If you’ve made it this far, you’re probably in one of two situations: your company has been asked by an automaker or a Tier 1 customer to get certified to IATF 16949, or it’s already certified and needs to keep the certificate without surprises at the next surveillance or recertification audit.
Either way, this guide brings together what you need to know right now: from the basic definition to the difference from ISO 9001, covering cost, timeline, requirements, core tools, audit preparation and how to sustain compliance day to day, without relying on a last-minute scramble.
What is IATF 16949?
IATF 16949 is the international quality management standard aimed specifically at the automotive supply chain, developed and published by the International Automotive Task Force (IATF), a group made up of automakers such as Ford, General Motors and Stellantis (formerly PSA/FCA), along with the automotive associations of Germany, France, Italy and the United Kingdom, among other members.
It replaced the former ISO/TS 16949 in October 2016, and it is not a substitute for ISO 9001 but an extension of it: to be certified to IATF 16949, a company must meet all the requirements of ISO 9001:2015 and the additional automotive requirements defined by the IATF at the same time.
The most practical differences from ISO 9001 come down to three points: certification can only be issued by certification bodies recognized by the IATF (not just any accredited body, as with ISO 9001); certification is site-specific (it can only be granted to the location where a value-adding manufacturing process actually takes place, such as machining, welding, heat treatment or painting); and the standard requires the mandatory use of the automotive industry’s so-called core tools: APQP, PPAP, FMEA, MSA and SPC.
The companies that typically pursue certification are Tier 1, Tier 2 and Tier 3 suppliers to automakers, manufacturers of automotive components and aftermarket parts, and heat treatment, painting, stamping or assembly companies that serve the automotive supply chain.
For most direct suppliers to IATF member automakers, certification has stopped being a differentiator and become a contractual prerequisite: without it, approval as a series-production supplier normally doesn’t happen. Keep reading to learn more about the IATF 16949 standard!
IATF 16949: what has already changed and what is still to come
Unlike ISO 9001, whose new version (ISO 9001:2026) was officially published on September 16, 2026, IATF 16949 has not yet undergone a revision of the standard’s text itself. What is already in effect and what is still only industry expectation are two different things, and it’s worth not confusing them:
Already in effect: the 6th edition of the IATF Rules (Rules for achieving and maintaining IATF 16949 Certification), published on March 31, 2024 and mandatory since January 1, 2025. It did not change the technical requirements of IATF 16949:2016, but it did change audit rules, including: a redefinition of Extended Manufacturing Site (EMS), which must now be at most 16 km and 60 minutes from the main site (plant) to be treated as an extension of it, rather than needing its own certification; a limit of 10 audit hours per auditor per day; and adjustments to how nonconformities and eligibility are handled.
Not yet confirmed, only expected by the industry: a revision of the text of IATF 16949 itself, with publication estimated for late 2026 or early 2027, subject to IATF confirmation. The market expects this revision to align with the structure of ISO 9001:2026 and to strengthen themes such as embedded software controls, supply chain risk management and supply chain resilience, reflecting the rise of connected and software-defined vehicles since 2016. Until the official publication and the opening of a transition period by the IATF, the version in force and required remains IATF 16949:2016.
In practice, if your company is getting certified or recertified now, what matters is the 6th edition of the Rules, which is already mandatory. The revision of the standard itself is something to watch, not yet to act on, but it’s worth mapping now where your AQMS has gaps in software and supplier risk, themes expected to carry more weight in the next version.
IATF 16949 vs. ISO 9001: what’s the difference?
| Aspect | ISO 9001 | IATF 16949 |
|---|---|---|
| Application | Any industry or company size | Specific to the automotive supply chain |
| Relationship between the standards | Base standard, stand-alone | Extension of ISO 9001: requires compliance with both at the same time |
| Certification body | Any accredited body | Only bodies recognized by the IATF (public list on IATF Global Oversight) |
| Certification scope | Can cover the organization as a whole | Certification tied to the plant where value-adding manufacturing takes place |
| Required tools | Does not specify methodologies | Mandatory use of the core tools: APQP, PPAP, FMEA, MSA and SPC |
| Customer requirements | Not formally provided for | Customer-Specific Requirements (CSRs) from each automaker are a mandatory part of the AQMS |
| Self-declaration | Allowed in some countries | Not allowed; certification is always by third-party audit |
What are the benefits of IATF 16949 for a company?
