IATF 16949 for Automotive Suppliers

Confirm eligibility and scope

The first step is to identify precisely:

• Automotive products.
• OEM/Tier customers.
• Manufacturing sites.
• Support locations.
• Design, if applicable.
• Outsourced processes.
• Permitted exclusions.

IATF 16949 is aimed at automotive parts manufacturing and processes. Eligibility must be confirmed with the recognised certification body.

ISO 9001 foundation

IATF 16949 is built on ISO 9001 and adds sector-specific requirements. The company needs an operating quality management system (QMS): processes, risks, objectives, audits, nonconformities and review.

IATF 16949 should not be treated as a manual separate from ISO 9001.

Customer-specific requirements

Each customer publishes its own customer-specific requirements (CSR), which can change. It is advisable to keep a tracking matrix:

IATF Global Oversight maintains a CSR repository. The team must monitor changes on an ongoing basis.

Core tools

• APQP.
• PPAP.
• FMEA.
• SPC.
• MSA.
• Control Plan.

Core tools must be linked to one another. A change in the FMEA must be reflected in the control plan and in the work instructions. Documents cannot remain inconsistent with each other.

Context and risks

The following must be considered:

• Customer and platform.
• Capacity.
• Sole-source supplier.
• Obsolescence.
• Quality and delivery.
• Cybersecurity.
• Continuity.
• Changes.
• Competence.

The contingency plan must cover equipment, staff, energy, IT, transport and suppliers.

Design and development

Where design responsibility exists, the following must be controlled:

• Inputs.
• Reviews.
• Verification.
• Validation.
• Special characteristics.
• Changes.
• Embedded software, where applicable.

If there is no product design, the rationale must be documented; process design still applies in any case.

Production

Controls include:

• Instructions.
• Parameters.
• Start-up approval.
• Shift changes.
• Maintenance.
• Tooling.
• Identification.
• Traceability.
• Nonconforming product.
• Reaction.

Special characteristics must flow from the customer through to the operator.

Capacity and maintenance

Capacity must be validated against demand, along with OEE where useful, bottlenecks and contingency. Preventive and predictive maintenance is prioritised by risk.

Critical spare parts and reaction plans must be backed by evidence.

Metrology

Calibrated equipment, MSA studies and a reaction procedure for out-of-tolerance results are required. A calibration certificate alone is not enough: the measurement system itself must be assessed.

Suppliers

The organisation develops its suppliers toward an automotive quality management system, based on risk and applicable requirements. It must control:

• Selection.
• Performance.
• Audits.
• PPAP.
• Changes.
• Sub-suppliers.
• Contingency.
• Complaints.

Urgent purchases do not remove these controls.

Nonconforming product

Nonconforming product is identified, contained, assessed and communicated. Rework and repair processes must be authorised and validated against requirements.

Containment protects the customer and the rest of the batches. Traceability is preserved.

Problem solving

A structured method — 8D or another required method — is applied, covering:

• Containment.
• Root cause.
• Escape-point cause.
• Action.
• Verification.
• FMEA and control plan update.
• Lessons learned.

Closing an action simply because it was implemented does not prove its effectiveness.

Changes

Changes to product, process, supplier, tooling, location or software require evaluation and, where applicable, customer approval. Temporary changes are controlled too.

Audits

Three types are considered:

• System.
• Manufacturing process.
• Product.

Auditors need specific competence and objectivity. Frequency is based on risk, performance and changes.

Metrics

• PPM.
• Complaints.
• Deliveries.
• Scrap and rework.
• Capacity.
• Downtime.
• Overdue actions.
• Supplier performance.
• Audits.
• Cost of poor quality.

Metrics are linked to reaction.

Certification

The Rules 6th Edition have been in force since 2025 according to recognised certification bodies. The company must use the current edition, choose a recognised IATF certification body and keep site and customer information accurate.

An ISO 9001 certificate is not equivalent to IATF.

9-month plan

Months 1–2

Eligibility, gap analysis, CSR and governance.

Months 3–4

Core tools, process, suppliers and contingency.

Months 5–6

Implementation, records and competence.

Month 7

System, process and product audits.

Month 8

Actions and management review.

Month 9

Pre-audit and certification.

The timeline depends on maturity and evidence cycles.

Common mistakes

1. Ignoring the CSR.
2. Disconnected core tools.
3. Generic FMEA.
4. Not assessing capacity.
5. Insufficient MSA.
6. Suppliers without development.
7. Changes without approval.
8. 8D without escape-point cause.
9. Paper-only audit.
10. Unrecognised certification body.

Checklist

• Eligibility and scope.
• Operating ISO 9001.
• Current CSR.
• Linked core tools.
• Special characteristics.
• Capacity and maintenance.
• MSA and calibration.
• Suppliers.
• Contingency and changes.
• Audits and certifier.

Frequently asked questions

Is it a legal requirement?

It is usually a customer or supply-chain requirement, not a general law. It should be confirmed in the contract.

Is ISO 9001 enough?

No, when the customer requires IATF. It is the foundation, but the sector-specific requirements are missing.

Can a non-manufacturing office be certified?

Support locations are linked to a site; eligibility must always be confirmed under the IATF rules.

Official sources consulted

• IATF: about IATF 16949.
• IATF: customer-specific requirements.
• IAOB: references and Rules 6th Edition.
• IAOB: resources.

Summum Calidad can carry out the gap analysis, core tools implementation, audits and certification preparation for automotive suppliers in Valladolid.