FMEA - The Standards Navigator

Risk Management in Medical Devices: How to Build an ISO 14971-Compliant Process in 2026

Medical device risk management is the thread that connects every element of your ISO 13485 QMS — and the first place an auditor looks. This guide covers all five stages of the ISO 14971:2019 process, required documentation at each step, how to set defensible acceptability criteria, and the most common findings in notified body and FDA audits.

A step-by-step implementation guide for medical device manufacturers building or strengthening a risk management framework under ISO 14971:2019 and ISO 13485:2016

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Your Risk Management File Is the First Thing an Auditor Opens

Not your QMS manual. Not your SOPs. Your risk management file.

That is where a notified body auditor or FDA inspector starts — because risk management in medical devices is the thread that connects every other element of your quality system. If your risk file is thin, incomplete, or disconnected from your design and production controls, the rest of your documentation will not save you.

Most medical device companies understand that ISO 14971:2019 requires a risk management process. Fewer understand what that process actually looks like when it is fully implemented — the outputs required, the decisions that must be documented, and the points where ISO 13485:2016 Clause 7.1 and ISO 14971 intersect in ways that catch teams off guard during audits.

This article walks through the complete risk management process for medical devices: what ISO 14971 requires at each stage, how those requirements connect to your QMS, and where most teams fall short.

I have spent 25 years in heavy industrial manufacturing running quality systems under ISO 9001, managing nonconformances, and building risk-based approaches to process control. When I transitioned into the ISO 13485 space, the discipline was familiar — but the regulatory stakes were different. In manufacturing, a process failure costs you time and scrap. In medical devices, the same gap in your risk file can cost you a 483 observation, a warning letter, or a market withdrawal. The rigor required is not optional, and it is not theoretical. Every output described in this article is something auditors actively look for.

Before you read further: If you have not yet assessed where your current risk management process stands against ISO 14971:2019 requirements, start there. A structured gap assessment takes less time than an audit finding.

📥 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including risk management obligations under Clause 7.1.

In This Guide

What ISO 14971:2019 actually requires — the full process, not just the outputs
How ISO 13485 Clause 7.1 connects to your risk management file
The five stages of the ISO 14971 process with required documentation at each step
How to set acceptable risk criteria — the decision most teams get wrong
Post-production surveillance and why it feeds back into your risk file
The most common audit findings in risk management reviews
Training options for teams building or rebuilding a compliant process

👉 Start Here: Top Resources for Medical Device Risk Management

If you are building or rebuilding your risk management process, these are the resources that will move you fastest:

ISO 14971:2019 — ANSI Webstore — The current edition of the standard. Required reading for anyone responsible for a device risk management file. Use code CC2026 for 5% off at checkout.
ISO 13485 Training — BSI Group — BSI offers ISO 13485 implementation and auditor training that covers risk management integration in depth.
ISO 13485 Training — ISOQAR — ISOQAR provides training and certification services for ISO 13485, with risk-based thinking woven throughout their courses.

What ISO 14971:2019 Requires

ISO 14971 risk management lifecycle infographic showing the seven stages of risk management in medical devices and required outputs from planning through post-production surveillance. — A visual overview of the ISO 14971 risk management lifecycle and the documentation outputs auditors expect to see.

ISO 14971:2019 is the international standard for the application of risk management to medical devices. It applies throughout the full device lifecycle — from concept through post-market surveillance.

The standard does not prescribe a specific risk analysis method. It does not tell you to use FMEA, FTA, or a risk matrix of a particular format. What it requires is a documented, systematic process that produces specific outputs at each stage.

The core framework in ISO 14971:2019 includes:

Stage	What ISO 14971 Requires
Risk management plan	Define scope, responsibilities, criteria for risk acceptability, and review activities
Risk analysis	Identify intended use, reasonably foreseeable misuse, and associated hazards and hazardous situations
Risk evaluation	Compare estimated risk against criteria — determine if risk reduction is required
Risk control	Select and implement controls; verify effectiveness; assess residual risk and any new risks introduced
Benefit-risk analysis	Where residual risk remains, evaluate whether the overall benefit outweighs remaining risk
Risk management report	Summarize the process and confirm residual risks are acceptable
Post-production information	Collect and review field data; feed findings back into risk management

Every output — the plan, the analysis, the controls, the report — must be captured in a risk management file.

How ISO 13485 Clause 7.1 Connects

ISO 13485:2016 Clause 7.1 requires that your organization document risk management requirements throughout product realization. This is not a standalone obligation — it is a QMS-level requirement that ties your risk file to your design controls, supplier management, production processes, and CAPA system.

The key connection points:

Design and development (Clause 7.3): Risk management inputs and outputs must be included in design planning. Design reviews, verification, and validation activities must all reference and be consistent with the risk management file.

Purchasing and supplier controls (Clause 7.4): Supplier-introduced risks must be identified and addressed. If a supplier failure creates a patient hazard, that scenario belongs in your risk analysis.

Production and service provision (Clause 7.5): Special processes — sterilization, labeling, software-dependent controls — require risk-based validation. Your risk file should identify where these controls are critical and what happens if they fail.

CAPA (Clause 8.5): Post-market findings, complaints, and nonconformances are data sources for your risk management process. A complaint that reveals a hazardous situation not previously identified in your risk analysis must trigger a risk file update.

Most common finding: Auditors frequently cite a disconnect between the CAPA system and the risk management file — complaints and CAPAs are processed and closed without evaluating whether the risk file needs to be updated.

If you are evaluating your current QMS against these connection points, the gap assessment checklist above covers all of them.

The Five-Stage Risk Management Process

Stage 1: Risk Management Plan

Your risk management plan is not a form — it is a governing document for the entire risk process for a specific device. It must define:

The scope of activities (which device, which lifecycle phases)
Roles and responsibilities for risk management activities
Requirements for review of risk management activities
Criteria for risk acceptability — what level of residual risk is acceptable and on what basis

The last item is where most teams take shortcuts. Acceptability criteria cannot simply reference “ALARP” or “as low as reasonably practicable” without defining what that means for your device and patient population. Auditors will push on this.

Stage 2: Risk Analysis

Risk analysis begins with a thorough description of the device — its intended use, intended users, and reasonably foreseeable misuse. From there, you identify:

Hazards (potential sources of harm)
Hazardous situations (circumstances in which people could be exposed to a hazard)
Harm sequences (how the hazardous situation leads to harm)

ISO 14971 Annex C provides a non-exhaustive list of hazard categories: energy hazards, biological hazards, environmental hazards, hazards related to incorrect output, and others. Use it as a prompt, not as a complete list.

Common analysis methods include FMEA (Failure Mode and Effects Analysis), FTA (Fault Tree Analysis), and HAZOP. Most device teams use FMEA as the primary tool. None of these methods is required by the standard — but whatever method you use must be documented and consistently applied.

Stage 3: Risk Evaluation

Once you have estimated the probability and severity of each harm, you evaluate whether each risk requires reduction. This evaluation is made against the acceptability criteria defined in your risk management plan.

If a risk exceeds your acceptable threshold, risk reduction is required. If it falls below the threshold, you still need to document the evaluation decision — not just assume silence means acceptable.

📥 If you are not confident your current risk file covers these evaluation decisions consistently, download the ISO 13485 Gap Assessment Checklist and work through Section 7 — it maps directly to these requirements.

Stage 4: Risk Control

ISO 14971 infographic showing the risk control hierarchy and residual risk evaluation process for medical device risk management. — ISO 14971 requires organizations to prioritize design controls first, verify effectiveness, and document residual risk decisions before closing risk.

ISO 14971 requires you to follow a three-level hierarchy when selecting controls:

Inherent safety by design — eliminate or reduce the hazard through design choices
Protective measures — add guards, alarms, or protective barriers in the device or manufacturing process
Information for safety — labeling, instructions for use, training requirements

You must implement controls in this order of preference. You cannot jump to warnings and labeling as your primary control if a design solution is practicable.

After implementing each control:

Verify the control was implemented as intended
Verify the control is effective at reducing risk
Assess whether the control introduces any new hazards
Re-evaluate residual risk after all controls are applied

Stage 5: Residual Risk and Benefit-Risk Analysis

After controls are in place, residual risk will remain for most devices. If residual risk exceeds your acceptability criteria even after all practicable controls have been applied, you must perform a benefit-risk analysis: does the clinical benefit of the device outweigh the remaining risk?

This analysis must be documented. “We believe the benefit outweighs the risk” is not documentation. The analysis must reference clinical evidence, intended use, and the nature and magnitude of remaining harm.

Setting Acceptable Risk Criteria

This is the decision most risk management teams get wrong, and it is the one auditors examine most carefully.

Your risk acceptability criteria must be:

Defined before you begin risk analysis — not after you have already seen your risk estimates
Based on relevant policy, standards, and guidance applicable to your device category
Specific enough to make clear decisions — a matrix with defined severity and probability ranges, not a narrative statement

What Auditors See	What They Want to See
“We aim to reduce risk ALARP”	A defined matrix with probability/severity scales and explicit acceptable/unacceptable zones
Criteria defined after the analysis was completed	Criteria established in the risk management plan before analysis began
One set of criteria applied across all device types	Criteria appropriate to the specific device and patient population
No documented basis for the criteria chosen	Reference to applicable guidance documents (IMDRF, EU MDR, FDA guidance)

Reference points that support defensible criteria include FDA guidance on risk management for device software, IMDRF guidance documents, and the introductory notes in ISO 14971:2019 itself.

