Certification logos appear on almost every manufacturing supplier’s website, and they all look equally reassuring. They are not equivalent. Some are general quality management standards, some are industry requirements without which a supplier cannot legally or commercially serve a sector, and some are voluntary marks of a particular practice.
Knowing which is which matters in two directions. Specifying a certification your part does not need narrows your supplier pool and raises cost for no benefit. Failing to specify one your customer requires produces a supply chain problem that surfaces late, usually during a customer audit, when changing supplier is expensive.
This guide covers what the main standards actually require, who needs them, and how to verify a certificate properly.
ISO 9001: The Baseline
What it is: a general quality management system standard applicable to any organisation in any industry. The current version is ISO 9001:2015.
What it requires: documented processes, defined responsibilities, control of documents and records, management review, corrective action processes, supplier control, and a risk-based approach to planning.
What it does not tell you: whether the supplier makes good parts. ISO 9001 confirms that a system exists and is followed. A supplier can be fully compliant while producing parts that do not meet your requirements, provided their system documents that consistently.
This is not a criticism of the standard, which does what it is designed to do. It is a caution against reading it as a quality guarantee.
Who needs it: effectively any credible manufacturing supplier. Treat it as a minimum entry requirement rather than a differentiator. A supplier without ISO 9001 is unusual and warrants explanation.
IATF 16949: Automotive
What it is: the automotive sector quality standard, built on ISO 9001 with substantial additional automotive-specific requirements. It replaced ISO/TS 16949.
What it adds: defect prevention rather than detection, reduction of variation and waste in the supply chain, and a set of specific tools that automotive supply chains use throughout.
Those tools matter practically because they define how you and the supplier will work together:
- APQP, advanced product quality planning, structures the launch process through defined phases and gates
- PPAP, production part approval process, is the documented submission proving a part meets requirements before production approval
- FMEA, failure mode and effects analysis, systematically identifies what could go wrong and what controls prevent it
- MSA, measurement systems analysis, verifies that the measurement system itself is capable
- НПЦ, statistical process control, monitors process stability over time
Who needs it: suppliers into automotive OEM and tier one supply chains, where it is generally mandatory rather than preferred. Certification requires an active automotive customer, so a supplier cannot hold it speculatively.
When to specify it: if your part goes into a vehicle, or your customer is an automotive tier supplier, this is likely a hard requirement. If your part does not touch automotive, specifying IATF narrows your options considerably for no benefit.
A useful side effect: IATF-certified suppliers tend to have strong discipline around documentation and process control generally, which some non-automotive buyers value even without needing the certificate itself.
ISO 13485: Medical Devices
What it is: the quality management standard for medical device manufacturing. Based on ISO 9001 but adapted for regulatory purposes.
What it adds: stronger emphasis on risk management throughout the product lifecycle, on regulatory compliance, on documentation and record retention, on traceability, and on validation of processes whose output cannot be fully verified by inspection.
Notably, ISO 13485 removes some of ISO 9001’s emphasis on continual improvement and customer satisfaction in favour of consistent regulatory compliance. The reasoning is that in a regulated environment, demonstrable consistency and traceability matter more than improvement initiatives.
Who needs it: suppliers producing components for medical devices, particularly where the component affects device safety or performance. Requirements vary by device classification and market.
A common misunderstanding: ISO 13485 certification of your supplier does not make your device compliant. Device-level regulatory approval is a separate matter involving your own quality system and submissions. Supplier certification supports your compliance rather than delivering it.
When to specify it: if the component goes into a medical device, particularly a higher-risk classification. For non-critical accessories, requirements may be lighter, and this is worth checking against your regulatory pathway rather than assuming.
AS9100: Aerospace
What it is: the aerospace quality standard, built on ISO 9001 with additional requirements for aviation, space and defence.
What it adds: configuration management, counterfeit part prevention, product safety, risk management, and stringent requirements around special processes such as heat treatment, welding and non-destructive testing.
Who needs it: suppliers into aerospace supply chains, where it is usually mandatory at tier one and often flowed down further.
ISO 14001: Environmental
What it is: an environmental management system standard, not a quality standard.
What it covers: identification of environmental aspects and impacts, legal compliance, objectives and monitoring, and emergency preparedness.
