifecycle, audit-ready by design.

What is continuous audit evidence for a UK manufacturer?

Continuous audit evidence is a manufacturer's quality and safety evidence, generated from the systems that already hold it and kept current every day, so that an ISO 9001, BRCGS or customer audit draws on a standing pack instead of a pre-visit scramble. The plant still owns every decision; the pack only shows what happened, where the record lives and which gaps remain open.

The idea is simple to state and harder to run. A certified plant already produces the raw material of its evidence: calibration certificates in a maintenance system, nonconformance reports and corrective actions in a quality system, training records in an HR platform, batch and traceability data in the ERP or MES, and inspection results on paper or tablets. What it rarely produces is the join. An auditor asks for one thing, such as proof that the measuring equipment used on a nonconforming batch was in calibration on the day, and the answer spans three systems and one filing cabinet.

A standing pack turns that join into a routine. Each evidence item is mapped once to the requirement it answers, the source system it comes from and the person who owns it. A scheduled process then pulls the current state, flags anything missing or out of date, and assembles the pack in the order the auditor works. When the auditor arrives, the quality team walks them through a pack it has already reviewed, rather than one it finished at midnight. Our enterprise AI consulting guide explains where this kind of placement sits among the others a regulated firm considers.

Why does audit evidence still get assembled the week before the auditor arrives?

Audit evidence gets assembled late because a UK plant's records live in systems built for production, not for audit, and the person who knows how they join is often a senior quality engineer. Manufacturers are investing in AI, but the knowledge to place it where it pays is thin, which makes evidence work easy to leave manual, on the people the plant can least spare.

The people problem is real. The Make UK and Autodesk report Future Factories Powered by AI, published in November 2024, found that 75% of UK manufacturers plan to increase AI investment in the next year, yet only 16% regard themselves as knowledgeable about AI, and only a third use AI specifically in their manufacturing operations. Budget intent is ahead of placement knowledge. That gap matches the wider picture: McKinsey's State of AI survey from November 2025 reports that 88% of organisations use AI in at least one function, while only around a third have it in production.

The second cause is structural. A maintenance system is designed to schedule work orders, not to prove that a gauge was in calibration when a particular batch was measured. A quality system holds nonconformances but not the training record of the operator who raised one. An ERP knows the batch but not the inspection sheet. Each system is correct about its own slice, and the audit asks a question that cuts across all of them. Without a mapped join, the cut is made by hand, under time pressure, each time.

The third cause is incentive. Between audits, evidence readiness is rarely a measured objective, so the pack can decay quietly. Records still get created, but links break, owners change roles and corrective actions sit open past their due date without anyone noticing until an auditor samples them. That is why the scramble repeats every cycle: the plant is not short of records, it is short of a standing view of them. The same pattern shows up in other regulated sectors, which is why our guide to AML onboarding evidence for accounting firms makes the same case under a very different regime.

What does ISO 9001:2026 change for a plant's evidence?

ISO 9001:2026 is the sixth edition of the quality management standard, published by ISO on 16 September 2026, replacing ISO 9001:2015, which ISO now lists as withdrawn. It is a targeted revision: the process approach and risk-based thinking stay, while quality culture, leadership, change management and a clearer split between risks and opportunities gain explicit weight in what a plant must evidence.

The ISO 9001:2026 standard page lists the new edition as published, Edition 6, 36 pages, developed by ISO/TC 176/SC 2, and states that ISO 9001 has more than one million certificates issued to organizations in 189 countries. ISO says the revision followed a global consultation in 2023. On the question every certified plant is asking, ISO's own guidance is short:

"Certified organizations will have to transition to the new version within the time frame set by their certification cycle."

That sentence, from ISO's page for the standard, ties the timing to each organisation's certification cycle, and the same page tells certified organisations to contact their certification body for further information. The certification body LRQA's publication-date update says a three-year transition period is anticipated, which would run to approximately September 2029, with the arrangements to be formally confirmed by the accreditation bodies, and that certification to ISO 9001:2015 remains valid during the transition. Treat September 2029 as an anticipated window until your own certification body confirms it in writing.