Risk Control Options and Residual Risk

One of the most common gaps in risk files is incomplete residual risk documentation. Teams identify hazards, apply controls, and then fail to document the post-control risk estimate.

Every control must have:

A documented implementation record (the control was actually applied)
A verification record (the control works as intended)
A post-control risk re-estimate (residual probability × severity)
An evaluation of residual risk against acceptability criteria

If your controls introduce new hazards — which software controls, sterilization processes, and combination products frequently do — those new hazards must be analyzed through the full process. There is no shortcut.

If you are preparing for your first ISO 13485 certification audit, verify that every risk control in your file has all four of these elements documented before your Stage 1 audit. Incomplete residual risk documentation is one of the most common major nonconformances found in initial certification audits.

BSI Group offers ISO 13485 implementation training that specifically addresses risk file documentation structure, including residual risk evaluation requirements. ISOQAR provides similar training with a certification pathway.

The Risk Management File

The risk management file is not a single document. It is a collection of records that demonstrates the complete risk management process was followed for a specific device. What it must contain:

Risk management plan
Risk analysis outputs (hazard list, probability/severity estimates)
Risk evaluation records (acceptability decisions)
Risk control records (implementation, verification, new hazard assessment)
Residual risk evaluation
Benefit-risk analysis (where required)
Risk management report
Post-production information review records

The risk management report is the capstone document. It confirms that the risk management plan was followed, all residual risks are acceptable, and appropriate methods were used to obtain relevant production and post-production information.

Your risk management file must be maintained and updated throughout the product lifecycle. It is not a one-time certification exercise.

ISO 14971 risk management file infographic showing required records and how the file integrates with ISO 13485 quality management requirements. — The risk management file is the central evidence package that demonstrates ISO 14971 compliance across the medical device lifecycle.

Post-Production Information and Surveillance

ISO 14971 Clause 9 requires a systematic process to collect and review post-production information. This includes:

Customer complaints and feedback
Field service and repair reports
Medical device reports (MDRs) and vigilance reports
Published literature and adverse event databases
Post-market clinical data

This information must be evaluated to determine whether it:

Indicates previously unidentified hazards
Changes the estimated probability or severity of a known harm
Invalidates earlier risk control decisions

If it does, your risk file must be updated. Your CAPA process must have a defined trigger for escalating post-market findings to the risk management team.

Most common finding: Post-market surveillance is treated as a regulatory reporting obligation rather than a risk management input. Complaints are processed through CAPA, but the risk file is never reviewed against complaint trends. This is a major nonconformance under both ISO 13485 Clause 8.2.1 and ISO 14971 Clause 9.

Common Audit Findings in Risk Management Reviews

These are the findings that appear most frequently in ISO 13485 and EU MDR notified body audits:

✅ Incomplete risk analysis scope — Reasonably foreseeable misuse not identified or analyzed. Risk analysis covers intended use only.

⚠️ Acceptability criteria defined after the analysis — Criteria were back-filled to match the estimates, rather than established as the decision framework before analysis began.

⚠️ Missing residual risk evaluation — Controls were implemented and verified, but no post-control risk estimate was documented.

✅ Disconnected CAPA and risk file — Complaints and CAPAs processed and closed without triggering a risk file review.

⚠️ Labeling used as the primary control — Instructions for use are cited as the risk control when a design solution was practicable.

✅ Risk file not maintained post-launch — The risk file was complete at certification but has not been updated since. Design changes, new complaint data, and field findings are not reflected.

⚠️ No benefit-risk analysis where residual risk is above acceptability threshold — Teams acknowledge residual risk exceeds their criteria but do not formally document the benefit-risk justification.

Training for Your Risk Management Team

Risk management competence is a requirement, not a preference. Your team members responsible for risk management activities must be trained — and that training must be documented.

Both BSI Group and ISOQAR offer ISO 13485 training that covers risk management integration. BSI also offers a dedicated Risk Management — Requirements (ISO 14971) e-learning course for teams who need focused training on the standard itself.

If you are already certified under ISO 13485 and preparing for a surveillance audit:

If your risk team has not been formally trained on ISO 14971:2019 since the 2019 edition was published, now is the time to close that gap. The 2019 edition introduced changes to state-of-the-art requirements and manufacturer benefit-risk responsibilities that differ from the 2007 edition.

If you are building your QMS from scratch and need structured implementation support across all 8 clauses:

If you are evaluating implementation support options, review what documentation a compliant ISO 13485 QMS requires before investing in training. It will help you scope what your team actually needs to build.

FAQ

What is the difference between ISO 14971 and ISO 13485 for risk management?

ISO 13485:2016 Clause 7.1 requires that risk management be applied throughout product realization. ISO 14971:2019 is the standard that defines how to do it — the process, the required outputs, and the documentation. ISO 13485 tells you that you must manage risk. ISO 14971 tells you how. Most medical device manufacturers must comply with both.

Is ISO 14971 mandatory?

ISO 14971 is not directly mandated by law in most markets, but it is referenced as a harmonized standard under the EU MDR 2017/745 and EU IVDR 2017/746. For FDA-regulated devices in the US, compliance with ISO 14971 supports conformance with 21 CFR Part 820 design controls requirements. As a practical matter, no notified body or FDA inspection team will accept a risk management process that does not align with ISO 14971.

What is a risk management file?

A risk management file is the complete collection of records that documents the risk management process for a specific device. It includes the risk management plan, risk analysis outputs, evaluation records, control records, residual risk documentation, benefit-risk analysis (where required), the risk management report, and post-production surveillance records. The file must be maintained and updated throughout the device lifecycle.

How often should a risk management file be updated?

Your risk management file must be updated whenever there is a change to the device, its intended use, or new information that could affect risk estimates — including complaints, adverse events, published literature, or design changes. Many organizations establish a formal periodic review (annually or at defined product lifecycle milestones) as part of their post-market surveillance process.

What risk analysis methods does ISO 14971 require?

ISO 14971 does not mandate a specific method. FMEA, FTA, HAZOP, and preliminary hazard analysis are all acceptable approaches. What the standard requires is that the method be documented, systematic, and capable of identifying hazards and estimating risk. Most medical device manufacturers use FMEA as their primary method.

What is the difference between a hazard, a hazardous situation, and harm in ISO 14971?

A hazard is a potential source of harm — for example, excessive electrical energy in a device. A hazardous situation is a circumstance in which people, property, or the environment could be exposed to the hazard — for example, a patient contact point that can carry excessive current under a specific failure condition. Harm is the physical injury or damage to health that results. ISO 14971 requires that you trace the full sequence from hazard to harm for each risk identified.

How does ISO 14971 relate to CAPA in ISO 13485?

Your CAPA process should have a defined trigger for escalating complaints, adverse events, and nonconformances to the risk management team for evaluation. If a post-market finding reveals a previously unidentified hazard or changes the estimated probability of an existing risk, your risk file must be updated. Closing a CAPA without evaluating its implications for the risk file is one of the most common major findings in ISO 13485 surveillance audits.

What changed in ISO 14971:2019 compared to the 2007 edition?

ISO 14971:2019 introduced several substantive changes: clarified the concept of state-of-the-art and how manufacturers must use it; expanded and clarified the benefit-risk analysis process; updated the overall residual risk evaluation process; and revised the structure of the standard to align with ISO management system high-level structure conventions. Teams trained only on the 2007 edition may have gaps in their current process.

📥 Free Resources

These tools are available at no cost to support your ISO 13485 and risk management implementation:

ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including risk management obligations under Clause 7.1
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still building your understanding of ISO 13485 requirements? Start with the ISO 13485 Implementation Roadmap — it walks through all 8 clauses and how they connect before you invest in building documentation.

🔹 Ready to implement and need training for your risk management team? Both BSI Group and ISOQAR offer ISO 13485 training with risk management integration. BSI also has a dedicated ISO 14971 e-learning course.

🔹 Need to purchase ISO 14971:2019 for your quality team? Get it from the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

Risk management is not a documentation exercise you complete before certification and revisit every few years. It is the living framework that keeps your device safe, your quality system defensible, and your audits clean. Build it right from the start — and maintain it like the regulatory asset it is.

The Standards Navigator covers ISO 13485, ISO 14971, FDA requirements, and medical device quality management in depth. Use the resources above to move from gap to compliant.

Stay Current on Medical Device Compliance

Most teams that struggle with ISO 13485 audits are not missing knowledge — they are missing a system for keeping their risk files, documentation, and compliance processes current as requirements evolve.

Organizations that pass surveillance audits consistently have one thing in common: their quality teams are not surprised by what auditors look for. They have a process for staying ahead of requirement changes, notified body expectations, and post-market obligations.

The Standards Navigator covers ISO 13485, ISO 14971, FDA QMSR, and medical device compliance requirements in plain language for quality professionals and regulatory teams.

👉 Get updates on the medical device compliance cluster — new articles, requirement changes, and implementation guidance delivered directly to your inbox.

👉 Be first to access new free resources, including the ISO 13485 Documentation Starter Kit when it launches.

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

What Is IATF 16949? (Automotive Quality Standard Explained for 2026)

IATF 16949 is the quality management standard for automotive production-part suppliers, implemented alongside ISO 9001:2015. This guide explains who needs certification, what the standard requires beyond ISO 9001, the five core tools, certification costs and timelines, and what the IATF’s planned 2nd Edition means for suppliers preparing for the 2027 transition.

