IATF 16949 customer-specific requirements: how to manage CSRs in your QMS

What are IATF 16949 customer-specific requirements?

A customer-specific requirement is an instruction from an automotive customer about how your quality system must work for its parts, over and above what IATF 16949 and ISO 9001 already say. ISO 9001:2015 sets the base, IATF 16949:2016 adds the automotive layer, and each customer's CSRs complete it. The IATF sanctioned interpretation of the foreword, issued in November 2025, lists the applicable customer-specific requirements alongside the two standards and ISO 9000 as the fundamental requirements for automotive production and service part organisations.

In practice a CSR can touch almost any process: how a new part is approved, which problem-solving format a complaint response must follow and how fast, how long records are kept, what a change notification must contain, which targets the scorecard measures, or what your own suppliers must hold. None of it is in the standard; it sits in documents the customer controls and revises.

The requirement to bring CSRs into the system appears in clause 4 of IATF 16949, where conformance of products and processes (4.4.1.1) extends to customer, statutory and regulatory requirements. The clause on quality management system documentation (7.5.1.1) then expects your documentation to show those customer requirements.

Where CSRs come from and which ones apply to you

List every direct customer that receives automotive parts from the site, then collect each document it has issued that governs supplier quality.

The IATF FAQ on clause 7.5.1.1, revised June 2026, removes a common misunderstanding: the requirement covers all direct customers, not only the IATF members. What those Tier 1s pass down is their decision, so ask each one in writing which requirements apply to the parts you make for it.

The method: turning CSR documents into how the plant works

A CSR is met when a process does what the customer asked, every time, and leaves a record; filing the PDF proves nothing. The method runs in six steps.

1. Collect and control the source documents

Hold one controlled copy of each customer's current CSR document, with its revision date, the place it was obtained and the date it was last checked.

2. Break each document into requirements

Read the document line by line and write each requirement as a separate entry.

3. Map each requirement to a process and a clause

Link every entry to the process that meets it and to the related IATF 16949 clause.

4. Name an owner and change the process

Give each entry a process owner and, where the current practice falls short, a dated action, such as a revised procedure, a changed retention period or a training session.

5. Keep the evidence where the process runs

Point each entry to the record that proves it: the PPAP file, the 8D report, the change notice, the retention setting.

6. Review on every revision and on a fixed cycle

Re-open the register when a customer issues a new revision, when you win a new customer and at a set interval in between, and bring the result into management review.

A worked example of a CSR register

Take a plastics moulding site supplying two Tier 1s and one vehicle maker directly. The entries are illustrative types of requirement, not any named customer's content.

The register itself is the record. A spreadsheet can serve a single-customer site; with several customers and revisions, a system that links entries to owners, actions and evidence is easier to keep current.

Keeping CSRs current when customers revise them

Customers revise their requirements on their own schedule, and the published IATF OEM documents carry dates ranging from 2021 to 2026.

Give one person the task of checking each source on a fixed cycle and recording the check. When a revision arrives, compare it with the previous one, update only the changed entries, and treat each change as a change to the system: owners informed, processes adjusted, people trained, effective date recorded. CSRs are also one of five priority areas the IATF named in July 2026 for the second edition of IATF 16949, planned for mid-2027 (indicative dates).

How CSRs show up in internal and certification audits

Your own audits should find CSR gaps before anyone else does. The quality management system audit (9.2.2.2) can sample register entries against their processes, the manufacturing process audit (9.2.2.3) can check that shop-floor practice matches what each customer asked for on every shift, and the product audit (9.2.2.4) can verify customer-specified characteristics on finished parts. The internal audit guide covers the programme.

Certification body auditors typically trace a customer through the site: its CSR document, the register entries, and then the complaints, approvals, changes and scorecards for that customer's parts. Customer performance also affects the audit itself. Under the IATF Rules 6th Edition, a site that does not meet the IATF OEM quality or delivery targets in the OEM scorecards is given additional audit time, unless it can show that its corrective actions have been verified as effective.

Common mistakes with customer-specific requirements

• Only the IATF OEMs are covered. Tier 1 and non-IATF customers are left out, although the June 2026 FAQ says documentation covers all direct customers.
• The register lists documents, not requirements. A row per PDF hides the individual obligations and makes the mapping impossible to test.
• Versions go stale. The plant works to a revision the customer replaced a year ago, and nobody recorded when the portal was last checked.
• Mapping without change. Every entry points to a procedure, but the procedure was never revised to say what the customer requires.
• Suppliers are forgotten. Requirements meant to travel down the supply chain stop at purchasing.

Customer-specific requirements: questions buyers ask