IATF 16949 requirements explained: what the automotive clauses add to ISO 9001

How IATF 16949 sets out its requirements

IATF 16949 requires an automotive supplier to run a quality management system that meets every requirement of ISO 9001:2015, adds a set of automotive-specific requirements, and folds in what each automotive customer demands on top. You cannot read it on its own: the automotive text supplements ISO 9001 rather than repeating it, so each automotive clause makes sense only next to the ISO 9001 clause it extends.

Customer-specific requirements carry equal weight in the audit; the guide on managing CSRs in your QMS covers them, and this page stays with the standard itself.

Clause numbers below are those the IATF quotes in its own sanctioned interpretations and FAQs; other required topics are named without a number.

Clauses 4 to 6: context, leadership and planning

Clause 4: context of the organisation

ISO 9001 requires you to understand your context and define the system. The automotive layer makes that concrete. Clause 4.4.1.1 requires every product and process, including outsourced ones and service parts, to conform to customer, statutory and regulatory requirements. Clause 4.4.1.2 adds a documented approach to product safety: identifying the safety-related characteristics, the approvals they need and the people trained to handle them.

Clause 5: leadership

Top management must review whether processes are efficient as well as effective (5.1.1.2), which moves the conversation from pass or fail to scrap, downtime and cost. The IATF's FAQ on 5.3.1 confirms that responsibilities are given to roles, not to named people, so the system survives staff changes. A corporate responsibility policy and named process owners are also expected.

Clause 6: planning

Risk analysis under 6.1.2.1 must draw on lessons learned from recalls, field returns, complaints and cyber-attack threats. Clause 6.1.2.3 then asks for contingency plans for key equipment, utilities, labour shortages, supply interruptions and cyber-attacks, and for those plans to be tested. Auditors ask when each plan was last exercised.

Clause 7: support

Clause 7 is where the plant's infrastructure and people are held to automotive expectations. Plant, facility and equipment planning (7.1.3.1) must now also consider protection of the equipment against cyber risk. Measurement system analysis (7.1.5.1.1) requires statistical studies for every type of inspection, measuring and test equipment named in the control plan. External laboratories used for inspection, test or calibration must meet the conditions of 7.1.5.3.2, which normally means an accredited scope covering the work.

Competence carries two automotive layers. Clause 7.2.1 supplements the ISO 9001 competence requirement and the standard expects on-the-job training for people whose work affects product quality, while 7.2.3 sets out what internal auditors must know, including the core tools and the relevant customer requirements. Documentation under 7.5.1.1 must show where the system addresses each customer requirement; the IATF's FAQ makes clear this includes every direct customer, not only the vehicle manufacturers. The documentation guide covers how far to take documents and records.

Clause 8: operation

Most of what distinguishes an automotive system sits here. Where you do not receive a fully defined engineering specification, the IATF's FAQ treats you as product-design responsible, and manufacturing process design applies to every site. Design outputs listed under 8.3.5.1 include the design FMEA, 3D models and GD&T. Special characteristics must be identified and carried through the documents (8.3.3.3), and where parts contain embedded software, 8.3.2.3 asks for a development capability you can demonstrate.

Supplier control is layered. Purchased products must meet statutory and regulatory requirements (8.4.2.2), suppliers' quality systems are developed on a risk-based path (8.4.2.3), and their performance is monitored (8.4.2.4), with second-party audits under 8.4.2.4.1.

Verification of job set-ups (8.5.1.3) covers first-off and last-off checks. Total productive maintenance (8.5.1.5) needs a planned maintenance system for the equipment that makes the product. Temporary changes to process controls, such as a bypassed sensor or an alternative gauge, follow 8.5.6.1.1 with a list, approvals and verification. Layout inspection and functional testing are required under 8.6.2, statutory and regulatory conformity is checked under 8.6.5, and shipping product under a concession needs the customer's authorisation first (8.7.1.1). Nonconforming product that is scrapped or reworked follows the disposition rules of 8.7.1.7. How APQP, PPAP, FMEA, MSA and SPC deliver product approval and the control plan is explained in the core tools guide.

Annex A: the control plan

Annex A belongs to the requirements. A.1 sets out the phases of the control plan, from prototype to production, and A.2 lists the elements each one must contain. Auditors test the link in both directions: a characteristic in the PFMEA should appear in the control plan, and every check in the control plan should trace back to a risk or a customer requirement.

Clauses 9 and 10: performance evaluation and improvement

ISO 9001 requires an internal audit programme; IATF 16949 asks for three. The quality management system audit (9.2.2.2) covers every process over a three-year cycle. The manufacturing process audit (9.2.2.3) covers all processes on all shifts across the same cycle, so night and weekend shifts are sampled as well as days. The product audit (9.2.2.4) checks finished parts against requirements at a frequency set by risk. The internal audit guide covers planning and sampling.

Management review inputs are wider than in ISO 9001. Clause 9.3.2.1 adds the cost of poor quality, warranty performance and field failures, turning the review into a decision about money and risk. Clause 9 also expects capability monitoring of manufacturing processes and customer satisfaction measured the way the customer measures it.

A documented problem-solving process (10.2.3) must cover containment, root cause, corrective action and verification of effectiveness, and it must use the customer's format where one is prescribed. Error-proofing, warranty management and the analysis of field failures and complaints complete the clause, with the lessons fed back into the FMEAs.

Reading the standard today: interpretations and the second edition

The requirements are fixed in IATF 16949:2016, the first edition, but their reading is not frozen. The IATF issues sanctioned interpretations, which revise how a clause is read, and FAQs, which explain it; the latest sets date from November 2025 and June 2026. Before a gap analysis or an internal audit, check that your team works from the current versions on the IATF website.

ISO 9001:2026 was published on 16 September 2026, while IATF 16949:2016 was written against ISO 9001:2015; how your certification body applies the new base standard in the meantime is confirmed with that body. The IATF has said the second edition of IATF 16949 is planned for mid-2027, with indicative dates, and its priority areas include software quality assurance, sub-tier supply chains, launch management and customer-specific requirements. Until it is published, the 2016 text remains the one you implement.

IATF 16949 requirements: questions buyers ask