ISO 9001 vs IATF 16949: what mid-market automotive suppliers need to know

This page is a buying comparison. It is for operations and quality leads at mid-market automotive suppliers who are about to send a registrar RFQ and cannot agree whether ISO 9001 or IATF 16949 belongs on it.

Those standards are not interchangeable quality logos. ISO 9001 is a general quality management system. IATF 16949 is the automotive quality management system written for production parts, service parts, and accessory parts, and for the customer requirements that come with them. Customers say "ISO" and mean either. A tier-1 portal often means the automotive one and will check a different record. Salespeople will offer to quote both. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

A Stage 1 versus Stage 2 page already walks the two initial visits. This page decides which system those visits are allowed to sample. Whether that system is real enough to book Stage 1 is first ISO certification. After you pick the standard, you still write one outbound pack, choose a registrar, read the quote, and verify accreditation for any ISO 9001 certificate you will claim. For IATF 16949, verification has a second door, described below. This page does not invent prices, day counts, or recognition claims.

The directory on this site does not filter IATF 16949. Nothing in the registrar profiles states IATF recognition. A general-quality tag is not evidence that the legal entity may issue an automotive certificate.

The decision here is narrower: 9001 on this RFQ, IATF 16949 on this RFQ, or neither until the system exists. Then one pack.

1. What each standard is for, in plain terms

Skip the clause lecture. Buyers do not award a certificate because they memorized a table of contents.

ISO 9001 is how a customer checks that you can repeat the work and correct it when it fails. A certification body samples that quality system: how an order becomes a product or a service, how nonconforming work is caught, and who owns the process. ISO 9001 uses the shared high-level structure also used by ISO 14001, ISO 45001, ISO/IEC 27001, and ISO/IEC 42001. The certificate is not a promise that every part is perfect. It is not a product mark.

ISO published ISO 9001:2026 on 16 September 2026. Many quotes this quarter are still against ISO 9001:2015. A body can certify the new edition only after its accreditation covers it. Put the edition you will claim on the pack. A 2015 certificate did not expire because a new edition exists.

IATF 16949 is the automotive quality management system for sites that manufacture production parts, service parts, or accessory parts, or that run a process an automotive customer has specified. The International Automotive Task Force publishes it. The edition to name, unless a recognized body tells you otherwise, is IATF 16949:2016, first published in October 2016. It replaced ISO/TS 16949. If a portal still says TS 16949, ask the customer which document they accept now.

IATF 16949:2016 is written to be used with ISO 9001:2015. They are two manuals. The IATF published them separately after it did not reach a licensing agreement with ISO for one book. You implement and audit both. The automotive manual is the supplemental. It is not ISO 9001:2026 with a car on the cover. If the IATF later publishes a revision, a body can issue it only after the scheme allows that edition. Ask which documents the body will audit now.

A certification body samples that automotive system. Buyers should expect the visit to care about things a general quality audit often treats lightly or not at all:

• Customer-specific requirements. The requirements of the customers you actually sell to, kept in a table or matrix the quality manual points at. A tier-2 does not inherit an OEM manual when that OEM is not the direct customer. The direct customer's supplier-quality manual still counts.
• Product safety of the part. Characteristics of the product and the process that affect safety in the vehicle. The customer often names them. This is product safety, not occupational health and safety. An ISO 45001 certificate does not answer it.
• The process controls the cell uses. A control plan that matches the job. A process failure-mode analysis someone updates when the process changes. Measurement-system work where the gauge decides accept or reject. The core-tool manuals (APQP, FMEA, MSA, SPC) and the customer's part-approval package are methods. They are not a second certificate.
• Change control that waits. A change the customer has to approve is not released on a verbal okay. The record is the approval.
• Supplier controls and contingency. How you choose and monitor the suppliers who affect the part, including a special process you send out, and what you will do when a press, a tool, or a sole supplier stops the customer's parts. Score delivery and quality the way that customer scores them.

The certificate records the management system for the manufacturing scope you agreed. It does not approve a part. It does not replace the customer's part-approval submission (buyers meet that as PPAP, or under the customer's own name). It does not accredit a special process.