How the automotive quality management standard works, who needs it, what it adds to ISO 9001, and what the 2nd Edition means for your certification timeline

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard That Governs Automotive Supply Chains Worldwide

IATF 16949 is the automotive industry’s quality management system standard for organizations that manufacture automotive production, service, or accessory parts. It builds on ISO 9001:2015 with automotive-specific requirements covering product safety, risk management, customer-specific requirements, supplier development, and the automotive Core Tools.

If you build components for the automotive supply chain and your customer’s purchase agreement names IATF 16949, you are not on the approved vendor list until you hold the certificate. IATF member OEMs — including Ford, GM, Stellantis, Volkswagen Group, BMW Group, Mercedes-Benz, and Renault — require it from direct production-part suppliers, and those Tier 1 suppliers commonly flow the same requirement down to Tier 2 component and material suppliers.

IATF 16949 is the primary automotive QMS certification scheme — but whether you need certification depends on your products, your role in the supply chain, your customers’ requirements, and your eligibility under the IATF scheme. This guide walks through each of those.

Most readers landing here are at one of two points: a customer just asked for the certificate, or you already hold ISO 9001 and want to know how much further IATF 16949 goes. It answers both — what the standard is, what it requires beyond ISO 9001, what certification costs, and what the coming 2nd Edition changes about your timeline.

From the Floor: My perspective comes from more than 25 years in heavy industrial manufacturing, including operations leadership and ISO 9001 internal auditing. As an internal auditor, I’ve spent plenty of time checking whether a documented procedure actually matches what happens on the floor — and that gap is exactly what IATF 16949’s core tools are built to close. In a valve and energy manufacturing environment, we treated special process control on welding and heat treatment the same way automotive treats a control plan: if the process couldn’t be fully verified after the fact, the upfront controls had to be airtight. Automotive suppliers who assume “we’re already ISO 9001 certified, this will be easy” can be blindsided by how much operational discipline PPAP and layered process audits demand.

Most first-time IATF 16949 findings trace back to gaps nobody checked before the auditor arrived. Run your operation against the same compliance points auditors look for — before you’re standing in front of one → 👉 Manufacturing Compliance Checklist — 50 items covering ISO 9001, 14001, 45001, and OSHA, with gap scoring

In This Guide

What IATF 16949 is and how it relates to ISO 9001
Who developed it and who recognizes it
Who needs IATF 16949 — and who doesn’t
What IATF 16949 requires beyond ISO 9001
The five automotive core tools
Customer-specific requirements (CSRs)
What certification audits involve under the Rules 6th Edition
Certification costs and realistic timelines
How to choose an IATF-recognized certification body
IATF 16949 2nd Edition — what’s changing and when
Common implementation mistakes and a readiness checklist

👉 Start Here (Top Resources)

👉 Get IATF 16949 training and the standard from an IATF-recognized body → BSI Group IATF 16949

👉 Purchase ISO 9001:2015 — you need it alongside IATF 16949, not instead of it → ISO 9001:2015 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

👉 Build the ISO 9001 documentation foundation without a consultant → 9001Simplified Documentation Kits

👉 Get ISO 9001 certified first if you’re starting from zero → ISOQAR ISO 9001 Certification

👉 Train your team on the ISO 9001 foundation → BSI Group ISO 9001 Training

What Is IATF 16949?

Question	Quick Answer
What is it?	The global automotive QMS standard — a supplement to ISO 9001:2015 that adds automotive-specific requirements
Does it replace ISO 9001?	No. It is implemented in conjunction with ISO 9001:2015, which is purchased separately
Who needs it?	Tier 1 and Tier 2 automotive production-part suppliers whose customers require it
Current edition	IATF 16949:2016 (1st Edition) — the only certifiable edition today
Next edition	2nd Edition planned for mid-2027; transition end aligned with the ISO 9001 transition
Who can certify you?	IATF-recognized certification bodies only
First-year cost	Roughly $20,000–$200,000+, depending on organization size and starting point
Typical timeline	6–22 months, depending on existing ISO 9001 status

IATF 16949:2016 — Quality Management System Requirements for Automotive Production and Relevant Service Parts Organizations — is the quality management standard for the global automotive supply chain. It defines the quality system requirements that production-part suppliers must implement and maintain to qualify for, and stay in, automotive supply chains.

One point trips up a lot of first-time readers. IATF 16949 is fully aligned with the structure and requirements of ISO 9001:2015, but it is not a standalone document. The publisher describes it as a supplement implemented in conjunction with ISO 9001:2015 — and ISO 9001 must be purchased separately. An IATF 16949 certification audit evaluates your QMS against the applicable requirements of both IATF 16949 and ISO 9001:2015. An ISO 9001 certificate alone does not satisfy IATF 16949.

The standard is built around three objectives:

Defect prevention — building quality into products and processes from the design stage rather than relying on end-of-line inspection.

Variation reduction — using statistical methods and structured process control to reduce variation in product characteristics and process parameters.

Continual improvement — systematically identifying and acting on improvement opportunities across product quality, process efficiency, and supply chain performance.

For a side-by-side breakdown, see ISO 9001 vs IATF 16949.

Who Developed IATF 16949?

IATF 16949 was developed by the International Automotive Task Force (IATF) — a group of automotive OEMs and their national trade associations that collaborate on common quality requirements for the global automotive supply chain. The IATF publishes its standards, rules, and stakeholder communiqués through IATF Global Oversight.

IATF member organizations include BMW Group, Ford Motor Company, General Motors, Stellantis, Renault, Volkswagen Group, and Mercedes-Benz, alongside the national trade associations AIAG (United States), ANFIA (Italy), FIEV (France), SMMT (United Kingdom), and VDA QMC (Germany).

IATF 16949:2016 was published October 3, 2016, replacing ISO/TS 16949:2009. ISO/TS 16949 certificates expired in September 2018, after which IATF 16949 became the only certifiable automotive QMS standard.

Why IATF 16949 Replaced ISO/TS 16949

ISO/TS 16949 was jointly managed by ISO and the IATF. When ISO 9001 moved to its 2015 edition, the automotive community developed IATF 16949:2016 to align with the new high-level structure while strengthening automotive-specific requirements. Key additions over ISO/TS 16949:

Product safety — explicit requirements for identifying and managing product safety characteristics across the lifecycle
Supplier quality management — strengthened requirements for qualifying, monitoring, and developing sub-tier suppliers
Leadership accountability — top management responsibilities aligned with ISO 9001:2015 Clause 5
Risk-based thinking — embedded throughout rather than confined to planning clauses
Corporate responsibility — anti-bribery policy, employee code of conduct, and ethics escalation (whistle-blower) policy

Who Needs IATF 16949?

IATF 16949 applies to organizations that manufacture automotive production parts, service parts, or accessory parts — and to their sub-tier suppliers where customers require it. In March 2024, the IATF also confirmed that manufacturers of electric-vehicle charging systems and related components are eligible for certification as accessory-part suppliers.

Organizations that typically need IATF 16949:

Tier 1 direct suppliers manufacturing production parts for automotive OEMs
Tier 2 component and material suppliers where the Tier 1 customer contract requires it
Manufacturers of service or accessory parts where OEM requirements specify it
Any organization whose purchase agreements with automotive customers name IATF 16949 certification

Organizations that typically do not need IATF 16949:

Indirect material suppliers — tools, equipment, facilities, consumables not incorporated into the vehicle
Service providers — logistics, transportation, software, consulting
Raw material suppliers — steel, aluminum, resin — unless a customer specifically requires it
Organizations supplying only non-automotive industries

The reliable test is your paperwork, not your instinct. Review current and target customer purchase agreements and supplier qualification questionnaires. If IATF 16949 is listed, it’s required. If a customer sends you PPAP submission requirements, you are being asked to operate within an automotive quality framework that may include IATF 16949 requirements, customer-specific requirements, and the applicable AIAG reference manuals — check the contract for the certification requirement itself.

For the full picture of what Tier 1 suppliers require from their supply chain, see What ISO Standards Do Tier 1 Suppliers Need?

If you are already ISO 9001 certified → your implementation timeline is likely 8–14 months rather than 14–22, and most of your internal audit and management review infrastructure carries over directly.

What IATF 16949 Requires Beyond ISO 9001

ISO 9001 vs IATF 16949 comparison graphic showing general manufacturing vs automotive quality standards with industrial and assembly line visuals — ISO 9001 provides a general quality framework, while IATF 16949 adds strict automotive-specific requirements for suppliers.

IAISO 9001 provides the general quality framework. IATF 16949 layers strict automotive-specific requirements on top of it. The most operationally significant additions:

Product safety — Explicit requirements for identifying product safety characteristics, features whose failure could create a safety hazard or regulatory non-compliance. Safety characteristics receive special handling through design, production, and inspection.

Defect prevention orientation — Where ISO 9001 emphasizes detecting and correcting nonconformances, IATF 16949 requires preventing them through structured APQP, FMEA, and control plan development before production begins.

Layered process audits — A structured program of process audits conducted at multiple organizational levels (operator, supervisor, manager, executive) on a defined frequency. There is no equivalent in ISO 9001, and it is one of the requirements first-time implementers most underestimate.

Contingency planning — Documented contingency plans for production processes covering equipment failure, supplier disruption, utility interruption, and natural events. Plans must be tested and reviewed.

Customer-specific requirements — Every IATF OEM publishes CSRs that supplement the standard and must be addressed in your QMS. CSRs vary significantly between OEMs.

Sub-tier supplier development — Active development of your supply base’s QMS capability — not just evaluation and monitoring. The standard identifies compliance to the Minimum Automotive Quality Management System Requirements for Sub-Tier Suppliers (MAQMSR) as a possible intermediate step.