LRQA summarises the changes as quality culture and ethical behaviour embedded in the requirements, a separation of risks and opportunities with separate requirements for each, strengthened change management, a limited set of core terms inside the standard, and an expanded informative Annex A that adds no new obligations. For an evidence pack, three of these matter most:

1. Quality culture and leadership. Evidence that leadership drives quality is harder to pull from a system than a calibration date. Expect management review minutes, quality objectives and their tracking, and communication records to carry more weight.
2. Risks and opportunities, separately. A plant that keeps one combined register under the 2015 edition should expect to show how it determined and addressed each, which means two traceable sets of actions rather than one blended list.
3. Change management. Planned changes to the quality management system, and how they were communicated, monitored and reviewed, become a clearer audit trail. A plant that already logs engineering changes in a PLM or ERP has the raw records; it needs the link to the quality system.

The clause numbers in the 2026 edition should be read from the purchased standard, not from a summary, and this guide deliberately refers to requirement areas by name. A transition is the natural moment to build the standing pack, because the plant has to re-map its evidence to the new edition anyway. Doing that mapping once, in a form a system can maintain, avoids doing it by hand now and again at the next surveillance visit.

Which safety records belong in the same standing pack?

Safety records belong in the same standing pack because health and safety law in Great Britain already requires a plant to keep them, and an ISO or customer auditor will often sample them alongside quality evidence. Equipment inspection results under PUWER and the RIDDOR accident record are statutory, they bind the employer or responsible person, and they come from the same maintenance and HR systems.

Two duties are worth naming exactly, because they show how a record requirement already reads like an evidence specification. Under regulation 6 of the Provision and Use of Work Equipment Regulations 1998, every employer must ensure that the result of an inspection of work equipment is recorded and kept until the next inspection is recorded. Under regulation 12 of RIDDOR 2013, the responsible person must keep a record of reportable incidents and over-three-day injuries, and an entry must be kept for at least three years from the date on which it was made. Both sets of regulations apply in Great Britain; Northern Ireland has its own equivalents. Both duties bind the employer running the plant. Neither binds a software vendor or a consultancy, and no AI system discharges them; it only keeps the record current and findable.

The stakes are not abstract. The HSE manufacturing statistics for 2025, published in November 2025, report that 55,000 manufacturing workers sustained non-fatal injuries at work each year, averaged over 2022/23 to 2024/25, and that 101,000 were suffering from work-related ill health over the same period. There were 11 fatal injuries to manufacturing workers in 2024/25, on provisional figures, against an annual average of 17 over the five years to 2024/25. HSE estimates the cost of work-related ill health and injury in manufacturing at £1.7 billion in 2023/24, which is 7% of the £22.9 billion all-industry total that HSE's Costs to Britain statistics report.

Work-related illness81% (81%)
Workplace injury19% (19%)

The chart is the reason safety evidence belongs in the pack rather than in a separate binder. HSE's figures put illness, not injury, at the centre of the lost time, and illness evidence, such as health surveillance, exposure monitoring and occupational health referrals, is exactly the kind that sits in a different system from the maintenance log. A plant that joins them can show an auditor, and its own board, the whole picture from one place.

What does a standing evidence pack contain, area by area?

A standing evidence pack for a UK manufacturer contains, for each audit requirement area, the evidence item, the system it comes from, the owner who signs it off and the check that keeps it current. It covers quality management areas under ISO 9001:2026, customer or sector standards such as BRCGS or IATF 16949, and the statutory PUWER and RIDDOR records.

The table below is a starting map, not a complete one. Every plant's map differs by sector, customer and system estate, which is exactly why the first piece of work is to build it with the people who know where the records live.

Two rules keep the table honest. First, the pack shows evidence; it does not create it. If a record does not exist, the pack shows a gap with an owner, never a generated substitute. Second, the freshness check is a rule a person agreed, not a model's opinion. Those rules belong in the AI operating model, which covers governance, RACI and lifecycle, so that what counts as current is decided by the plant, documented and auditable in its own right.

How does AI generate the pack from systems the plant already runs?

AI generates a standing audit pack by reading the plant's existing systems through their own interfaces, matching each record to the requirement it answers, checking it against the freshness rules the plant agreed and drafting the pack with every gap flagged. The quality team reviews and signs it. Nothing replaces the maintenance system, the QMS or the ERP.

