ISO 9001 vs AS9100 vs IATF 16949 in CNC machining

A certificate number on a quotation is a compressed statement about how a shop is organised — what it documents, who audits it, how often, and what happens when something goes wrong. The three schemes a machining buyer meets most often share a core and diverge sharply in what they oblige a shop to prove.

This article sets out ISO 9001 vs AS9100 vs IATF 16949 from a buyer’s point of view: what each requires, how each certification is governed and verified, what each adds to your documentation package, and how to decide which one your part genuinely needs.

What this article covers

• What does a quality certificate actually guarantee?
• ISO 9001: the base management system
• AS9100D: ISO 9001 plus the aerospace requirements
• IATF 16949: ISO 9001 plus automotive discipline
• Side by side: what each standard obliges a machine shop to do
• Which certificate does your part actually need?
• What does each certificate cost you as a buyer?
• How do you verify that a certificate is real and in scope?
• What MW+ holds and what ships with an order
• When a certificate is the wrong thing to ask for
• Frequently asked questions

What does a quality certificate actually guarantee?

It guarantees that a third-party auditor, accredited under ISO/IEC 17021-1, found documented processes in place and evidence that they are followed. It does not guarantee that your part will be in tolerance, that the shop has the machines your geometry needs, or that its scope of certification covers the process you are buying.

That last point is the one buyers miss. A certificate carries a defined scope — the activities and sites it applies to. A shop certified for “CNC machining of metallic components” at one address is not certified for the anodising it subcontracts, nor for a second facility across town. Read the scope line before the standard number.

The second thing a certificate does not do is set a numeric quality target. None of the three standards states an acceptable defect rate; they require that you define, measure and act on one. The arithmetic behind those figures is covered separately in our article on CNC defect rate benchmarks.

ISO 9001: the base management system

ISO 9001 is sector-neutral. It requires an organisation to understand its context, identify risks, define processes with inputs and outputs, control documented information, manage nonconforming output and improve on measured data. Everything else here is built on that skeleton.

What the 2026 edition changes

ISO 9001:2026 was published on 16 September 2026 and supersedes the 2015 edition, which iso.org now lists as withdrawn along with its 2024 amendment. Certification does not lapse on publication day: organisations transition inside the timeframe their certification body sets, normally mapped onto the existing three-year cycle. A certificate still naming the 2015 edition is expected during the transition window — ask for the transition plan and target date, not why they have not already moved.

What ISO 9001 does not require

Four omissions matter for machined parts: ISO 9001 mandates no first article inspection, no key-characteristic control, no statistical process control or capability study, and says nothing about counterfeit material. Many good shops do all four — but the certificate is not evidence of any of them. If you need them, they belong in the purchase order.

AS9100D: ISO 9001 plus the aerospace requirements

AS9100D, published in 2016, contains the full text of ISO 9001:2015 with aviation, space and defence requirements added in the same clause structure. The additions are the reason it exists.

The aerospace-specific additions

• First article inspection. A documented FAI to AS9102 is required before series production of a new part number, and again after defined changes to design, process, tooling or location.
• Key characteristics. Features whose variation affects fit, form, function or safety must be identified, controlled and monitored — variation data, not a pass/fail stamp.
• Configuration management. Drawing revisions, deviations and concessions are formally controlled; an undocumented change is a nonconformity in itself.
• Counterfeit part prevention. Material must be traceable to an approved source, with mill certification retained.
• Product safety and human factors. Explicit clauses covering safety-critical items and the human contribution to nonconformity.
• Special process control. Heat treatment, plating, welding and non-destructive testing are typically required to be performed by a NADCAP-accredited source, because the machining certificate does not cover them.

How aerospace certification is governed

AS9100 certification runs under the scheme defined in AS9104/1, administered by the International Aerospace Quality Group. Certified suppliers appear in the OASIS database — the authoritative place to check a certificate, rather than the PDF a supplier emails you. The 9100 series is under revision toward a new edition published as IA9100; until it is issued and its transition defined, AS9100 Rev D remains operative.