Warranty management — Requirements covering warranty claims, warranty part analysis, and no-trouble-found (NTF) analysis.

Embedded software — Requirements for software development and assessment where the product includes embedded software. This area is a stated priority for the 2nd Edition.

The Five Automotive Core Tools

The five commonly recognized automotive Core Tools are the most distinctive and operationally demanding part of IATF 16949. Auditors evaluate their implementation specifically. The methodology for each is contained in separate AIAG reference manuals (or the joint AIAG-VDA FMEA Handbook) — the standard tells you where they apply; the manuals tell you how to do them.

APQP — Advanced Product Quality Planning

APQP is the structured process for planning product and process quality during new product development — before production begins. It organizes the work into five phases: planning and definition, product design and development, process design and development, product and process validation, and feedback and corrective action.

AIAG published the APQP 3rd Edition in March 2024, alongside a new standalone Control Plan 1st Edition reference manual — control plan guidance that previously lived inside the APQP manual now has its own document. If your team trained on the 2nd Edition, check which edition your customers reference in their CSRs.

What makes APQP challenging: It requires cross-functional involvement — quality, engineering, manufacturing, purchasing — working to a structured timeline before production tooling exists. Compressing APQP under launch pressure is a common root cause of weak design verification and late PPAP rejections.

PPAP — Production Part Approval Process

PPAP is the formal documentation and approval process demonstrating that your production process can consistently produce conforming parts. For many automotive programs, customer PPAP approval is a key release gate between production validation and authorized production, though launch arrangements vary by customer.

PPAP has five submission levels:

Level 1 — Part Submission Warrant (PSW) only
Level 2 — PSW with product samples and limited supporting data
Level 3 — PSW with product samples and complete supporting data (the most common default)
Level 4 — PSW and other requirements as defined by the customer
Level 5 — PSW with product samples and complete supporting data reviewed at the supplier’s manufacturing location

A Level 3 package commonly includes design records, engineering change documentation, customer engineering approval, DFMEA, process flow diagram, PFMEA, control plan, MSA studies, dimensional results, material and performance test results, initial process studies, qualified laboratory documentation, appearance approval report, sample parts, master sample, checking aids, customer-specific requirements evidence, and the PSW itself.

What makes PPAP challenging: Packages are comprehensive and unforgiving. A missing element or an inadequate capability study results in rejection and resubmission — with the production launch date sliding behind it.

FMEA — Failure Mode and Effects Analysis

FMEA is a systematic analysis of potential failure modes in design (DFMEA) and manufacturing processes (PFMEA) — what could go wrong, its effect on the customer, how likely it is, what controls exist, and what additional action is needed.

The current automotive methodology is the AIAG-VDA FMEA Handbook (2019), which replaced the separate AIAG and VDA manuals with a single seven-step approach. PFMEA findings drive control plan development — the controls in your control plan should address the highest-risk failure modes identified in the PFMEA.

What makes FMEA challenging: It is a living document, not a one-time exercise. It must be updated for design changes, process changes, customer complaints that reveal new failure modes, and on a defined review cycle.

SPC — Statistical Process Control

SPC uses statistical methods to monitor process variation in real time — detecting trends, shifts, and special causes before they produce nonconforming parts. IATF 16949 requires statistical control for special characteristics identified in control plans.

Control charts are the primary tool. Process capability indices (Cp/Cpk) show whether a process can meet specification limits consistently; automotive customers commonly specify capability targets such as Cpk ≥ 1.33 or 1.67 for certain characteristics, but the applicable target comes from the customer’s requirements, control plan, or CSR — not from a universal IATF 16949 threshold.

What makes SPC challenging: Calculating control limits, interpreting chart signals, and reacting correctly to special-cause variation requires trained personnel and consistent discipline on the floor.

MSA — Measurement System Analysis

MSA — most often a Gauge Repeatability and Reproducibility (GR&R) study — evaluates whether your measurement systems can reliably detect the variation you’re trying to control. If measurement variation is too large relative to tolerance, your data is unreliable regardless of how carefully it was collected.

What makes MSA challenging: Many organizations assume a recently calibrated gauge is adequate. Calibration verifies accuracy against a reference; MSA evaluates whether the whole system — equipment, operators, environment — produces repeatable results in production conditions.

Most teams moving from ISO 9001 to IATF 16949 underestimate the operational lift of the core tools until they are already behind schedule. Map the gap before you commit to a certification date → 👉 ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or extending a QMS

IATF 16949 core tools process flow diagram under APQP showing PFD, PFMEA, Control Plan, MSA, SPC and PPAP sequence — IATF 16949 core tools flow within the APQP framework, showing how automotive quality planning progresses from process definition to full production approval.

Customer-Specific Requirements

IATF 16949 certification alone does not satisfy every OEM requirement. Each IATF member OEM publishes Customer-Specific Requirements (CSRs) that suppliers must meet alongside the standard. CSRs are published through the IATF Global Oversight website and OEM supplier portals.

CSRs commonly address:

PPAP submission levels and approval processes
FMEA methodology (some OEMs specify AIAG-VDA explicitly)
SPC requirements and capability targets
Supplier development and sub-tier flow-down expectations
Second-party audit requirements
Controlled shipping requirements when quality issues occur

CSRs are living documents — OEMs reissue them regularly, and several have been updated in 2025–2026. Check the current version for every OEM customer rather than relying on the copy stored in your QMS. Organizations must review and address the CSRs of every automotive customer they supply — not just the base standard. A CSR gap is a nonconformance in that customer’s supplier audit regardless of your certificate status. CSR management is also one of the five stated priorities for the 2nd Edition, which aims to identify common CSRs and potentially incorporate them into the standard itself.

If you are under customer pressure to certify quickly → prioritize certification body selection and core tools training before building full documentation. Those are your longest lead items.

What IATF 16949 Certification Audits Involve

IATF 16949 audits are conducted under the IATF’s Rules for Achieving and Maintaining IATF Recognition. The Rules 6th Edition took effect January 1, 2025, changing how certification bodies plan and conduct audits without changing the requirements of IATF 16949:2016 itself.

Stage 1 audit: Readiness assessment — the certification body evaluates whether the organization is sufficiently prepared for the Stage 2 audit, including relevant QMS documentation, site readiness, and automotive-specific requirements such as core tools evidence and CSR coverage.

Stage 2 audit: Full on-site certification audit using the IATF process approach:

Process audits — each manufacturing process evaluated against its PFMEA, control plan, and work instructions, with auditors verifying on the floor that specified controls are implemented and effective
Product audits — production parts sampled and checked for dimensional and functional conformance
System audits — the overall QMS evaluated against all IATF 16949 clauses and applicable CSRs

IATF audits typically require more audit days than ISO 9001 audits for the same organization size, reflecting the additional scope of core tools, CSRs, and the process/product audit methodology.

Surveillance: Surveillance audits occur during the three-year certification cycle according to the IATF certification scheme, with recertification required before the certificate expires.

Certification Costs and Timeline

Illustrative First-Year Budget Ranges

Organization Size	ISO 9001 Foundation	IATF 16949 Addition	Total First Year
Small (1–25 employees)	$8,000–$18,000	$12,000–$22,000	$20,000–$40,000
Mid-size (26–200 employees)	$15,000–$40,000	$25,000–$60,000	$40,000–$100,000
Large (200+ employees)	$30,000–$75,000	$50,000–$125,000	$80,000–$200,000+

These are planning ranges, not published IATF fees. Actual costs vary substantially with employee count, audit scope, number of manufacturing processes, sites, existing QMS maturity, training needs, consulting support, equipment and software requirements, and customer-specific requirements. The additional cost of IATF 16949 over ISO 9001 primarily reflects core tools implementation, CSR compliance work, more intensive audit fees, and specialized training. Organizations already ISO 9001 certified generally spend less on the automotive layer because the QMS foundation is already in place.

The common objection — cost: For suppliers whose target customers require IATF 16949 certification, the cost is better understood as a market-access requirement than a conventional marketing expense. The business case ultimately depends on the automotive customers and opportunities the certification enables the supplier to pursue.

Practical Planning Ranges

Starting Point	Typical Timeline
No prior management system	14–22 months
ISO 9001 certified	8–14 months
ISO 9001 certified with core tools experience	6–10 months

These are planning estimates rather than IATF-mandated timelines. Actual implementation time varies with scope, site complexity, existing QMS maturity, customer-specific requirements, product development activity, and available resources.

For the full breakdown, see How Long Does ISO Certification Take? and How Much Does ISO Certification Cost?

How to Choose an IATF-Recognized Certification Body

Best ISO certification bodies ranked and reviewed for 2026 with manufacturing-focused audit quality and accreditation comparison — Top ISO certification bodies for manufacturers ranked by audit quality, accreditation, pricing transparency, and industry experience (2026)

This is one of the most consequential decisions in the project — and one of the most common mistakes.

IATF 16949 certificates can only be issued by IATF-recognized certification bodies. A certification body’s general management-system accreditation does not by itself establish eligibility to issue IATF 16949 certification — the body must be recognized and contracted by the IATF. A certificate from a body without IATF recognition is not accepted by automotive OEMs, regardless of that body’s accreditation status. Verify recognition on the IATF’s public list at IATF Global Oversight before requesting any quote.

For a full guide to selection, see Best ISO Certification Bodies and Who Can Issue ISO Certification?