In practice there are four jobs, and only two of them involve a language model. Connection is ordinary integration: read-only access to the systems that hold the records, wherever those systems run, on premises or on a cloud platform such as Azure, AWS or Google Cloud. Rule checking is ordinary software: a calibration date is either in the past or it is not. The model earns its place in the other two jobs. It reads unstructured records, such as a free-text nonconformance description or a scanned inspection sheet, and maps them to the right requirement area. And it drafts the narrative that joins records into an answer, such as a summary of how a corrective action was verified, with a link to each underlying record so a person can check it.

That split is deliberate. The pack's value comes from being trusted, and trust comes from every statement in it being traceable to a record a person can open. A model that summarises without links, or fills a gap with a plausible sentence, destroys that trust in one audit. This is the same discipline behind the DATS solution for evaluation and observability of production AI agents, where the question is always whether an output can be checked, not whether it reads well.

The same design keeps the plant's information inside the plant. Process parameters, supplier quality data and nonconformance histories are commercially sensitive, and a plant may hold customer drawings under confidentiality terms. A plant should therefore set, as a design requirement, that records are read in place and not copied into a shared external model. The deeper case for keeping sensitive data inside a firm's own perimeter is made in our enterprise AI consulting guide, and the same principle applies to a plant's quality data.

A phased plan for one plant

A standing pack is best proven on one plant and one standard before it spreads. The phases below follow the DATS five-stage system, Discover and Diagnose, Prioritise and Place, Operating Model, Pilot to Production, and Scale and Run, and they map onto the three productised engagements described on our DATS services page.

Phase one: diagnose where evidence work actually costs the plant. The placement diagnostic runs four to six weeks, and the last two audit cycles are a sensible place to start. Which requests took longest to answer, which findings were raised, which records were missing or late, and whose time went into the scramble? The output is a ranked roadmap of where AI belongs and where it does not. For some plants the answer is that evidence is a lower priority than downtime root cause, and the diagnostic says so.

Phase two: map the requirements once. With the quality team, the requirement areas of the plant's standards are mapped to evidence items, source systems and owners, as in the table above. A transition to ISO 9001:2026 is a natural trigger, because the mapping has to be refreshed against the new edition in any case. This is also where freshness rules are written down and agreed.

Phase three: set the operating model. Who owns each evidence area, who reviews the draft pack, how often it runs and what happens when a gap is flagged are decisions, not technical settings. The operating model design, over six to ten weeks, covers governance, RACI and lifecycle, audit-ready by design. Our comparison of an AI operating model against a centre of excellence explains why this structure, not the tool, is what keeps a placement alive after the consultants leave.

Phase four: pilot on one standard. The first live pack covers one standard at one plant, usually the one with the nearest surveillance or transition visit. Success is measured in the plant's own terms: hours of quality-engineer time spent on audit preparation, open corrective actions past due, and findings raised at the visit. Those are illustrative measures to agree with the plant, not promised outcomes.

Phase five: scale and run. Once the first pack has survived a real audit, the same map extends to a customer standard, a second plant or the safety records. The twelve-month-plus execution office is the embedded delivery model for this stage, with production placements the client owns. DATS keeps a stated discipline of three shippable placements a year, with a named owner per ship, which keeps an evidence programme from sprawling into everything at once.

The same delivery logic underpins our AI execution office, the embedded delivery model a plant moves to once one pack has proven itself, taking it across the estate without losing the governance that made the first one trusted.

Where should AI stop in a quality or safety decision?

AI should stop before any decision that a standard or the law places with a competent person: releasing product, dispositioning a nonconformance, closing a corrective action, judging an inspection result or deciding whether an incident is reportable. In a standing audit pack, AI finds, maps, checks and drafts. A named person at the plant decides and signs.

This is not a technicality. Buyers in quality and food safety are right to distrust anything that sounds like AI making a product safety call on its own, and a black box with no evidence trail fails the first question any auditor asks. The boundary is easy to draw in practice. If an action changes the state of product, a record of conformity or a legal duty, it belongs to a person. If it changes only the state of the pack, such as marking an item current or flagging a gap, it can be automated against a rule the plant agreed.