Beyond making contracts with automakers possible, certification solves concrete management problems in the automotive supply chain:
Becomes a commercial prerequisite, not a differentiator: most IATF automakers only approve series-production suppliers that hold a valid certificate recognized by the IATF.
Reduces second-party audits: OEM (Original Equipment Manufacturer) customers and Tier 1 suppliers tend to reduce the frequency and scope of their own supplier audits once the supplier is certified, which frees up quality team time.
Standardizes evaluation across global supply chains: a plant in Mexico, Germany or China is assessed against the same criteria, which simplifies global sourcing and reduces the risk of rework caused by differing requirements between countries.
Structures the use of core tools: companies that master APQP, PPAP, FMEA, MSA and SPC make better product development decisions, identify process risks earlier and deliver more stable quality, even outside the context of an audit.
Institutionalizes continual improvement: the standard requires measurable quality objectives, trend analysis and formal continual improvement (CIP) projects, instead of one-off efforts tied to a specific person.
How much does IATF 16949 certification cost and how long does it take?
There is no fixed market price, and certification tends to take longer and cost more than ISO 9001 alone, because it requires simultaneous compliance with the base standard and the automotive requirements. The investment depends on a combination of factors:
| Factor | Impact on cost/timeline |
|---|---|
| Plant size and production volume | More lines, shifts and processes = more audit days |
| Maturity of the current QMS (already ISO 9001?) | Companies already certified to ISO 9001 start ahead, but still need to implement the automotive layers |
| Prior command of the core tools | Teams already using APQP, PPAP, FMEA, MSA and SPC get certified faster |
| IATF-recognized certification body | Fees vary, and the list of eligible bodies is smaller than for ISO 9001 |
| Customer-Specific Requirements (CSRs) | Each automaker customer may add its own requirements, which widens the implementation scope |
| Number of Extended Manufacturing Sites (EMS) | Support sites (plants) outside the 16 km / 60 min radius of the main site need their own certification |
As a general benchmark, companies starting from scratch, without a prior ISO 9001, usually take 12 to 18 months from the decision to the certification audit, including the gap assessment, core tools implementation, internal audit and the two stages of the external audit (Stage 1 and Stage 2). Companies already operating with a mature ISO 9001 tend to shorten that to 6 to 12 months, since the foundation of the management system already exists.
What are the requirements and mandatory documents of IATF 16949?
In addition to all the documented information required by ISO 9001 (scope, quality policy and objectives, supplier evaluation, competence, calibration, internal audits, nonconformities, management review), IATF 16949 adds requirements specific to the automotive sector.
The items IATF 16949 certification auditors check most often in practice:
- Control Plan per product or product family
- APQP (Advanced Product Quality Planning) records for new projects
- PPAP (Production Part Approval Process) approved by the customer before series production starts
- Design and process FMEA, reviewed and kept up to date
- MSA (Measurement Systems Analysis) studies for critical instruments
- Control charts and evidence of process capability (SPC)
- Contingency plan for interruption of supply to the customer
- Records of compliance with each automaker customer’s Customer-Specific Requirements (CSRs)
- Complete lot traceability system, from supplier through shipping
- Containment and rapid response records for nonconformities that affect the customer
The most common mistake isn’t a missing document; it’s an approved PPAP that doesn’t reflect the real production process, or a Control Plan that isn’t followed on the line. IATF auditors spot this divergence quickly, because they cross-check the approved document against direct observation of the process, and a nonconformity classified as major on this point can block issuance of the certificate.
How to prepare for the IATF 16949 certification audit
A structured path reduces nonconformities on audit day:
- Maturity assessment against the combined requirements of ISO 9001 and IATF 16949.
- Definition of the AQMS scope by plant, respecting the site-specific criterion.
- Implementation and mastery of the core tools (APQP, PPAP, FMEA, MSA, SPC) in daily production routine.
- Mapping of the Customer-Specific Requirements (CSRs) of each automotive customer.