A recognized body that also runs training lets you close the competence gap and the certification gap with one provider → BSI Group IATF 16949 Training & Standard

If you are evaluating certification bodies for the first time → confirm IATF recognition before comparing prices. A competitive quote from a non-recognized body is worthless.

IATF 16949 2nd Edition — What’s Changing and When

IATF 16949:2016 remains the only certifiable edition today. But the IATF formally started the revision process in October 2024, and in July 2026 it published Stakeholder Communiqué SC-2026-005 confirming the scope and schedule for the 2nd Edition.

Five priority areas for the revision:

Priority	What the IATF Says It Will Address
Simplification, clarity, and efficiency	Reduce complexity, clarify existing requirements, minimize interpretation variability, avoid duplication with ISO 9001
Software quality assurance	Strengthen the QMS approach for embedded software across the software lifecycle
Tier N supply chain management	More consistent risk-based management of lower-tier suppliers and better deployment of customer requirements
Launch management	More structured approach to new products, change management, and industrialization
Customer-specific requirements	Better identification and management of CSRs; potential incorporation of common CSRs into the standard

Indicative timeline (per SC-2026-005, subject to change):

Phase	Planned Timing
Working draft development	2026
External feedback	2026
Final validation	2027
Translation and supporting documents	2027
Publication	Mid-2027 (planned)
Transition	End of transition aligned with the end of the ISO 9001 transition

The planned 2nd Edition is being developed alongside the ISO 9001 revision and is expected to align structurally with ISO 9001:2026. The IATF has stated that the end of its transition period will coincide with the end of the ISO 9001 transition. Because ISO 9001:2026 is expected to carry a three-year transition, automotive suppliers will effectively be managing two aligned transitions on one calendar. Transition arrangements will be communicated through IATF stakeholder communiqués once the schedule is finalized — treat any specific deadline you see elsewhere as unconfirmed until it appears there.

What this means in practice:

Don’t wait. IATF 16949:2016 remains the certifiable edition today. Organizations starting now should not assume they need to wait for the 2nd Edition — but plan implementation and certification timing with the announced revision schedule in mind.
If your recertification falls in 2027–2028 → plan for the possibility that your recertification audit and your transition audit converge. Talk to your certification body early.
If you carry embedded software in your product → the software quality assurance priority is the change most likely to add work. Start assessing your software development process against your current CSRs now.

For how the ISO 9001 side of this is unfolding, see ISO 9001:2026 Is Coming — What Manufacturers Should Do Right Now.

Common Implementation Mistakes

Manufacturing compliance checklist graphic showing ISO and OSHA requirements with industrial factory background and checklist clipboard — Manufacturing compliance checklist covering ISO standards, OSHA safety requirements, and quality management systems for industrial operations.

IATF 16949 Readiness Checklist

⚠️ Recertification date checked against the 2nd Edition timeline — potential convergence flagged with your certification body

✅ Customer purchase agreements and supplier questionnaires reviewed — IATF 16949 requirement confirmed in writing

✅ ISO 9001:2015 and IATF 16949:2016 both purchased from authorized sources (they are separate documents)

✅ Every customer’s current CSRs downloaded and mapped to QMS clauses

✅ Core tools training completed — APQP (3rd Ed.), Control Plan, PPAP, AIAG-VDA FMEA, SPC, MSA

✅ PFMEA and control plan in place for every production process, with controls verifiable on the floor

✅ Layered process audit program defined with schedule and escalation

✅ Contingency plans documented and tested for production processes

✅ Special characteristics identified, with SPC and MSA evidence for each

✅ Product safety characteristics identified and controlled through design, production, and inspection

✅ Certification body verified as IATF-recognized on the IATF Global Oversight list

⚠️ Recertification date checked against the 2nd Edition timeline — potential convergence flagged with your certification body

Most organizations don’t fail their IATF 16949 audit because they misunderstood the standard — they fail because they assumed ISO 9001 experience covered the gap. Check your operation against the areas auditors flag most → Manufacturing Compliance Checklist

Frequently Asked Questions

What is IATF 16949?

IATF 16949:2016 is the international quality management standard for automotive production and relevant service and accessory parts organizations. It is aligned with ISO 9001:2015 and implemented in conjunction with it, adding automotive-specific requirements including the five core tools (APQP, PPAP, FMEA, SPC, MSA), product safety, layered process audits, and customer-specific requirements.

Does IATF 16949 include ISO 9001?

Not as a document. IATF 16949 is a supplement structured around ISO 9001:2015, and the publisher states ISO 9001 must be purchased separately. An IATF 16949 certification audit does, however, evaluate the QMS against the applicable requirements of both documents.

Who needs IATF 16949 certification?

Organizations that manufacture automotive production, service, or accessory parts — particularly Tier 1 and Tier 2 suppliers whose customers require it. If your purchase agreements name IATF 16949, it is required. PPAP requests alone signal an automotive quality framework, not necessarily a certification requirement — check the contract.

Do I need ISO 9001 before IATF 16949?

No — a separate ISO 9001 certificate is not a prerequisite. But ISO 9001 experience typically shortens IATF 16949 implementation significantly because the QMS foundation is already built, and organizations starting from scratch commonly need 14–22 months versus 8–14 for those already certified.

What are the five automotive core tools?

APQP (Advanced Product Quality Planning), PPAP (Production Part Approval Process), FMEA (Failure Mode and Effects Analysis), SPC (Statistical Process Control), and MSA (Measurement System Analysis). Their methodology is published in AIAG reference manuals and the AIAG-VDA FMEA Handbook, not in IATF 16949 itself.

How long does IATF 16949 certification take?

Organizations with no prior management system typically need 14–22 months. Organizations already ISO 9001 certified typically need 8–14 months. Organizations with ISO 9001 and existing core tools experience can sometimes complete certification in 6–10 months, though customer CSR complexity affects this considerably.

When is the IATF 16949 2nd Edition coming?

The IATF’s July 2026 communiqué (SC-2026-005) gives an indicative publication target of mid-2027, following ISO 9001:2026. The end of the transition period will be aligned with the end of the ISO 9001 transition. Dates are indicative and may change; IATF 16949:2016 remains the only certifiable edition until then.

Can any certification body issue an IATF 16949 certificate?

No. IATF 16949 certification can only be issued by certification bodies specifically recognized by the IATF. General ANAB or UKAS accreditation is necessary but not sufficient. Verify IATF recognition at iatfglobaloversight.org before selecting your certification body.

What is a customer-specific requirement (CSR)?

A CSR is a supplemental requirement published by an automotive OEM that its suppliers must meet alongside IATF 16949. IATF member OEMs each publish their own CSRs covering PPAP levels, FMEA methodology, capability targets, and other topics. Reducing CSR fragmentation is a stated goal of the 2nd Edition.

What is the difference between IATF 16949 and ISO/TS 16949?

ISO/TS 16949 was the predecessor automotive quality standard, jointly managed by ISO and the IATF. IATF 16949:2016 replaced it, incorporating ISO 9001:2015 and strengthening requirements around product safety, supplier quality management, risk-based thinking, and corporate responsibility. ISO/TS 16949 certification is no longer valid.

📥 Free Resources

👉 ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
👉 Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
👉 Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

Still researching whether IATF 16949 applies to you:

🔹 Compare the two standards side by side → ISO 9001 vs IATF 16949 🔹 See what Tier 1 customers actually require of their supply chain → What ISO Standards Do Tier 1 Suppliers Need? 🔹 Understand the broader manufacturing standards landscape → ISO Standards Required for Manufacturing → Quality Standards for Fabrication Shops

Ready to start implementation:

🔹 Build the ISO 9001 foundation with a documentation system, not a consultant → 9001Simplified Documentation Kits 🔹 Train your team with an IATF-recognized body → BSI Group IATF 16949 Training 🔹 Pursue ISO 9001 certification first if you’re starting from zero → ISOQAR ISO 9001 Certification 🔹 Follow the full certification process → ISO 9001 Certification Guide → Best ISO Certification Bodies

Need to buy the standards:

🔹 Where to purchase IATF 16949 and what it costs → Buy IATF 16949 Standard 🔹 Purchase ISO 9001:2015 — required alongside IATF 16949 → ISO 9001:2015 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026 🔹 Buying several ISO standards for an integrated system? Bundles cost less than buying separately → ISO Standards Packages — ANSI Webstore

When IATF 16949 Becomes the Price of Entry to Automotive Supply Chains

ISO 9001 opens most supply chain doors. IATF 16949 opens automotive ones.

The path is clear: build the ISO 9001 foundation, implement the five core tools, address every customer’s specific requirements, and certify through an IATF-recognized body.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

When “We’re Already ISO 9001 Certified” Becomes the Most Expensive Assumption in Automotive

Suppliers that struggle with IATF 16949 usually didn’t misread the standard. They assumed their ISO 9001 system already covered it, and discovered the gap at Stage 2 — with a customer launch date already on the calendar.

Suppliers that succeed map the gap first, train before they document, and confirm their certification body’s IATF recognition before anyone quotes a price.

The Standards Navigator covers automotive quality from the first customer requirement through certification, CSR management, and the coming 2nd Edition transition.

👉 Get updates on IATF 16949, ISO 9001:2026, and automotive supplier compliance
👉 Be first to access new gap assessment tools and readiness checklists

Industrial Compliance. Clearly Explained.

ISO 9001 vs IATF 16949: Key Differences and Which Standard You Actually Need (2026)

ISO 9001 vs IATF 16949: understand the key differences, costs, and requirements for each quality standard. Learn which certification you need for manufacturing or automotive supplier compliance.