Who needs it: increasingly requested by large corporate customers as part of supply chain sustainability requirements. It says nothing about part quality and should not be treated as a quality signal.
Comparison
| Стандарт | Scope | Typically required for | Builds on |
| ISO 9001 | General quality management | Any manufacturing supplier | Базовый уровень |
| IATF 16949 | Automotive quality | Automotive OEM and tier supply | ISO 9001 |
| ISO 13485 | Medical device quality | Medical device components | ISO 9001 |
| AS9100 | Aerospace quality | Aerospace and defence supply | ISO 9001 |
| ISO 14001 | Environmental management | Corporate sustainability requirements | Independent |
Verifying a Certificate Properly
A logo on a website is not evidence. Certificates are routinely displayed after expiry, held by a related entity rather than the manufacturing site, or scoped to activities other than the one you need.
Request the certificate document itself, not a logo or a statement.
Check the certification body. Certificates are issued by accredited bodies, and the certificate names the issuer and usually the accreditation. An unfamiliar issuer warrants checking whether it is accredited by a recognised national body.
Check the expiry date. Certificates run on fixed cycles with surveillance audits between. An expired certificate means the supplier either failed to maintain it or has not updated their documentation.
Check the scope statement. This is the most commonly missed check. A certificate covers specific activities at a specific site. A supplier certified for “assembly of electronic components” is not certified for your Обработка на станках с ЧПУ work, even though the certificate is genuine.
Check the site address. Multi-site organisations may certify one facility and not another. Confirm the certificate covers the site that will make your parts.
Verify with the issuing body where it matters. Most certification bodies maintain searchable registries. For significant programmes this check takes minutes and occasionally finds problems.
What Certification Does Not Tell You
Certification confirms a system, not an outcome. Several things matter equally and are not covered.
Inspection capability. What can the supplier actually measure? Named coordinate measuring machines, calibration records and staff able to interpret GD&T are what turn a tolerance claim into a verified one.
Process capability for your specific part. A certified supplier may be excellent at parts unlike yours. Capability is part-specific.
Engineering depth. Whether a supplier reviews your drawing and returns substantive comments before quoting says more about their engineering capability than any certificate.
Commercial reliability. Delivery performance, communication quality and behaviour when something goes wrong are not audited by any of these standards.
Use certification as a filter for eligibility, then assess the rest separately.
Specifying Sensibly
Ask what your customer or regulatory pathway actually requires, and specify that. Do not add certifications defensively, because each one narrows your supplier pool and adds cost that flows into your part price.
Where you want the discipline associated with a standard without needing the certificate, you can specify the practices directly. Requiring PPAP-style submission documentation, for example, is possible without requiring IATF certification, and many capable suppliers will provide it.
Where a certification is genuinely required, verify it properly and re-verify periodically, since certificates lapse and scopes change.
In Practice
For most industrial and consumer components, ISO 9001 plus demonstrated inspection capability and good engineering communication is the right bar. For automotive, IATF is usually non-negotiable. For medical, ISO 13485 scoped to the relevant activity. For aerospace, AS9100.
Elite Mold Tech maintains documented quality assurance processes across CNC machining, molding and assembly, with inspection documentation available as part of standard supply. Certification documents with issuing body and scope are available on request at quotation stage rather than after commitment.
Часто задаваемые вопросы
Q: Is ISO 9001 enough for my supplier?
A: For most general industrial and consumer components, yes, provided you also verify inspection capability separately. Automotive, medical and aerospace work generally require the relevant sector-specific standard in addition.
Q: Does IATF 16949 replace ISO 9001?
A: It builds on it rather than replacing it, adding automotive-specific requirements including APQP, PPAP, FMEA and SPC. IATF-certified suppliers meet ISO 9001 requirements as part of the standard.
Q: Does my supplier need ISO 13485 for medical parts?
A: It depends on device classification and how the component affects safety or performance. Check your regulatory pathway rather than assuming, since requirements for non-critical accessories may be lighter.
Q: How do I check a certificate is genuine?
A: Request the certificate document, check the issuing body and accreditation, verify the expiry date, and confirm the scope and site address cover your work. Most certification bodies maintain searchable registries.
Q: Does certification guarantee good parts?
A: No. It confirms a documented system exists and is followed, not that output meets your requirements. Assess inspection capability, engineering depth and process capability for your specific part separately.