You can hold both an ISO 9001 certificate and an IATF 16949 certificate. This page is about which one this RFQ is for.

2. When ISO 9001 alone is enough this cycle

Start with ISO 9001 when the pressure in front of you is general quality, and an automotive certificate will not lose a bid, a supplier approval, or a renewal this quarter.

That is still the usual case for a shop whose purchase orders are commercial or industrial, including a shop that would like to sell into automotive later. It is also a rational gate when you make only aftermarket parts and no customer has required IATF 16949. The IATF treats that certification as optional unless an automotive customer makes it mandatory. If you choose it anyway, you still have to meet the whole standard. A brochure is not a reason to enter the scheme this cycle.

Put ISO 9001 on this RFQ when most of these are true:

• The customer, portal, bid, or supplier approval in front of you names ISO 9001, or names "an ISO certificate" and means general quality.
• No current contract, supplier-quality manual, or portal names IATF 16949, ISO/TS 16949, or an IATF-certified site for this work.
• You can name the legal entity, the sites that do the certified work, and a quality or operations owner who will be in the room.
• Documented processes roughly match Tuesday. Internal audit and management review can touch this system before you invite a body. That test is first-certificate readiness.
• Automotive pressure is a forecast: a sales call, a capability line on the website, a booth at a show, or a note that a tier "might send a print." A forecast is not a date that kills a contract this cycle.
• You are not offering a general quality certificate as a stand-in for a flow-down that names IATF 16949. If the exhibit names IATF 16949, ISO 9001 will not clear it.

A later IATF add is a normal plan when an automotive customer is real and the automotive system does not exist yet. One line on the pack is enough. Leave IATF 16949 off this RFQ while you have no manufacturing site and no customer requirement you will defend. If the live fork is an aviation, space, and defense system, use ISO 9001 vs AS9100. Do not add IATF 16949 to look specialized.

If the portal requires ISO 9001 and the quality system does not exist, build the system, then send the pack. Who writes the system versus who certifies it is consultant vs certification body.

3. When customers demand IATF 16949 this cycle

Start with IATF 16949 when an OEM, a tier, or a supplier portal will not let this site through without an automotive certificate this cycle, and you can show that system where the parts are made.

That is the usual case for a stamper, molder, machine shop, or component plant whose sourcing agreement names IATF 16949, and for a site that heat-treats, plates, welds, or paints when the customer has put that process inside the automotive requirement. A brochure that says "automotive capable" is not that case. A sales office, a design studio, or a warehouse that does not manufacture can support a plant. Those addresses do not get their own certificate.

The certificate does not authorize the part. Quoting IATF 16949 does not finish a part-approval package you have never submitted.

Put IATF 16949 on this RFQ when most of these are true:

• The agreement, portal, or supplier-quality manual names IATF 16949, on a date you can point at. If it still says ISO/TS 16949, you have written confirmation of what they accept now.
• A manufacturing site makes the production parts, service parts, or accessory parts, or it runs the specified process, and that sentence matches the contracts.
• The automotive system exists: the customer matrix, control plans people use, change control that waits for the customer, supplier controls, and internal audit and management review of this system.
• Design is an explicit decision. In, with records. Or out, because the customer owns the design and you do not change it. "The website says engineering" is not a design scope.
• You know which support locations feed the manufacturing site: design, purchasing, corporate quality, a lab, a warehouse, a second shift. More than one address is multi-site certification scope. Say which address manufactures and which addresses support it.
• You are not asking the certificate to stand in for PPAP, a customer scorecard, a special-process assessment, or a regulatory approval of the vehicle.

If the agreement requires IATF 16949 and the automotive system does not exist, build the system, then send the pack. A general quality manual with "automotive" typed into the scope will not survive Stage 1. Readiness still has the first-certificate shape. The content is the automotive system. What that first visit is for sits in Stage 1 versus Stage 2.

You do not need an ISO 9001 certificate already on the wall before you may ask for an IATF quote. You do need both layers to be real, because the audit reads both manuals. An existing ISO 9001 system is a head start only where people already run it.

Leave ISO 9001 off this cycle only when general quality is not the gate and you cannot staff both. Read the other portals before you do that. An industrial customer can still require ISO 9001 for the non-automotive work in the same legal entity. Ask, in the same pack, whether you also need a separate ISO 9001 certificate.

