Customer-specific requirements (CSRs) are what each vehicle manufacturer adds to IATF 16949 on its own account. Clause 4.3.2 of the standard requires you to evaluate them and include them in the quality management system, and the certification auditor checks that you have. Those of the manufacturers that make up the IATF are published on its website; those of a tier 1 supplier reach you through the contract or its supplier portal.
In practice, two plants with the same IATF 16949 certificate can work very differently depending on who they supply. A CSR can set how a PPAP is submitted, how far in advance a process change must be notified, which quality indicators the customer tracks, or what happens if you enter its escalation programme. If you don't have them under control, the certificate falls short.
Which manufacturers publish them, and which version
This is the situation on the IATF customer-specific requirements page at the end of October 2026. The date is that of the current version, which is what you need to compare with the one you have on file:
| Manufacturer | Current document | Version |
|---|---|---|
| BMW Group | CSR for IATF 16949 | April 2021 |
| Ford | CSR for IATF 16949 and CSR for PPAP | Effective 15 June 2026 |
| General Motors | CSR for IATF 16949 | Effective 30 October 2025 |
| IVECO Group | CSR for IATF 16949 | 24 November 2025 |
| Mercedes-Benz Group | CSR for IATF 16949 | February 2022 |
| Renault Group | CSR | April 2026 |
| Stellantis | CSR for IATF 16949 and summary with FAQs | June 2025 (summary updated in 2026) |
| Volkswagen | CSR | March 2022 |
| Volvo Group | CSR | 28 February 2025 |
| Zhejiang Geely | CSR for IATF 16949 | June 2025 |
| BYD Group and Jaguar Land Rover | Under development | Not published |
Look at the pace. Ford published a new version in June 2025 and again in June 2026; Renault updated in April 2026 and Stellantis has revised its summary several times this year. A CSR you downloaded two years ago is almost certainly out of date.
Ford and General Motors also publish a document with minimum quality requirements for sub-tier suppliers, dated September 2017. If you supply a company that works for them, you will probably be asked to meet it even if you have no direct relationship with the manufacturer.
What a CSR usually contains
Most follow the numbering of IATF 16949 and state, clause by clause, what the manufacturer adds or clarifies. Others refer to their own supplier quality manuals, which have to be read separately. These are the topics that come up most often:
- Part approval: which PPAP or initial sample level is submitted and when it has to be repeated.
- Changes: which process, supplier or location changes have to be notified before they are made.
- Customer indicators: the scorecard the manufacturer calculates for you (incidents, deliveries, complaints), which clause 9.1.2.1 requires you to monitor.
- Escalation: what happens when your indicators get worse, from action plans to containment controlled by a third party.
- Audits: process or product audit methods the customer wants you to use in your internal audits.
- Suppliers: what you have to pass down to your own supply chain.
How the certification auditor reviews them
The auditor doesn't audit the CSR as a stand-alone document. They pick processes and check that what each customer requires is built in: if the CSR requires a change to be notified and there has been one on the shop floor, they will ask for the notification. If there is no trace in your system of a requirement that appears in the current CSR, it will normally end up as a nonconformity against clause 4.3.2 or against the clause it affects.
The IATF acknowledges the problem. In its communiqué SC-2026-005 on the second edition of the standard, it says CSRs are one of the most discussed topics in the scheme and that stakeholders consistently identify them as a significant challenge. One of the goals of the revision is to identify requirements shared by several manufacturers and, where possible, include them in the standard itself. Until it comes out (publication is planned for mid-2027), CSRs are still managed one by one.
How we would manage them
With a requirements matrix. Each requirement from each customer is a row with its IATF 16949 clause, the process it affects, the owner, the evidence that proves it and the CSR version it comes from. It works better than keeping the PDFs in a folder per customer, for three reasons: you can see at a glance which processes carry the most requirements, you can audit against the matrix and, when a new version comes out, you only review the rows that change.
Add a periodic check of the IATF page and each customer's portal, with a date and an owner, and keep a record even when nothing has changed. It is the simplest way to show the auditor that your clause 4.3.2 evaluation is alive. And don't forget customers that are not manufacturers: a tier 1 supplier can have its own requirements too, and they don't appear on any public website.
In the GlobalSuite® compliance module each CSR can be loaded as your own framework, with every requirement assigned to its process, owner, controls and evidence, alongside ISO 9001 and IATF 16949. What you need to pass on to your suppliers can be sent as a questionnaire from the third-party module, with their answers and evidence stored in the same place. If you'd like to see how it would look with your customers, get in touch.
Official sources: customer-specific requirements on the IATF website, IATF news and communiqué SC-2026-005. CSR dates checked on 30 October 2026.
