The IATF 16949 certification process under the IATF Rules, step by step

Who runs IATF 16949 certification, and under which rules

ISO 9001 certification sits inside the general accreditation system. IATF 16949 does not: the automotive scheme is owned by the International Automotive Task Force, the group of vehicle manufacturers and national trade associations that also wrote the standard. The scheme is governed by the Rules for achieving and maintaining IATF recognition, 6th Edition, which every recognised certification body had to apply in full from 1 January 2025. The 5th Edition, together with its interpretations and FAQs, lapsed on that date.

Four parties are involved. Your organisation builds and operates the automotive quality management system at each manufacturing site. A consultancy such as Sterling helps you plan, implement and prepare it, and never audits it for certification. An IATF-recognised certification body carries out the audits and takes the decision. Above the certification body sit the IATF oversight offices (ANFIA, IAOB, IATF France, SMMT and VDA QMC), which handle applications from new certification bodies, qualify third-party auditors, witness audits, monitor certification body activity and maintain the IATF database. The Rules are read together with the IATF's sanctioned interpretations and FAQs, which are revised periodically; the latest sets date from November 2025 and June 2026.

Step 1: confirm eligibility and map the site structure

Certification belongs to manufacturing sites. The standard applies where automotive products are made, meaning production materials, production parts, service replacement parts, assemblies, or finishing work such as heat treating, welding, painting and plating. Design centres, head offices and distribution centres are audited as support functions linked to a manufacturing site and cannot hold a certificate alone. Under the Rules Q&A, warehousing, sequencing and product segregation do not count as manufacturing. Two eligibility points often surprise buyers: a plant making only aftermarket replacement parts may choose certification unless a customer insists on it, and since March 2024 makers of EV charging systems and their components are eligible, with the product treated as an accessory part.

Before any proposal, set out the structure the certification body will need to plan against:

• each manufacturing site and any extended manufacturing sites, which are covered in the main site's audit plan;
• standalone remote support locations, with product design functions audited every year and other support functions at least once every two years;
• whether several sites will be certified under a corporate scheme, in which the central location is audited annually;
• the automotive customers served by each site and the customer-specific requirements each one imposes. Our guide to managing CSRs in your QMS covers the register behind this list.

Steps 2 to 4: gap analysis, implementation and a working track record

Step 2: gap analysis

Sterling's gap analysis sets your current practice against three sources at once: ISO 9001, the automotive additions of IATF 16949 and the CSRs of your customers. The output is a list of actions with owners and dates. It is the first stage of the engagement, not the free online readiness check, and it has nothing to do with the certification body's stage 1 readiness assessment, which comes months later.

Step 3: implementation

This is where the plant changes how it works. Control plans are linked to process FMEAs and work instructions, gauges receive measurement system analysis, capability is monitored with SPC, contingency plans are written and tested, suppliers are brought under control and a documented problem-solving method is adopted. The requirements themselves are set out in our IATF 16949 requirements guide, and the methods in our core tools guide.

Step 4: operate, audit internally, review

The certification body wants to see a system with a history, not a system that has just been installed. That history is built from performance data, a completed internal audit programme and a management review that has acted on the results. IATF 16949 calls for three kinds of internal audit: the quality management system audit (9.2.2.2), the manufacturing process audit, which over the three-year cycle must reach every process on every shift (9.2.2.3), and the product audit, with a frequency set by risk (9.2.2.4). The management review inputs listed in 9.3.2.1 go further than those of ISO 9001. The Rules set their own expectations for what must be on record before stage 2; confirm them with your certification body when you plan the audit dates. Our internal audit guide describes how the three audit types are scheduled.

Step 5: contract an IATF-recognised certification body

The first check is simple. The body you pick must appear on the IATF's list of certification bodies under contract. An accreditation certificate for ISO 9001 tells you nothing about its right to issue IATF 16949 certificates. Within that list, compare the bodies on auditor availability in your region and language, their experience of your processes, and how they handle multi-site structures.

Audit days are calculated under the Rules, not negotiated. A minimum-days table based on headcount sets the starting point, and for large sites an extra half day per 1,000 employees above 7,677 is compulsory. Where a site falls short of the quality or delivery targets on an IATF OEM scorecard, the certification body has to add further audit time, unless you can show that your corrective actions have been verified as effective. So two quotes for the same site should show similar audit days. What moves the rest of the price is explained in our cost guide.

Steps 6 and 7: the stage 1 readiness assessment and the stage 2 audit

The Rules name the first stage the stage 1 readiness assessment, and it is carried out on site. The only remote option is a limited-scope repeat of stage 1; a full repeat is again on site. At least twenty calendar days must separate stage 1 from stage 2, and stage 2 is planned on the basis of what stage 1 found. Standalone remote support locations are audited before the manufacturing site. Because auditors must see the processes running, you and the certification body plan stage 2 for a period when production will be active across the planned audit duration.

Step 8: nonconformity deadlines, the decision and the database

Under IATF 16949, nonconformity deadlines are set by the Rules and counted in calendar days. Reading each finding carefully at the closing meeting, and assigning an owner to it before the auditors leave, is what keeps the site inside those windows.

With the findings handled, the certification body carries out its technical review and makes the certification decision. It then records the audit in the IATF database, and customers can confirm a valid certificate through the IATF Customer Portal.

Step 9: surveillance, recertification and what the timeline looks like

For initial and recertification audits held in 2025 or later, surveillance runs at twelve-month intervals. The Rules permit an audit up to three months after its due date and no later; if the audit does not take place within that window, the certificate is cancelled. The certification body must confirm audit dates with you at least ninety calendar days before each due date, which gives you time to plan production and people around them. The certificate runs for three years, with surveillance in years one and two and recertification in year three. Along the way, the IATF expects to publish a second edition of IATF 16949 in mid-2027, with dates still indicative and the end of its transition aligned to the end of the ISO 9001:2026 transition. Until then IATF 16949:2016 remains the edition you are certified to.

From the decision to start until the certificate, the process usually takes between nine and eighteen months. A plant already certified to ISO 9001 that uses the core tools every day sits near the lower end. The factors that stretch it are the size of the gaps, the core tools work needed on each part family, how long the system must run to produce credible records, and the certification body's calendar. The twenty-day minimum between the two audit stages and the closure windows for any findings add fixed time on top.

IATF 16949 certification process: questions buyers ask