- Team training on AQMS processes and on the required core tools.
- Internal audit, with correction of the nonconformities found before the external visit.
- Management review of indicators, customer scorecards and risks.
- External audit by an IATF-recognized certification body, in two stages: Stage 1 (document review) and Stage 2 (verification of implementation in practice).
The earlier core tools evidence is generated as a production routine, rather than pulled together in a rush before the auditor’s visit, the lower the risk of a major nonconformity, a category that can suspend issuance of the certificate until the correction is verified.
What the auditor assesses in the IATF 16949 certification audit
Before organizing your preparation, it helps to know exactly what’s being checked. In addition to everything already assessed in an ISO 9001 audit, the IATF auditor checks whether the core tools and automotive requirements move off the page and become shop-floor practice.
| Area of the standard | What the auditor assesses | Typical evidence expected | How Qualiex helps |
|---|---|---|---|
| New product planning (8.3, APQP) | Whether new product development follows the APQP phases, with formal approval at each gate | APQP schedule, design review minutes, control plan | Project workflow with phases and recorded approvals, with no need for a parallel spreadsheet to know which gate each product is at |
| Production part approval (8.3.4.4, PPAP) | Whether every part in series production has a PPAP approved by the customer before shipment | PPAP package, customer approval, level required per part | Central PPAP register by part and by customer, with approval status and revision history visible |
| Design and process risk analysis (FMEA) | Whether FMEAs are living documents, reviewed with every relevant design or process change | Up-to-date design and process FMEA, resulting actions implemented | Risk module linked to FMEA, with an action plan and an owner for each identified risk |
| Measurement systems (MSA) | Whether critical instruments have a valid MSA study, not just up-to-date calibration | R&R studies, MSA plan per critical instrument | Calibration matrix with expiration alerts that also cover MSA re-studies, not just basic calibration |
| Statistical process control (SPC) | Whether key processes are monitored with control charts and capability (Cp/Cpk) within the customer’s criterion | Control charts, process capability reports | Indicator dashboard connected to process data, with history available for management review |
| Customer-specific requirements (CSRs) | Whether each automaker customer’s particular requirements are mapped and implemented | CSR matrix per customer, evidence of compliance | Document control with owner, version and review date, useful for keeping each customer’s requirement records up to date and traceable |
| Scorecards and customer performance (9.3.2.1) | Whether performance scorecards sent by automakers are analyzed in management review | Scorecards received, management review minutes discussing the results | Management review minutes linked to indicators and to received scorecards, with a complete history of decisions |
| Containment and response to customer-impacting nonconformity | Whether a formal rapid containment process exists (e.g., controlled shipping) when a problem reaches the customer | Containment plan, record of immediate action, customer communication | NC workflow with a mandatory containment step before root cause, with the deadline of each step monitored |
IATF 16949 certification audit preparation checklist
We’ve broken the 8 preparation steps into individual blocks. Copy each one into your team’s task management tool and use it as a tracking checklist up to the audit date.
Step 1. Maturity assessment
Before implementing anything, you need to know exactly where the plant stands against the combined ISO 9001 and automotive requirements. Without that, effort gets scattered across points that are already resolved.
- Review the requirements of ISO 9001 and IATF 16949 clause by clause
- Identify what already exists, what partially exists and what doesn’t exist
- Assess the maturity level of the core tools (APQP, PPAP, FMEA, MSA, SPC)
- Prioritize gaps by criticality and the time left until the audit
Step 2. Definition of scope and eligibility
These elements form the stated foundation of the AQMS: they define which plant will be certified and whether it meets the standard’s site-specific criterion.
- Confirm that the plant carries out a value-adding manufacturing process on site
- Map Extended Manufacturing Sites (EMS) and check the 16 km / 60 min radius
- Define the AQMS scope for the site in writing
- Communicate the scope and quality policy to the whole team
Step 3. Implementation of the core tools in product development
With the scope defined, the next step is to structure how new products enter production, using the tools the standard requires, not a simplified version of them.
- Structure the APQP process for new projects, with formal gates
- Develop design and process FMEA for each critical product
- Define and document the Control Plan for each product or family
- Prepare the PPAP documentation at the level required by the customer
Step 4. Process control and measurement systems
This is where the AQMS comes off the page: control plans become real production monitoring, with instruments and methods proven to be reliable.
