ISO 56001 vs ISO 56002: what's the difference?

Choose ISO 56001 when you want, or are asked, to show an outside party that your innovation management system meets an international standard, because it is the one you can be certified against. Choose ISO 56002 when you want advice on how to build and improve that system without an audit at the end, because it is guidance, not requirements. Most organisations that do this well use both: ISO 56001 to know what must be in place, ISO 56002 (and the rest of the ISO 56000 family) for ideas on how to do it.

The plain answer

Both standards come from the same ISO technical committee, ISO/TC 279, and both describe an innovation management system: the way an organisation sets direction for innovation, supports it, runs it and learns from it. The difference is the verb.

• ISO 56001:2024 sets out requirements. Its wording is "shall". It was published in September 2024 and is the first standard in the family that an accredited certification body can audit and certify.
• ISO 56002:2019 gives guidance. Its wording is "should". It was published in July 2019 and was the main international reference for innovation management systems until ISO 56001 arrived. It is not intended for certification. ISO lists it as under revision, with a new edition being developed to align with ISO 56001.

Both sit on top of ISO 56000, which defines the vocabulary and sets out eight innovation management principles. Its second edition was published in January 2025 and was aligned with ISO 56001.

This article does not reproduce or paraphrase clauses from either standard. If you are implementing, buy the documents from ISO or your national standards body and read them in full. For a practitioner's walk-through of the certifiable standard itself, see ISO 56001 explained for practitioners.

Side by side

Because both follow ISO's common structure for management system standards, an organisation that already runs ISO 9001 or ISO 14001 will recognise the shape. Certification bodies make the same point: ISO 56001 can be integrated with other management systems rather than run as a separate bureaucracy.

When ISO 56001 fits

ISO 56001 earns its place when outside assurance matters.

1. A regulator, parent body or major client expects evidence. Certification gives a recognised, independent answer to "how do you manage innovation?" instead of a slide deck.
2. You already run certified management systems. The audit rhythm, internal audit and management review are familiar. Adding innovation to an integrated system is less work than starting from nothing.
3. Your innovation work has outgrown goodwill. When several units run projects with no shared way of deciding what to fund, stop or scale, a requirements standard forces those decisions to be defined and owned.
4. You want a fixed bar to work towards. Some leadership teams move faster with a clear target and a date.

Be clear about the commitment. As with other management system certificates, certification is not a one-off. It typically involves an initial audit in two stages, surveillance audits during the certificate's life, and recertification at the end of the cycle. Ask your chosen certification body for their exact process.

When ISO 56002 fits

ISO 56002 earns its place when you are still building.

1. You are early. If innovation is a handful of projects and a willing leader, guidance helps you think about culture, leadership and process before you think about audits.
2. You need to explain the "why". Requirements tell you what an auditor will look for. Guidance helps you convince a sceptical executive team that each element is worth having.
3. You do not need a certificate. Many organisations will never certify and do not need to. A well-run system without a certificate still beats a certified one that nobody believes in.
4. You want to self-assess. Guidance is a gentler basis for an internal review of where you are. Our innovation maturity assessment pillar explains how to run one.

Mixing them

The most useful approach treats the two standards as one conversation.

1. Start from your own objectives, not the clause list. Decide what innovation is for in your organisation and how you will know it is working. A KPI tree is a good way to make that concrete.
2. Use the requirements as a checklist of what must exist. Read ISO 56001 to see which elements, roles and records you will need. Map each to an owner with a RACI.
3. Use the guidance to design how each element works. Read ISO 56002, and the specialist guidance documents in the family, for approaches that suit your size and culture.
4. Run the system for real before you call an auditor. Hold the portfolio reviews, make the stop decisions, learn from the retrospectives. The evidence comes from doing the work; see evidence assessors accept.
5. Decide on certification last. Once the system works, certification is a smaller step. If it does not work, certification will not fix it.

Illustrative example: a public transport authority in Lisbon

Illustrative. A city transport authority had run innovation pilots for three years: contactless ticketing trials, a night-bus redesign, an accessibility review. Each was run well, but each was run differently. When its parent ministry asked every agency to describe how it managed innovation, the authority had stories but no system.

The innovation director first read ISO 56002 with the leadership team, one section per monthly meeting, to agree what kind of system they wanted. They then used ISO 56001 as a list of what had to be true: a stated innovation policy, defined roles, a regular portfolio review with recorded decisions, and a way to evaluate results. After a year of running it, they commissioned a pre-assessment, fixed the gaps it found, and only then booked a certification audit. The certificate was the last thing they did, not the first.

Do's and don'ts

Do

• Buy and read the actual standards. Summaries, including this one, are not a substitute.
• Fold innovation into your existing management system if you have one, rather than building a parallel structure.
• Write evidence as a by-product of real work: minutes of decisions, review records, results.
• Check that any consultant or certification body you use understands innovation, not only audit.

Don't

• Treat "aligned with ISO 56002" as a claim of conformity. Guidance cannot be certified, so do not imply it can.
• Copy another organisation's manual. The standard is generic on purpose; your system should not be.
• Start with documents. A system that exists only as policies will fail its first honest review.
• Assume certification proves you are innovative. It shows you manage innovation in a disciplined way; results still have to be earned.

Questions people ask

Can I get certified to ISO 56002? No. ISO 56002 is guidance and is not designed for certification. If you want a certificate, the standard to look at is ISO 56001.

Do I need to implement ISO 56002 before ISO 56001? No. They are not sequential steps. Many organisations go straight to ISO 56001 and use ISO 56002 as reference reading while they build.

Has ISO 56001 replaced ISO 56002? Not replaced. ISO 56001 added a certifiable requirements standard to the family. ISO 56002 remains a guidance document and is being revised to align with ISO 56001. Check the ISO website for the current edition before you buy.

Where to go next

To turn either standard into working practice, start with a KPI tree for your objectives, a RACI for ownership, portfolio mapping for decisions, and regular retrospectives for improvement. Then read ISO 56001 explained for practitioners and our pillar on assessing innovation maturity.