How the general quality standard and the automotive supplement differ in scope, requirements, cost, and certification — and how to decide which one your customers require

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Same Structure, Different Stakes

ISO 9001 vs IATF 16949 is a question that tends to arrive with a deadline attached. A customer questionnaire lands in the inbox, a purchase agreement names a standard your shop doesn’t hold, or a prospective automotive customer asks whether you’re “IATF certified” before they’ll send the RFQ.

The two standards share the same ten-clause structure, and IATF 16949 is built directly on ISO 9001:2015. That makes them look closer than they are. In practice, they serve different markets, carry different costs, are audited differently, and answer different customer requirements.

ISO 9001 is the general quality management system standard used across every industry. IATF 16949 is the automotive supplement — a set of additional requirements applied on top of ISO 9001 for organizations manufacturing automotive production, service, and accessory parts. This guide compares them across the dimensions that matter to a manufacturer making the decision, then gives you a framework for choosing.

From the Floor: In operations roles I’ve seen the same pattern from the customer side of the desk more than once: a base quality system that met ISO 9001, and then a customer flow-down document — a railroad or energy-sector specification — that layered specific process controls, traceability rules, and inspection requirements on top of it. Nobody asked whether we were “ISO certified.” They asked whether we met their specification. That’s the right way to read the ISO 9001 vs IATF 16949 question too: the standard your customer names in the contract is the one you’re being measured against, and the general certificate is the floor, not the ceiling.

If you can’t say with certainty which standard your customer contracts actually name, that’s the first gap to close. Check your operation against the compliance points that apply regardless of which certificate you pursue → 👉 Manufacturing Compliance Checklist — 50 items covering ISO 9001, 14001, 45001, and OSHA, with gap scoring

In This Guide

ISO 9001 vs IATF 16949 at a glance
What each standard is and who it’s for
How the two standards relate — the supplement model
Side-by-side comparison: scope, requirements, audits, cost, timeline
The automotive-specific requirements that have no ISO 9001 equivalent
The five Core Tools and what they demand
Certification differences: bodies, audit method, surveillance
Illustrative cost and timeline planning ranges
Which standard your organization needs — decision framework
Common mistakes and a readiness checklist

👉 Start Here (Top Resources)

👉 Purchase ISO 9001:2015 — the foundation for both paths → ISO 9001:2015 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

👉 Build the ISO 9001 documentation your QMS sits on → 9001Simplified Documentation Kits

👉 IATF 16949 training and certification from an IATF-recognized body → BSI Group IATF 16949 — Training & Certification

👉 Get ISO 9001 certified with an accredited body → ISOQAR ISO 9001 Certification

ISO 9001 vs IATF 16949 at a Glance

Question	ISO 9001:2015	IATF 16949:2016
What is it?	General QMS standard for any industry	Automotive QMS supplement built on ISO 9001
Who publishes it?	ISO	The IATF, through its national associations (AIAG, SMMT, VDA QMC, ANFIA, FIEV)
Who needs it?	Any organization whose customers require a certified QMS	Automotive production, service, and accessory part suppliers whose customers require it
Standalone document?	Yes	No — implemented in conjunction with ISO 9001:2015, purchased separately
Who can certify?	Accredited certification bodies	IATF-recognized certification bodies only
Core Tools required?	No	Applied where applicable — APQP, PPAP, FMEA, SPC, MSA; customer requirements may specify methodology
Customer-specific requirements?	Not part of the standard	Applicable OEM/customer CSRs must be identified and addressed
Current edition	ISO 9001:2015, with ISO 9001:2026 scheduled for publication September 16, 2026	IATF 16949:2016, with a 2nd Edition planned for mid-2027
Typical first-year budget (illustrative)	$8,000–$75,000

Buy IATF 16949 standard guide showing automotive quality management booklet, ISO 9001 documents, cost savings, and official purchase options — Learn where to buy the official IATF 16949 standard, understand pricing, and explore cost-saving bundle options for automotive compliance.

What Is ISO 9001?

ISO 9001:2015 — Quality Management Systems — Requirements — is the international standard for quality management systems, published by ISO and applicable to any organization in any sector. It defines what a QMS must do — leadership commitment, process approach, risk-based thinking, customer focus, competence, control of production, monitoring and measurement, nonconformance handling, and continual improvement — without prescribing industry-specific methods.

ISO 9001 is the most widely adopted management system standard in the world and the foundation on which sector schemes such as IATF 16949 (automotive), AS9100 (aerospace), and ISO 13485 (medical devices) are built.

For manufacturers, ISO 9001 certification is commonly a customer requirement in general industrial, fabrication, machining, and contract manufacturing markets. For the full requirements, see the ISO 9001 Certification Guide and ISO 9001 Clauses Explained.

ISO 9001:2026 is coming

The FDIS has been approved and ISO has scheduled publication of ISO 9001:2026 for September 16, 2026, with a three-year transition to follow. The changes are evolutionary rather than structural. If you’re deciding between the two standards now, this doesn’t change the decision — but it does set the timing: ISO 9001 changes first, and IATF 16949 follows, with the IATF’s 2nd Edition planned for mid-2027 and its transition tied to the ISO 9001 schedule. See ISO 9001:2026 Is Coming — What Manufacturers Should Do Right Now.

What Is IATF 16949?

IATF 16949:2016 — Quality Management System Requirements for Automotive Production and Relevant Service Parts Organizations — is the quality management standard for the global automotive supply chain, developed by the International Automotive Task Force (IATF). It replaced ISO/TS 16949 in 2016.

IATF 16949 follows the ISO 9001:2015 clause structure exactly and inserts automotive-specific requirements as numbered sub-clauses at the points where they apply. It is not a standalone document: AIAG, its U.S. publisher, describes it as a supplement implemented in conjunction with ISO 9001:2015, which must be purchased separately. An IATF 16949 certification audit evaluates the QMS against the applicable requirements of both documents.

IATF member OEMs — Ford, GM, Stellantis, Volkswagen Group, BMW Group, Mercedes-Benz, Renault — require it from direct production-part suppliers, and Tier 1 suppliers commonly flow the requirement down to Tier 2. For the complete guide, see What Is IATF 16949?

If your customers are outside automotive → IATF 16949 is not your standard. Pursue ISO 9001 and any sector scheme your market actually requires.

If a customer contract names IATF 16949 → ISO 9001 alone will not satisfy it, no matter how mature your system is.

How the Two Standards Relate

The relationship is easy to misstate, so here is the precise version:

ISO 9001 is the base standard. It stands alone.
IATF 16949 is a supplement. It adds automotive requirements to ISO 9001’s structure but does not reproduce ISO 9001’s text.
An organization implementing IATF 16949 works from both documents — ISO 9001’s requirement at each clause, then IATF’s additions at that clause.
An IATF 16949 certificate is issued by an IATF-recognized body after an audit against the applicable requirements of both standards. A separate ISO 9001 certificate is not a prerequisite, though many suppliers hold one first.
An ISO 9001 certificate alone does not satisfy an IATF 16949 requirement.

For what to purchase and what it costs, see Buy IATF 16949 Standard and Buy ISO 9001.

Side-by-Side Comparison

Dimension	ISO 9001:2015	IATF 16949:2016	Key Difference
Scope	Any industry, any size	Automotive production, service, and accessory parts	IATF is sector-specific by design
Structure	10 clauses (Annex SL)	Same 10 clauses plus automotive sub-clauses	Structure identical; content expanded
Product safety	Addressed generally through risk-based thinking	Explicit product safety requirements and special characteristics	IATF makes it a defined requirement
Defect prevention	Encouraged	Addressed through APQP, FMEA, and control plans	IATF incorporates automotive-specific planning and control methods
Core Tools	Not referenced	Applied where applicable; customer requirements may specify methodology	Automotive-specific tools and methods are incorporated into the QMS
Customer-specific requirements	Not part of the standard	Applicable OEM/customer CSRs must be identified and addressed	Adds a customer-driven layer of requirements
Layered process audits	Not required	Required program at multiple organizational levels	No ISO 9001 equivalent
Contingency planning	General risk planning	Documented, tested contingency plans for production processes	IATF is prescriptive
Supplier management	Evaluate, select, monitor	Evaluate, select, monitor, and actively develop sub-tier QMS capability	IATF requires development
Warranty management	Not addressed	Warranty claims, warranty part analysis, NTF analysis	No ISO 9001 equivalent
Embedded software	Not addressed	Software development and assessment requirements	No ISO 9001 equivalent
Corporate responsibility	Not addressed	Anti-bribery, code of conduct, ethics escalation policy	No ISO 9001 equivalent
Certification body	Any accredited body	IATF-recognized bodies only	Narrower pool
Audit method	Clause-based system audit	Process, product, and system audits under the IATF Rules	More audit days for the same organization

Requirements With No ISO 9001 Equivalent

These are the additions that carry significant operational weight when moving from ISO 9001 to IATF 16949.

Product safety and special characteristics. IATF 16949 requires identification of product safety characteristics — features whose failure could create a hazard or regulatory non-compliance — and defined handling for them through design, production, and inspection. ISO 9001 addresses safety only through general risk-based thinking.

The Core Tools. ISO 9001 does not reference APQP, PPAP, FMEA, SPC, or MSA. IATF 16949 requires them where applicable, and auditors evaluate their implementation specifically.

Customer-specific requirements. Every IATF member OEM publishes CSRs that supplement the standard. They cover PPAP submission levels, FMEA methodology, capability targets, controlled shipping, and second-party audit expectations. They are living documents — several OEMs reissued theirs in 2025–2026 — and each customer’s current version must be addressed in the QMS.