- Run MSA studies on critical instruments and measurement systems
- Implement control charts and capability calculation (Cp/Cpk) on key processes
- Make sure every process nonconformity triggers a recorded corrective action
- Make process data available to the people who make decisions day to day
Step 5. Mapping of Customer-Specific Requirements (CSRs)
Meeting the generic standard is not enough if the company ignores the particular requirements of each automaker customer, which are a mandatory part of the AQMS.
- Gather the CSRs of each automotive customer the plant serves
- Create a compliance matrix by requirement and by customer
- Review the matrix whenever a customer publishes a CSR update
- Train the sales and quality teams on the CSRs relevant to their roles
Step 6. Internal audit
Before welcoming the external auditor, the plant audits itself. It’s the last chance to find and fix problems before they become a formal nonconformity, especially in the core tools.
- Draw up the internal audit program, covering both process and product
- Conduct the audit with an internal auditor qualified in IATF 16949
- Record every finding, including those in the core tools
- Open an action plan for each nonconformity found
Step 7. Management review
The standard requires leadership to formally review AQMS performance, including customer performance, not as a bureaucratic formality but as a real decision about what changes from that point on.
- Gather the performance scorecards received from automaker customers
- Review internal audit results and open nonconformities
- Assess the performance of the core tools and process indicators
- Record decisions and actions in formal minutes
Step 8. External audit by an IATF-recognized certification body (Stage 1 and Stage 2)
The final step: an IATF-recognized certification body checks, first on paper and then in practice, whether everything that was implemented actually works as stated.
- Confirm that the chosen body is IATF-recognized for the plant’s scope
- Gather and organize all core tools documentation for Stage 1
- Prepare the shop-floor team for interviews and practical verification in Stage 2
- Assign one person to accompany the auditor throughout the visit
How to maintain IATF 16949 certification (surveillance audits and recertification)
IATF 16949 certification is valid for three years, but it doesn’t sit idle during that time: the certification body conducts surveillance audits, usually once a year, to confirm the AQMS is still active and the core tools remain in real use. At the end of the cycle, recertification repeats the initial certification process in a broader form.
Major nonconformities not addressed within the deadline set by the certification body can lead to suspension of the certificate, and the IATF gives less leeway here than ISO 9001 does: a suspended or withdrawn certificate is published on IATF Global Oversight, visible to any customer who checks a certificate’s validity before approving or keeping a supplier.
The biggest risk at this stage is rarely technical; it’s operational: losing track of when an FMEA needs review, when a PPAP needs re-approval after a process change, or when a customer CSR has been updated, especially when those controls are scattered across spreadsheets, emails and shared folders.
Common mistakes in IATF 16949 certification
The same mistakes show up, with few variations, in certification, surveillance and recertification audits:
| Most common mistakes | Root cause | How Qualiex solves it |
|---|---|---|
| An approved PPAP that doesn’t reflect the real production process, quickly spotted by any experienced auditor | Process change neither formalized nor revalidated with the customer | PPAP record linked to process revisions, so a change without revalidation is visible, not hidden |
| Treating a nonconformity that reached the customer as “resolved” without formal containment or root cause investigation | One-off correction instead of containment and root cause analysis | NC workflow with a mandatory containment and root cause step; it can’t be closed until these are completed |
| Leaving FMEA and Control Plan out of date relative to the real shop-floor process | FMEA review treated as a one-time event, not a routine after changes | Risk module linked to FMEA, easy to review whenever a process changes |
| Treating the scorecard received from the automaker as a stand-alone file, without connecting it to internal process indicators | Scorecard filed away but not discussed alongside the plant’s real performance | Indicator dashboard connected to management review minutes, with history available to compare against received scorecards over time |
| Certifying an Extended Manufacturing Site outside the radius allowed by the 6th edition Rules without adjusting the certification strategy | Unawareness of the new EMS definition (16 km / 60 min) | Indicator dashboard by site, helping map the plant structure before defining the certification strategy |
| Running the internal audit without covering the core tools, focusing only on generic ISO 9001 requirements | Internal audit program copied from a pure ISO 9001 template | Configurable internal audit program, covering both the general requirements and the automotive core tools |
How quality management software helps maintain IATF 16949 compliance
Sustaining IATF 16949 compliance between one audit and the next, with PPAPs, FMEAs and Control Plans for multiple automotive customers running at the same time, is exactly where most quality teams lose time and take on risk. Scattered spreadsheets, FMEA reviews done off-schedule and corrective actions without a clear owner are the most common causes of nonconformity in surveillance and recertification audits.