Three failure modes are worth designing out from the start:

1. Silent gap filling. A model that writes a plausible sentence where a record should be is worse than no model, because it hides the gap. The pack must show a missing record as missing, with an owner.
2. Stale trust. A pack that was correct last month and is quietly wrong today is the same failure as the old scramble, with more confidence attached. Freshness checks run on a schedule, and the review step records who looked and when.
3. Unowned rules. If nobody can say who decided that a corrective action is overdue after a set number of days, an auditor will ask, and the answer must be a person and a document, not a configuration file.

The board-level version of this boundary, including what to ask before approving AI spend, is covered in our guide to board-level AI investment decisions. The plant-level version is simpler: the pack is a witness, never a judge.

How a standing pack fits with the rest of a plant's AI work

A standing audit pack fits as one placement among several on a plant floor, usually alongside downtime root cause analysis and maintenance knowledge capture, which are best treated as separate placements with their own owners. It shares their foundations, such as read-only access to plant systems and agreed rules, but it is scoped, measured and signed off on its own.

That separation matters for focus. A plant that tries to build one AI system for downtime, knowledge and audit at once risks shipping none of them. The AI for manufacturing hub sets out how those placements differ, and the DATS solution for enterprise knowledge retrieval is the closest neighbour, because SOPs and work instructions sit at the centre of both.

Other DILR lines touch the plant without overlapping this work. Where a plant has real call volume with suppliers or field service teams, Dilr Voice handles those conversations, and our guide to AI voice for manufacturer aftersales covers that use case. Where a plant runs agent teams for scheduling or inspection, Cognibl, from DILR.AI, is the line built for governing that agent work. Where operations and engineering teams need AI literacy before any of this lands, Dilr Academy provides the training. None of them produces audit evidence on the plant's behalf; that stays with the quality team and the pack it signs.

What is the best way to run continuous audit evidence in 2026?

The best way to run continuous audit evidence in 2026 depends on the plant's system estate and the standards it answers to. For most UK manufacturers it means mapping requirements once against ISO 9001:2026, reading records from existing systems, automating only freshness checks and drafting, and keeping every quality and safety decision with a named person.

There are honest alternatives, and some plants should choose them. A plant whose records already live in one modern QMS with strong reporting may get most of the value from that vendor's own dashboards and a disciplined review cadence, with no AI at all. A large multi-site group with an existing relationship may prefer one of the large consultancies, such as Deloitte, PwC, EY, KPMG or Accenture, particularly where the same firm already supports its wider assurance work. A plant with a strong in-house data team may build the integration itself and only need help with the operating model.

DATS fits a different case: a plant with records spread across a maintenance system, a QMS, an ERP and paper, a transition or customer audit on the horizon, and no spare senior engineers to run the scramble again. There, the value is in senior practitioners who ship code, not decks, working alongside the quality team, with production placements the client owns. Whichever supplier a plant considers, including AI specialists such as Faculty, Kainos or Slalom, a buyer should compare them on the same criteria: who owns the evidence afterwards, whether every statement links to a record, and whether the plant can run it without the supplier.

Frequently asked questions

Does ISO 9001 require software to manage audit evidence?

ISO 9001 does not prescribe software for managing audit evidence. The standard sets requirements for a quality management system, including documented information, and leaves the choice of tool to the manufacturer, whether paper, spreadsheets or a quality management system. Software, including AI, is a choice a plant makes to keep evidence current with less manual effort, not a condition of certification.

What the standard does require is that evidence exists, is controlled and can be retrieved. A plant that runs a standing pack still answers to the same requirements as one that does not; it simply answers faster and with fewer surprises. The ISO 9001:2026 standard page is the place to start for the edition itself.

Can a certification body rely on AI-generated evidence?

A certification body audits the plant's quality management system and its records, not the tool that assembled them, so an AI-drafted pack is acceptable only where every statement links to a real underlying record that a person at the plant has reviewed. An auditor can sample records directly, and a pack that cannot be traced back to source fails that sampling, however well it reads.

That is why the review and sign-off step is not optional. The auditor's question is always whether the evidence is genuine and controlled, and the honest answer comes from the records and the named owner, never from a summary. Plants transitioning to the new edition should confirm timing and expectations with their own certification body, as ISO's guidance advises.

Want to see this in production? Start with DATS AI consulting, read about our approach to placing AI inside regulated operations, see how an evidence pack for AI due diligence works in software, or browse more industry guides on regulated sectors.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.