Layered process audits. A structured program of process audits at operator, supervisor, manager, and executive levels on a defined frequency. This requirement is one that organizations moving from ISO 9001 commonly underestimate, because it has no counterpart in their existing system.

Contingency planning. Documented plans for equipment failure, supplier disruption, utility interruption, and natural events — tested and reviewed, not just written.

Sub-tier supplier development. Active development of suppliers’ QMS capability, with the Minimum Automotive Quality Management System Requirements for Sub-Tier Suppliers (MAQMSR) identified as a possible intermediate step.

Warranty, embedded software, and corporate responsibility. Three areas ISO 9001 does not address at all.

If you are already ISO 9001 certified and moving to IATF 16949 → focus your gap assessment on these items first. Your internal audit, management review, document control, and corrective action infrastructure carries over; these requirements are net-new.

A common planning mistake is treating the move from ISO 9001 to IATF 16949 as incremental documentation. The requirements above are operational programs, not procedures. Map them before you commit to a certification date → 👉 ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or extending a QMS

The Five Automotive Core Tools

The five commonly recognized automotive Core Tools are among the most distinctive and operationally demanding elements of IATF 16949, and where it diverges most visibly from ISO 9001 in day-to-day practice. IATF 16949 tells you where they apply; the AIAG reference manuals (and the joint AIAG-VDA FMEA Handbook) tell you how to do them.

Core Tool	What It Is	Current Reference	ISO 9001 Equivalent
APQP	Structured product and process quality planning before production	AIAG APQP 3rd Ed. and Control Plan 1st Ed. (2024)	None — ISO 9001 requires planning, not this method
PPAP	Formal evidence that the production process can consistently produce conforming parts	AIAG PPAP 4th Ed.	None
FMEA	Systematic analysis of design and process failure modes	AIAG-VDA FMEA Handbook (2019)	None — risk-based thinking is general
SPC	Statistical monitoring of process variation	AIAG SPC 2nd Ed.	None — ISO 9001 requires monitoring, not this method
MSA	Evaluation of whether measurement systems can detect the variation being controlled	AIAG MSA 4th Ed.	None — calibration (7.1.5) is narrower

PPAP submission levels

PPAP has five levels, set by the customer:

Level 1 — Part Submission Warrant (PSW) only
Level 2 — PSW with product samples and limited supporting data
Level 3 — PSW with product samples and complete supporting data (the common default)
Level 4 — PSW and other requirements as defined by the customer
Level 5 — PSW with product samples and complete supporting data, reviewed at the supplier’s location

For many automotive programs, customer PPAP approval is a key release gate between production validation and authorized production, though arrangements vary by customer.

Capability targets

Automotive customers commonly specify capability targets such as Cpk ≥ 1.33 or 1.67 for certain characteristics. The applicable target comes from the customer’s requirements, control plan, or CSR — not from a universal IATF 16949 threshold. ISO 9001 has no capability requirement at all.

Certification Differences

Aspect	ISO 9001	IATF 16949
Who can certify	Any accredited certification body	IATF-recognized certification bodies only — general accreditation alone does not qualify a body
Governing rules	Accreditation body requirements (ANAB, UKAS, etc.)	IATF Rules for Achieving and Maintaining IATF Recognition, 6th Edition (effective Jan 1, 2025)
Stage 1	Readiness / documentation review	Readiness assessment including automotive-specific requirements, core tools evidence, and CSR coverage
Stage 2	Clause-based system audit	Process audits (against PFMEA and control plan), product audits, and system audit
Surveillance	Periodic surveillance in a three-year cycle	Surveillance during the three-year cycle per the IATF scheme; recertification before expiry
Audit days	Based on employee count	Generally more days for the same organization, reflecting core tools, CSRs, and process/product audit method

The certification-body point is an expensive one to get wrong. An IATF 16949 certificate from a body without IATF recognition is not accepted by automotive OEMs regardless of that body’s accreditation. Verify recognition on the public list at IATF Global Oversight before requesting any IATF quote.

For selection guidance, see Best ISO Certification Bodies and Who Can Issue ISO Certification?

→ An IATF-recognized body that also delivers Core Tools and internal auditor training covers both the competence and the certificate → BSI Group IATF 16949 — Training & Certification

Cost and Timeline — Illustrative Planning Ranges

These are planning ranges, not published fees. Actual costs vary substantially with employee count, audit scope, number of manufacturing processes, sites, existing QMS maturity, training needs, consulting support, and customer-specific requirements.

First-year budget

Organization Size	ISO 9001 Only	IATF 16949 (incl. ISO 9001 foundation)
Small (1–25 employees)	$8,000–$18,000	$20,000–$40,000
Mid-size (26–200 employees)	$15,000–$40,000	$40,000–$100,000
Large (200+ employees)	$30,000–$75,000	$80,000–$200,000+

The IATF premium reflects Core Tools implementation and training, CSR compliance work, more audit days, and the narrower certification-body pool.

Standards document costs

The documents themselves are a small share of either budget. ISO 9001:2015 lists at $293 for a single-user PDF through the ANSI Webstore (5% off with coupon CC2026 → apply here). IATF 16949:2016 lists at $177 non-member / $60 member from AIAG, which also sells an IATF 16949 / ISO 9001:2015 2-Pack at $391 / $288. If you are evaluating ISO 9001 alongside ISO 14001 or ISO 45001 for an integrated system, buying them together as a package saves meaningfully compared to purchasing separately. IATF 16949 is not sold on the ANSI Webstore.

Timeline planning ranges

Starting Point	ISO 9001	IATF 16949
No management system	6–12 months	14–22 months
ISO 9001 certified	—	8–14 months
ISO 9001 certified with Core Tools experience	—	6–10 months

These are planning estimates rather than mandated timelines; scope, site complexity, CSR load, and product development activity all move them.

The common objection — “Should we skip ISO 9001 and go straight to IATF?” You can: a separate ISO 9001 certificate is not a prerequisite for IATF 16949. But the IATF audit still evaluates you against ISO 9001’s requirements, so the ISO 9001 work isn’t skipped — it’s absorbed into a larger project. For a shop with no existing management system and non-automotive customers as well, ISO 9001 first is often the lower-risk sequence: it produces a certificate that serves the rest of your customer base while the automotive layer is built. For a shop with a signed automotive contract and a launch date, go straight to IATF with ISO 9001 built in.

For full cost detail, see How Much Does ISO Certification Cost? and the ISO Certification Cost Calculator; for timing, How Long Does ISO Certification Take?

If you’re starting the ISO 9001 side from scratch, a structured documentation system shortens the foundation build → 9001Simplified Documentation Kits

Customer-Specific Requirements — What OEMs Actually Mandate

IATF 16949 certification alone does not satisfy all automotive OEM requirements. Each major OEM publishes Customer-Specific Requirements (CSRs) that supplement IATF 16949 and must be met specifically for that customer’s supply chain.

Major OEM CSR publishers:

Ford Motor Company — Ford CSR
General Motors — GM CSR
Stellantis — Stellantis CSR
Toyota — Toyota CSR
Volkswagen Group — VW CSR
BMW Group — BMW CSR
Mercedes-Benz — Mercedes CSR

CSRs vary significantly between OEMs — what one OEM requires may differ substantially from another. Organizations supplying multiple OEMs must ensure their QMS addresses each customer’s specific CSRs simultaneously.

Tier 1 to Tier 2 flow-down: Tier 1 suppliers typically flow down IATF 16949 requirements — and often their OEM’s specific CSRs — to their Tier 2 component suppliers. This is why fabrication shops and component manufacturers supplying Tier 1 customers frequently find IATF 16949 requirements in their purchase agreements even when they never supply directly to an OEM.

For the full picture of what Tier 1 suppliers require from their supply chain, see What ISO Standards Do Tier 1 Suppliers Need?

Which Standard Does Your Organization Need?

The decision is driven by customers, not preference.

Choose ISO 9001 if:

Your customers are in general industrial, fabrication, machining, energy, construction, or contract manufacturing markets
No customer contract or supplier questionnaire names IATF 16949
You supply automotive only indirectly — tooling, equipment, consumables, or services not incorporated into the vehicle
You want a QMS certificate recognized across every industry you serve

Choose IATF 16949 if:

A customer purchase agreement or supplier requirement names IATF 16949
You manufacture automotive production, service, or accessory parts and meet the IATF eligibility requirements — including eligible EV charging systems and related components, recognized as accessory parts since March 2024
You are a Tier 2 supplier whose Tier 1 customer flows the requirement down
You are pursuing automotive customers who require it as a condition of the RFQ

Choose both — or sequence them — if:

You serve automotive and non-automotive customers from the same facility. The IATF certification scope applies to the eligible automotive activities, while organizations may maintain ISO 9001 certification for broader non-automotive activities depending on their scope and business requirements
You are building toward automotive but don’t yet have a contract. ISO 9001 first, with Core Tools training running in parallel, positions you to add the automotive layer when the contract lands

If you are under customer pressure to certify quickly → confirm the exact standard named in the contract, select an IATF-recognized certification body, and schedule Core Tools training before you write a single procedure. Those are the longest lead items.

ISO standards for Tier 1 suppliers including automotive, aerospace, and medical industries with certification checklist and compliance icons — ISO standards required for Tier 1 suppliers across automotive, aerospace, and medical industries

Common Mistakes in the ISO 9001 vs IATF 16949 Decision

Assuming ISO 9001 will satisfy an automotive customer. If the contract names IATF 16949, it won’t — regardless of how mature the ISO 9001 system is.