Qualiex, Automotive Quality Management Software, centralizes document control, nonconformities, risks and FMEA, corrective actions, control plans, decision minutes, internal audits, process indicators, supplier management and instrument calibration in a single system, with an evidence trail ready whenever the auditor asks.
No last-minute digging through files. For those following the expected revision of IATF 16949 aligned with ISO 9001:2026, it also makes it easier to map, in one place, which of your current AQMS controls already cover the expected themes (software and supplier risk) and which need attention.
If your company is assessing the maturity of its AQMS for the next audit, whether certification, surveillance or recertification, Qualiex is the definitive solution for you.
Frequently asked questions about IATF 16949
Is IATF 16949 certification required by law?
No. Like ISO 9001, IATF 16949 is a voluntary standard, not a legal requirement in any country. In practice, however, it works as a contractual requirement: most IATF member automakers only approve series-production suppliers that present a valid certificate, so for anyone who wants to sell to those automakers, certification stops being optional.
Does IATF 16949 replace ISO 9001, or do I need both?
You need both. IATF 16949 is not a stand-alone standard; it is an extension of ISO 9001: it adds specific automotive requirements (core tools, Control Plan, PPAP, customer requirements) to the requirements already set by ISO 9001:2015. There is no IATF 16949 certification unless the company also fully meets ISO 9001. In practice, the certification audit covers both standards at the same time.
Can any certification body issue the IATF 16949 certificate?
No. Unlike ISO 9001, where any accredited body can certify, IATF 16949 can only be certified by certification bodies specifically recognized by the IATF, with the IATF number and logo printed on the certificate. Before hiring, it’s worth confirming this directly on the IATF Global Oversight website: a certificate issued by a non-recognized body is not accepted by automakers.
Will my company lose its IATF 16949:2016 certificate when the standard is revised?
Not abruptly, at least. When an ISO or IATF standard is revised, a certificate issued under the previous version remains valid during a transition period set when the new version is published, as has happened in previous revisions in the industry. Since the revision of IATF 16949 has not yet been published or officially confirmed, there is currently no defined transition deadline; that will only be announced when the new version is released. Until then, IATF 16949:2016 remains the version in force and required.
Do I need to already have ISO 9001 before pursuing IATF 16949?
Having a separate ISO 9001 certificate before you start is not a prerequisite, but you must implement and demonstrate compliance with the requirements of ISO 9001:2015 together with the automotive requirements, since both are assessed in the same IATF 16949 certification audit. In practice, companies that already have a mature ISO 9001 arrive with an advantage: the foundation of the management system already exists, and the effort focuses on the additional automotive layers (core tools, Control Plan, customer requirements), which usually shortens the total implementation time.
How long does the certification audit take?
It depends mainly on the plant’s size, the number of processes and production lines, and the number of products and customers covered by the scope. As a benchmark, the external certification audit happens in two stages: Stage 1, shorter, focused on document review, and Stage 2, longer, which verifies implementation in practice, including direct observation of the shop floor. The exact duration (in audit days) is calculated by the certification body under specific minimum audit time rules, which take into account headcount, shifts and process complexity.
What happens if my company fails the certification audit?
It depends on the severity of the findings. Minor nonconformities come with a deadline to submit an action plan, without preventing the certificate from being issued. A major nonconformity, such as an approved PPAP that doesn’t reflect the real process or a serious traceability failure, prevents the certificate from being issued until the company proves the correction, which normally requires a follow-up audit. There is no permanent “fail”: the company can correct the points raised and be reassessed, but this delays the certificate issue date and may jeopardize deadlines agreed with automotive customers.