IATF 16949: ISO 9001 plus automotive discipline

IATF 16949:2016 is not a standalone standard: it is applied together with ISO 9001 rather than containing it, and certification requires both. Its emphasis is defect prevention, variation reduction and waste elimination across the supply chain, and it is the most prescriptive of the three about the tools used to get there.

The core tools

Advanced product quality planning drives the launch; design and process FMEAs document failure modes before they occur; measurement systems analysis qualifies the gauges; SPC monitors the control-plan characteristics; and the production part approval process packages the evidence for sign-off. A control plan is mandatory for prototype, pre-launch and production phases — a document ISO 9001 never mentions.

Customer-specific requirements

The certificate is only part of the obligation. Each vehicle manufacturer publishes customer-specific requirements audited alongside the standard, so two IATF-certified shops can face materially different rules. Ask which customer-specific requirement sets a supplier is assessed against.

An IATF 16949 second edition is in development. The IATF has indicated publication is targeted for mid-2027, with the end of the transition period aligned to the ISO 9001 transition — so the two calendars will move together rather than separately.

Side by side: what each standard obliges a machine shop to do

Table 1 — Requirement comparison

Requirement	ISO 9001	AS9100D	IATF 16949:2016
Documented QMS, internal audit, management review	Required	Required	Required
Risk-based thinking	Required, method free	Required, plus product safety clauses	Required via FMEA methodology
First article inspection	Not required	Mandatory to AS9102	Mandatory within PPAP
Key / special characteristics	Not required	Mandatory identification and control	Mandatory via control plan
Statistical process control	Not required	Required where specified for key characteristics	Mandatory on control-plan characteristics
Measurement systems analysis	Not required	Measurement uncertainty addressed	Mandatory (gauge studies)
Counterfeit part prevention	Not addressed	Explicit clause	Via supplier control
Configuration management	Not required	Explicit clause	Via change control
Supplier development obligations	Evaluation only	Approval and monitoring	Development to certification
Production part approval	Not required	FAI serves this role	PPAP, levels 1–5

Compiled from the published scopes of ISO 9001, AS9100D and IATF 16949:2016.

Table 2 — Governance and verification

Aspect	ISO 9001	AS9100D	IATF 16949:2016
Standard owner	ISO	IAQG, published by SAE	International Automotive Task Force
Scheme rules	ISO/IEC 17021-1 and accreditation body rules	AS9104/1	IATF Rules for achieving and maintaining IATF recognition
Public certificate register	None central; accreditation body directories	IAQG OASIS	IATF database
Certification cycle	Three years with surveillance	Three years with surveillance	Three years with surveillance
Unannounced audits	Not standard	Possible under scheme rules	Explicitly part of the scheme
Current revision status	ISO 9001:2026 published 16 Sep 2026	Rev D (2016); IA9100 revision in preparation	2016 edition; 2nd edition targeted mid-2027

Which certificate does your part actually need?

Work from the end application and the contractual flow-down, not the impressiveness of the acronym. If your customer’s contract does not require AS9100, asking for it narrows your supplier pool and adds documentation cost without adding function.

Table 3 — Certification by application

Application	Usual minimum	Typically also needed	Why
General industrial and machinery parts	ISO 9001	Material certificates	No regulatory flow-down
Fluid power, pumps, instrumentation	ISO 9001	Dimensional report on key features	Function, not regulation, drives control
Medical devices, non-implantable	ISO 13485	Process validation, record retention	Regulatory requirement, not customer preference
Commercial aerospace structure and systems	AS9100D	AS9102 FAI, NADCAP for special processes	Prime contractor flow-down
Defence hardware	AS9100D	FAI, export control compliance	Programme and regulatory requirements
Automotive production, Tier 1 or 2	IATF 16949	PPAP, control plan, customer-specific requirements	OEM supply-chain mandate
Automotive aftermarket and motorsport	ISO 9001	Agreed inspection plan	IATF applies to OEM series production
Prototype and development parts	ISO 9001	Documented first article	Volume too low for statistical control

The same logic applies to component families: standard industrial work in custom machine parts rarely benefits from an aerospace certificate, while the same shop’s aerospace work does. What changes is the documentation package, not the machine.