4. What changes in scope, evidence, and who can quote it

A quote is a designed audit programme. It starts from your facts. ISO 9001 facts and IATF 16949 facts are not the same list with a different title. The approval behind the body is not the same approval either.

Who is allowed to issue IATF 16949. IATF recognition is a contract with IATF oversight. It is not implied by an ISO 9001 line on an accreditation schedule. A body can be accredited for ISO 9001 and still have no recognition to issue IATF 16949.

The live list is on the IATF certification bodies page. Open it in the quarter you would book. Match the legal entity that will sign the certificate, not the marketing logo and not a sister company. This site's directory does not tag that recognition. If the legal entity is not on that list, it cannot issue this certificate. A partner accredited only for ISO 9001 cannot lend you the recognition.

Auditors for these visits are qualified under the IATF scheme. An ISO 9001 lead auditor is not qualified for IATF 16949 by that fact alone. Ask for the qualification.

The rules that bind those bodies are the current IATF Rules for achieving and maintaining recognition. The 6th edition has been effective since 1 January 2025, and the 5th edition is obsolete from that date, including the sanctioned interpretations attached to it. Later interpretations of the 6th edition can still change a reading. You do not need to buy the Rules to send an RFQ. You do need the body to be auditing to the edition in force now.

Where the certificate has to be visible. The public check is the IATF customer portal, which looks up a manufacturing site or a remote support location. The customer's own supplier portal may ask for the certificate number or the site identifier. Open the record before you tell them it is live. A PDF, a logo, and an ISO 9001 hit in an accreditation directory are not that record. The verify guide is still the path for a separate ISO 9001 certificate. Confirm both when the proposal issues both.

Scope. ISO 9001 names the legal entity, the products or services, and the exclusions you will defend. IATF 16949 names the manufacturing site, the automotive products or processes, design in or out, and the support locations. "General machining" is a weak scope if automotive work is why you are buying the certificate, and a false scope if that work does not exist. Ask how commercial work in the same building will be bounded. Do not assume that cell is invisible, and do not put the whole company on the certificate sentence by default.

Evidence and people. ISO 9001 evidence is processes that match the work. IATF evidence adds the customer matrix, the control plan, customer approvals before a change, supplier controls, and a management review that looked at the customer's scorecard. If the product includes software you develop, say so. The owner has to walk that layer. "The ISO 9001 manager will cover IATF" works only when that person can.

What you already hold. If an ISO 9001 certificate exists, name the issuing body, the edition, the scope, and the expiry. Say whether you want the same body to add IATF 16949 or a different body to certify it. If the current body is not on the IATF list, it cannot issue this certificate. An existing file can change how a recognized body plans the visit. It does not convert one standard into the other.

Audit time, without a number from this page. Duration is set under the IATF Rules. It is not last year's ISO 9001 day count. Sites, support locations, shifts, and design responsibility are the kinds of facts that move it. A reduction counts only when the body writes the reason. Ask them to show time by stage, any support-location time, any separate ISO 9001 time, and any reduction. Do not accept "same days as your 9001." How to compare those rows is what drives certification cost. The calendar is how long ISO certification takes.

Ask the same questions of every body: which legal entity is on the live IATF list, which documents they will audit, whether design is in or out, which address manufactures, which addresses support it, who will audit, and whether any activity is remote. The Rules constrain remote work on a manufacturing audit. The method page is remote vs on-site ISO audits. Also ask whether a separate ISO 9001 certificate is included, what you should see in the IATF customer portal before you tell a customer the certificate is live, and what a major does to issue under their rules. The general chapter is closing ISO nonconformities.