Pursuing IATF 16949 without a customer who requires it. The IATF path generally carries higher implementation and certification costs because of the additional automotive requirements, Core Tools, customer-specific requirements, training, and audit scope. Without an automotive customer or a credible path to one, ISO 9001 is generally the more broadly applicable certification.

Treating the move from ISO 9001 to IATF 16949 as incremental documentation. The Core Tools, CSRs, layered process audits, and audit method are operational programs that require training and floor discipline, not new procedures in the manual.

Selecting a certification body before confirming IATF recognition. General accreditation does not qualify a body for IATF 16949. Check the IATF list first.

Ignoring customer-specific requirements. Certification without CSR compliance fails the customer’s own supplier audit. CSRs are living documents — check the current version for every OEM.

Reading the two documents as one. IATF 16949 does not contain ISO 9001’s text. Implementation teams and internal auditors need both.

Decision Checklist

✅ Current and target customer contracts and supplier questionnaires reviewed — the standard each one names is confirmed in writing
✅ Products classified: automotive production/service/accessory parts vs. indirect supply
✅ If IATF applies: every customer’s current CSRs downloaded and dated
✅ ISO 9001:2015 purchased (both paths); IATF 16949:2016 purchased if applicable
✅ Gap assessment scoped to the requirements with no ISO 9001 equivalent (product safety, Core Tools, CSRs, layered audits, contingency planning, supplier development)
✅ Core Tools training budgeted before documentation work begins (IATF path)
✅ Certification body verified — accredited (ISO 9001) or IATF-recognized (IATF 16949)
✅ Timeline planned against ISO 9001:2026 and IATF 16949 2nd Edition transition schedules
⚠️ Recertification dates in 2027–2028 flagged for possible convergence with transition audits

Frequently Asked Questions

What is the difference between ISO 9001 and IATF 16949?

ISO 9001 is the general quality management standard applicable to any industry. IATF 16949 is an automotive supplement built on ISO 9001’s structure that adds sector-specific requirements — product safety, the five Core Tools, customer-specific requirements, layered process audits, contingency planning, and sub-tier supplier development — and can only be certified by IATF-recognized bodies.

Does IATF 16949 include ISO 9001?

Not as a document. IATF 16949 is implemented in conjunction with ISO 9001:2015, which is purchased separately. An IATF 16949 certification audit evaluates the QMS against the applicable requirements of both standards.

Can I hold both ISO 9001 and IATF 16949 certificates?

Yes. Some organizations hold both — IATF 16949 for automotive scope and ISO 9001 for other business — while others scope a single IATF 16949 system to cover the facility. The right approach depends on your customer mix and how your certification body scopes the audit.

Is IATF 16949 harder than ISO 9001?

It is more demanding. The Core Tools, CSR compliance, layered process audits, and process/product audit method add substantial operational requirements beyond ISO 9001, and IATF audits generally require more audit days for the same organization size.

How much more does IATF 16949 cost than ISO 9001?

As illustrative planning ranges, first-year IATF 16949 budgets commonly run roughly two to three times the equivalent ISO 9001 budget for the same organization size, driven by Core Tools implementation and training, CSR work, and additional audit days. Actual costs vary widely.

Can any certification body issue IATF 16949?

No. Only IATF-recognized certification bodies can issue IATF 16949 certificates. General accreditation alone does not qualify a body. Verify recognition on the IATF Global Oversight list.

Are ISO 9001 and IATF 16949 both being revised?

Yes. ISO 9001:2026 is scheduled for publication on September 16, 2026, with a three-year transition. The IATF confirmed in July 2026 that a 2nd Edition of IATF 16949 is planned for mid-2027, with its transition ending in line with the ISO 9001 transition. Both current editions remain fully certifiable until then.

What are the five Core Tools?

APQP (Advanced Product Quality Planning), PPAP (Production Part Approval Process), FMEA (Failure Mode and Effects Analysis), SPC (Statistical Process Control), and MSA (Measurement System Analysis). Their methodology lives in the AIAG reference manuals and the AIAG-VDA FMEA Handbook, not in IATF 16949 itself. ISO 9001 does not reference them.

📥 Free Resources

👉 ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
👉 Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
👉 Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

Still deciding which standard applies:

🔹 Understand the automotive standard in full → What Is IATF 16949? 🔹 See what your customer tier actually flows down → What ISO Standards Do Tier 1 Suppliers Need? 🔹 Map the wider landscape for your shop type → ISO Standards Required for Manufacturing → ISO 9001 Requirements for Fabricators

Ready to start:

🔹 Build the ISO 9001 foundation with a documentation system, not a consultant → 9001Simplified Documentation Kits 🔹 ISO 9001 certification with an accredited body → ISOQAR ISO 9001 Certification 🔹 IATF 16949 training and certification with an IATF-recognized body → BSI Group IATF 16949 — Training & Certification 🔹 Train the team on the ISO 9001 foundation → BSI Group ISO 9001 Training 🔹 Follow the certification path step by step → How to Get ISO 9001 Certified

Need to buy the standards:

🔹 ISO 9001:2015 — the foundation for both paths → ISO 9001:2015 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026 🔹 Where to buy IATF 16949 and what to buy with it → Buy IATF 16949 Standard 🔹 Building an integrated system with ISO 14001 or 45001? Packages cost less than separate purchases → ISO Standards Packages — ANSI Webstore

Let the Contract Decide

ISO 9001 and IATF 16949 share a structure, not a purpose. One is the general quality standard your customers across every industry recognize; the other is the automotive supplement your automotive customers require. The standard named in your purchase agreements is the one you’re being measured against — start there, build the ISO 9001 foundation either way, and add the automotive layer when your customer requirements and business strategy call for it.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

When “We’re ISO 9001 Certified” Isn’t the Answer the Customer Was Looking For

A common way to get this decision wrong is to make it by assumption — assuming either that ISO 9001 would satisfy an automotive customer, or that IATF 16949 was worth pursuing without a customer who required it.

Organizations that get it right read the contract, classify their products, confirm the certification body’s recognition, and sequence the two standards around the customers they actually have.

The Standards Navigator covers quality management standards from the first customer requirement through certification and the coming ISO 9001:2026 and IATF 16949 2nd Edition transitions.

👉 Get updates on ISO 9001, IATF 16949, and manufacturing quality compliance
👉 Be first to access new gap assessment tools and decision checklists

Industrial Compliance. Clearly Explained.

Your Risk Management File Is the First Thing an Auditor Opens

In This Guide

Table of Contents

👉 Start Here: Top Resources for Medical Device Risk Management

What ISO 14971:2019 Requires

How ISO 13485 Clause 7.1 Connects

The Five-Stage Risk Management Process

Stage 1: Risk Management Plan

Stage 2: Risk Analysis

Stage 3: Risk Evaluation

Stage 4: Risk Control

Stage 5: Residual Risk and Benefit-Risk Analysis

Setting Acceptable Risk Criteria

Risk Control Options and Residual Risk

The Risk Management File

Post-Production Information and Surveillance

Common Audit Findings in Risk Management Reviews

Training for Your Risk Management Team

FAQ

What is the difference between ISO 14971 and ISO 13485 for risk management?

Is ISO 14971 mandatory?

What is a risk management file?

How often should a risk management file be updated?

What risk analysis methods does ISO 14971 require?

What is the difference between a hazard, a hazardous situation, and harm in ISO 14971?

How does ISO 14971 relate to CAPA in ISO 13485?

What changed in ISO 14971:2019 compared to the 2007 edition?

📥 Free Resources

Not Sure What to Do Next?

Stay Current on Medical Device Compliance

Subscribe

The Standard That Governs Automotive Supply Chains Worldwide

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Is IATF 16949?

Who Developed IATF 16949?

Why IATF 16949 Replaced ISO/TS 16949

Who Needs IATF 16949?

What IATF 16949 Requires Beyond ISO 9001

The Five Automotive Core Tools

APQP — Advanced Product Quality Planning

PPAP — Production Part Approval Process

FMEA — Failure Mode and Effects Analysis

SPC — Statistical Process Control

MSA — Measurement System Analysis

Customer-Specific Requirements

What IATF 16949 Certification Audits Involve

Certification Costs and Timeline

Illustrative First-Year Budget Ranges

Practical Planning Ranges

How to Choose an IATF-Recognized Certification Body

IATF 16949 2nd Edition — What’s Changing and When

Common Implementation Mistakes

Frequently Asked Questions

What is IATF 16949?

Does IATF 16949 include ISO 9001?

Who needs IATF 16949 certification?

Do I need ISO 9001 before IATF 16949?

What are the five automotive core tools?

How long does IATF 16949 certification take?

When is the IATF 16949 2nd Edition coming?

Can any certification body issue an IATF 16949 certificate?

What is a customer-specific requirement (CSR)?

What is the difference between IATF 16949 and ISO/TS 16949?

📥 Free Resources

Not Sure What to Do Next?

When IATF 16949 Becomes the Price of Entry to Automotive Supply Chains

When “We’re Already ISO 9001 Certified” Becomes the Most Expensive Assumption in Automotive

Subscribe

Same Structure, Different Stakes

In This Guide

Table of Contents

👉 Start Here (Top Resources)

ISO 9001 vs IATF 16949 at a Glance

What Is ISO 9001?

ISO 9001:2026 is coming

What Is IATF 16949?

How the Two Standards Relate

Side-by-Side Comparison