What does each certificate cost you as a buyer?

Not in fees — those are the supplier’s problem — but in calendar time and paperwork before first shipment. Over-specifying lengthens qualification without improving the part.

Table 4 — Documentation burden before first production shipment

Deliverable	ISO 9001 baseline	AS9100D part	IATF 16949 part
Certificate of conformance	Usual	Required	Required
Material certificate to heat / lot	On request	Required	Required
Dimensional inspection report	On request	Full FAIR on all characteristics	Full dimensional results in PPAP
Process flow, FMEA, control plan	Not required	Control plan for key characteristics	All three required
Capability study	Not required	Where specified	Required on identified characteristics
Gauge study	Not required	Measurement uncertainty stated	Required
Formal customer approval before shipping	No	FAI approval	PPAP approval

Worked example: mapping a transition onto a certification calendar

A recurring question during a revision is whether a supplier’s certificate will still be valid when your programme reaches production. That is arithmetic. Assume a certificate to ISO 9001:2015 issued 1 March 2025 on the conventional three-year cycle, and a production start planned for Q4 2027.

Step 1 — Fix the cycle. Issue date 1 March 2025; certificate expiry three years later, 28 February 2028. Surveillance audits fall at roughly twelve-month intervals: March 2026 and March 2027.

Step 2 — Place the new edition. ISO 9001:2026 was published on 16 September 2026, which sits between the first and second surveillance audits.

Step 3 — Identify the realistic transition point. Transition is normally performed at a scheduled audit rather than as a separate visit. The two candidates are the March 2027 surveillance audit and the recertification audit that must complete before 28 February 2028.

Step 4 — Compare against your programme. A Q4 2027 start falls after the March 2027 surveillance and before the February 2028 recertification deadline. The supplier can be compliant either way, but only the March 2027 route guarantees it — recertification leaves the transition as late as the month before expiry.

Step 5 — Convert into a purchasing action. Ask for the transition date in writing and make it a condition of the qualification, rather than asking whether they “are ISO 9001 certified”. The same calculation applies to AS9100 and IATF certificates once their own transition windows are published.

How do you verify that a certificate is real and in scope?

• Check the register, not the PDF. Aerospace certificates are listed in IAQG OASIS; IATF certificates in the IATF database; ISO 9001 certificates through the issuing accreditation body’s directory.
• Read the scope statement. It must name the processes you are buying and the site that will perform them.
• Check the accreditation mark. A certificate issued by a body that is not itself accredited under ISO/IEC 17021-1 carries far less weight, whatever the standard number on it says.
• Check dates and edition. Issue date, expiry date and the edition of the standard — and, during a transition, the plan to move.
• Ask about special processes. Plating, heat treatment and NDT usually sit outside a machining certificate — ask who performs them, under what accreditation.
• Ask for the last audit’s nonconformity summary rather than the certificate. A system with no findings in three years has usually not been audited hard.

What MW+ holds and what ships with an order

MW+ is certified to ISO 9001:2015, AS9100D, ISO 13485 and IATF 16949, with NADCAP coverage for special processes and ITAR, RoHS and REACH registration. These are audited as separate schemes against their own rules, not a single badge stretched across three industries, and certificates with their scope statements are available before you place an order.

Every order ships with a certificate of conformance, a CMM inspection report and material certificates. First article inspection to AS9102 and PPAP Level 3 are available on request and quoted per programme, because both add real preparation time rather than being a box to tick. The controls behind those documents — general tolerances to ±0.01 mm per ISO 2768-m, a ±0.001 mm floor on capable features, Cpk ≥1.67 on controlled characteristics — are set out on our CNC machining quality control page, and the process envelope they apply to under CNC machining services.

