IATF 16949:2016 is the quality management standard for the automotive industry. It does not stand alone: it adds sector requirements on top of ISO 9001, and only certification bodies recognised by the IATF (International Automotive Task Force) can certify it. Vehicle manufacturers and their direct suppliers will ask you for it if you make series production or service parts for them.
The manufacturers themselves are behind the standard. According to the IATF website, its members today are BMW Group, BYD Group, Ford, General Motors, IVECO Group, Jaguar Land Rover, Mercedes-Benz Group, Renault Group, Stellantis, Volkswagen, Volvo Group and Zhejiang Geely, together with the industry associations of the United States (AIAG), Italy (ANFIA), France (FIEV), the United Kingdom (SMMT) and Germany (VDA). That is why selling to them without it is so hard.
Who it applies to, and who it doesn't
Certification is for manufacturing sites: the plant where parts, assemblies or materials that end up in a vehicle are produced, service parts included. Functions that support that plant from another location (design, purchasing, central logistics) are covered in the audit as support, but they cannot be certified on their own.
If you make tooling, machinery or provide services to the sector, you will normally be asked for ISO 9001, not IATF 16949. And if your customer is a tier 1 supplier rather than the manufacturer, it may require you to meet parts of the standard without being certified. Clause 8.4.2.3 requires the certified organisation to develop its suppliers' quality systems, with ISO 9001 as the starting point and IATF 16949 as the goal.
What it adds to ISO 9001
IATF 16949 follows the structure of ISO 9001 clause by clause and adds supplemental sections. Almost everything new revolves around three ideas: preventing defects before they reach the customer, controlling the manufacturing process with data, and meeting what each manufacturer asks for. These are the requirements that change day-to-day work the most:
| Clause | What it requires |
|---|---|
| 4.3.2 | Evaluate each customer's specific requirements and include them in the system |
| 4.4.1.2 | Documented processes to manage products and manufacturing processes that affect safety |
| 6.1.2.3 | Contingency plans to keep deliveries going if equipment, a supplier or a system fails, and tests of those plans |
| 7.1.5.1.1 | Measurement systems analysis (MSA) for the equipment listed in the control plan |
| 8.3.2.3 | A quality assurance process for embedded software |
| 8.5.1.1 | Control plans per part or family, for pre-launch and for production |
| 9.2.2 | Three types of internal audit: system, manufacturing process and product |
| 10.2.3 and 10.2.4 | A documented problem-solving method and error-proofing devices |
On top of that come the sector's core tools, which the standard takes for granted and the manufacturers spell out in their manuals: advanced product quality planning (APQP), the production part approval process (PPAP), failure mode and effects analysis (FMEA, using the harmonised AIAG-VDA handbook of 2019), statistical process control (SPC) and MSA. If you are coming from ISO 9001, this is where most of the effort goes.
What certification looks like
The process is set by the IATF Rules, now in their 6th edition, in force since 1 January 2025. Before the initial audit you need the system running with real records, including at least one complete internal audit and a management review. The audit has two stages, the certificate is valid for three years, and there are surveillance audits in between.
Only certification bodies under contract with the IATF can certify, and the list is published on its website. Any customer can then check whether your certificate is valid on the IATF portal, so a certificate issued by anyone else is no use to them.
What's next: the second edition
The IATF is revising the standard. Its communiqué SC-2026-005 of July 2026 sets five priorities: simplify the text, strengthen embedded software quality, manage the supply chain better beyond tier 1, give more weight to product launches, and bring order to customer-specific requirements. Publication is planned for mid-2027, and the deadline to move to the new edition will end at the same time as the ISO 9001 transition.
ISO 9001 has already changed: ISO 9001:2026 was published on 16 September 2026, and certificates to the 2015 version are expected to remain valid until 30 September 2029, pending final confirmation from accreditation bodies. Until the second edition comes out, IATF 16949:2016 is the one being audited.
Our advice is not to wait. If a customer asks you for certification today, the second edition will not replace it, only revise it, and what you build now (control plans, FMEA, process audits) will still count.
Where we would start
First, ask your customer for its specific requirements in writing. They will decide a good part of the scope, and some manufacturers require things the standard does not mention. We cover this in our article on customer-specific requirements.
Then run a clause-by-clause gap analysis starting from your ISO 9001. The clauses in the table above are the ones that usually come up empty. And don't leave internal audits for last: the certification auditor wants to see a full cycle and internal auditors trained in the core tools. The details are in our article on the IATF 16949 internal audit.
In GlobalSuite® you can load the IATF 16949 requirements as your own framework, alongside ISO 9001, and see which clause is implemented, which is in progress and which has not started. The process map, nonconformities with their corrective action, supplier evaluation and audits all live on the same platform. FMEA, PPAP and SPC are still done with their engineering tools; what changes is that the system that organises and audits them is in one place. If you'd like to see it with your own case, get in touch.
Official sources: IATF 16949:2016 on the IATF website, IATF members, IATF Rules, 6th edition, communiqué SC-2026-005 and recognised certification bodies. Content reviewed in October 2026.