5. How to write the RFQ when automotive is in play

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If ISO 9001 is this cycle	If IATF 16949 is this cycle
Standard and edition	The 9001 edition you will claim. Ask which edition the body is accredited to certify now	IATF 16949:2016 with ISO 9001:2015, unless the body tells you a later edition is the one it is recognized to issue
What is in scope	Products, services, processes, exclusions you will defend	Manufacturing site, automotive products or processes, design in or out
Document the owner can show	Processes that match the work, plus internal audit and management review of this system	Customer-requirements matrix, control plan and process controls, change approvals, supplier controls, product safety, contingency, plus internal audit and management review of this system
Sites	Where that work happens, with headcount bands and shifts	The manufacturing site, the support locations, and the shifts that run the automotive job
Owner	Named quality or operations owner	Named owner who can walk the automotive system
The other standard	Later add, or not this cycle	Later add, or not this cycle. Say if a separate ISO 9001 certificate is also required
Neighboring product	Not this quote	Write "IATF 16949 only" unless a special-process assessment or a customer process audit is its own row
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier
Where the certificate must show up	The accreditation path in the verify guide	The IATF customer portal, plus the accreditation path if a separate ISO 9001 certificate is issued

Headcount is a band per site, not the about-page total. A night shift still counts when the automotive job runs at night. What comes back is what CB quotes include. If the same firm wrote the control plans and the customer matrix, they should not be the certifier. Disclose them. That split is consultant vs certification body.

Name the direct automotive customers, not "various OEMs." If the site is not yet in production, or internal audit and management review have not covered this system, say so in the first paragraph. Ask whether the body can quote a certificate or only an earlier IATF document, and what a customer may do with that document. Do not call a letter a certificate.

If you already hold IATF 16949 and the question is a different body, that move is a transfer under the IATF Rules, not a reprint of the old certificate. The general chapter is transferring an ISO certificate. Ask the receiving body to show its place on the recognized list and to state what the current Rules require for a transfer. The general page does not replace those rules.

6. How this sits next to other sector schemes

Automotive, aerospace, and medical devices are three different gates. A customer can name more than one over a career. This RFQ should name the one that blocks revenue now.

AS9100 is the aviation, space, and defense system, not a cousin of IATF 16949. It is published through the IAQG and checked in OASIS. IATF 16949 is checked through the IATF portal. A machine shop that holds one has not cleared the other. If the live argument is ISO 9001 versus AS9100, use ISO 9001 vs AS9100 and leave IATF off this pack. If you truly supply both a vehicle maker and an aerospace customer from the same legal entity, those are two schemes. Write them as two rows, or run the one that unblocks this cycle and park the other. Do not ask one body to "cover transportation."

ISO 13485 is the medical-device system. A part that later sits in a device is not an automotive part with a different logo. If that is the fork, use ISO 9001 vs ISO 13485.

Process audits and special-process assessments are different products. A VDA 6.3 audit, a customer's own process audit, and an AIAG CQI assessment for heat treat, plating, coating, welding, or whatever the manual names, are not an IATF 16949 certificate. If you outsource the special process, your system still has to control that supplier. Write "IATF 16949 only" unless you are buying the other work on purpose. ISO 14001 and ISO 45001 are the plant stack. Keep them off this pack when they are not the gate.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, supplier-quality manual, sourcing agreement, purchase order. Use their words. If one field says ISO 9001 and another says IATF 16949, note which revenue is blocked this cycle. If a field says PPAP, a CQI assessment, a VDA process audit, or AS9100, mark it as a different product.
2. Match it to a system you can show. ISO 9001 needs processes that match the work. IATF 16949 needs a manufacturing site, the customer matrix, the process controls, and an owner who can walk them. If that system does not exist, do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems are real enough to defend at Stage 1.
4. Name the site, the support locations, the design decision, and the direct customers for the automotive standard, or the quality owner and the locations for ISO 9001.
5. Check the body before you invite it. For IATF 16949, the legal entity is on the IATF recognized list. For ISO 9001, use how to verify accreditation. How to choose among bodies you can actually award is how to choose a registrar.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. The Get quotes form on this site lists the standards on the directory desk. IATF 16949 is not one of those checkboxes. In Scope notes, name IATF 16949 if it is this cycle, say whether ISO 9001 is also this cycle or a later add, and state the manufacturing site and the design decision in one or two lines. If the form will not send without a ticked standard, do not let a ticked ISO 9001 box stand in for an automotive request. The notes sentence is the scope. Put any certificate you already hold in Existing certificates. Submit the same page once, including to the logo you already like. The standard on the page has to be the standard you can staff.