MW+ has operated from Shenzhen since 2015 and serves customers in more than 50 countries; the facility and equipment list are summarised on the page about MW+. For how a first article report and CMM data fit a qualification package see CMM inspection and FAI, and for lot-level records, full traceability in CNC machining.

When a certificate is the wrong thing to ask for

When the requirement is a process, not a system. If your concern is plating thickness or heat-treat response, a QMS certificate answers none of it — NADCAP accreditation for that specific special process does. Asking for AS9100 where you needed NADCAP is a common and expensive mis-specification.

When it narrows the pool for no functional gain. Requiring IATF 16949 for an aftermarket bracket removes capable shops from consideration and adds PPAP preparation to a part that will never see a production control plan. Specify the deliverables you want — dimensional report, material certificate, documented first article — and let the certificate follow from the application.

When the part is a prototype. Development parts change faster than a configuration-management system can absorb. The right controls at that stage are a documented first article and clear drawing revision control, not a scheme designed for series production. Where that boundary falls is discussed in our comparison of low-volume CNC machining cost against speed.

When the certificate stands in for due diligence. A certificate says a system exists. It does not say whether the shop has run your alloy, held your tolerance or delivered your volume — those are answered by sample parts, capability data and references, as described in our guide to choosing a CNC machining supplier in China.

Frequently asked questions

Is AS9100 simply a stricter version of ISO 9001?

It is ISO 9001 plus a defined set of aviation, space and defence additions in the same clause numbering — first article inspection, key characteristics, configuration management, counterfeit prevention, product safety. “Stricter” understates it: the additions change what a shop must be able to produce as evidence, not merely how carefully it does the same things.

Does my supplier’s ISO 9001:2015 certificate become invalid now that ISO 9001:2026 is published?

No. The 2015 edition is listed as withdrawn on iso.org, but existing certificates remain valid through the transition period set by the certification body, normally mapped onto the supplier’s existing three-year cycle. Ask for the planned transition date and check it against your own production schedule.

Can one shop hold all three certifications at once?

Yes, and many precision suppliers serving several sectors do. They are separate schemes with separate audits and registers, so a shop holding all three carries three audit burdens. The benefit to a buyer is one supplier who can take aerospace, automotive and industrial work without a new qualification each time.

Do I need an AS9102 first article report on every order?

No. A full FAI is required for a new part number and after defined changes to design, process, tooling, supplier or manufacturing location. Repeat orders of an unchanged part run against the approved first article; a partial FAI covers the affected characteristics when only part of the configuration changes.

What is the difference between PPAP and FAI?

Both are pre-production approval packages, but PPAP is broader. An AS9102 FAI verifies that every drawing characteristic was achieved on the first production part. A PPAP submission adds process flow diagrams, FMEAs, control plans, measurement systems analysis and capability data, in levels defining how much is submitted rather than retained on file.

Does a certified supplier cost more per part?

The certificate itself is not the cost driver; the documentation package is. A part requiring a full FAIR or a Level 3 PPAP carries real engineering and metrology hours before the first shipment, and that is what appears in the quotation. A part with the same geometry and no formal approval package does not carry it. Specify the package you need and the cost becomes visible rather than assumed.

How do I check whether a special process is covered?

Ask which processes are performed in-house and which are subcontracted, then ask for each subcontractor’s accreditation. Heat treatment, plating, anodising, welding and NDT are commonly outside a machining shop’s own certificate and are typically covered by NADCAP accreditation at the supplier performing them.

What should I send with an enquiry to get a meaningful answer?

The drawing with its tolerance scheme, the end application, the standard your customer flows down to you, and the documentation package you need at first shipment. With those four, a quotation can state the inspection method and approval route rather than a price against assumptions — request a CNC machining quote with them attached and compare how specific the replies are.