ISO 22163 certification consulting for railway products that hold up for the life of the fleet.

What it is

What is ISO 22163 and what is it used for?

ISO 22163 is the international standard for railway quality management systems. It reproduces the full text of ISO 9001:2015 and adds the railway sector's own requirements, for organisations anywhere in the railway supply chain of industrial products and services, with the emphasis on preventing and reducing defects and on product quality, including its safety aspects. The requirements began as the industry's own IRIS standard; ISO/TS 22163 brought them into ISO in 2017, and the 2023 edition made them a full International Standard.

ISO 22163 is also the basis of IRIS Certification®, the certification scheme of UNIFE, the European rail supply industry association, operated by its IRIS Management Centre. Revision 04 of the scheme combines ISO 22163:2023 with UNIFE's IRIS Certification® Performance Assessment:2023, which contains the assessment method and the certification rules, and with the IRIS portal, database and audit tool. The assessment goes beyond conformity: it looks at how mature and how effective your processes are, and a full certificate receives a Bronze, Silver or Gold quality performance level each year.

The practical test for a railway supplier: does the business bid only what it can deliver, run each contract as a controlled project, trace every product's configuration through its changes, prove the first article and still support the product when its parts go out of production? The answer belongs in daily records, not in a manual written for the auditor.

Current edition. ISO 22163:2023, published on 25 July 2023 and amended by ISO 22163:2023/Amd 1:2024 (climate action changes, February 2024), replaced the Technical Specification ISO/TS 22163:2017. IRIS Certification® Rev. 04 came into force on 1 January 2024; since October 2024 every IRIS audit has had to use the new version, with any certificate not yet transitioned moved over at its next audit, so no certificate in force today is still on Rev. 03. Next: ISO registered the project for a second edition of ISO 22163 in September 2025, and ISO 9001:2026, replacing the ISO 9001:2015 text ISO 22163 reproduces, was published in September 2026. Until UNIFE announces otherwise, IRIS audits apply Rev. 04 with ISO 22163:2023; confirm the timing of any change with your certification body. ISO 22163 and IRIS Rev. 04: what the scheme requires today

Who it is for

Who needs ISO 22163 certification?

ISO 22163 applies wherever railway products are designed, made, maintained or supplied: rolling stock builders, suppliers of equipment, components and spare parts, and maintenance companies, and since Rev. 04 also distributors and turnkey suppliers. Under IRIS Certification® the certificate belongs to a single site that carries out at least three certifiable activities from the scheme's business categories and qualifies for at least one certification scope. Production or maintenance at a connected location can join as a site extension; remote support functions are audited but cannot hold an IRIS certificate of their own. Organisations come to Sterling for ISO 22163 from four starting points:

• A system integrator, an operator or a tender names ISO 22163 or IRIS. Before planning, confirm whether the request means IRIS Certification® or any certificate citing ISO 22163, which site and activities it covers, and whether a performance level is expected.
• You supply rail on ISO 9001 and want to qualify for more of the supply chain. The ISO 9001 base is in place; what is usually missing is the railway layer: tender and project management, configuration and change control, RAMS and life cycle costing, first article inspection, obsolescence management and the indicators the IRIS assessment reads.
• You are entering rail from another sector. Automotive, aerospace and electrical suppliers arrive with strong production controls, then meet product lives measured in decades, safety-related configuration and contract-driven project reviews.
• You hold an IRIS certificate and it is under strain. A readiness review failed on a KO item, corrective actions miss their 90 days, the performance level has stalled at Bronze, or the certificate is moving to another certification body. It is time to rebuild the system around how the business really works.

The benefit is control of railway products and projects, with evidence customers can review; it depends on ownership in engineering, production and maintenance, which a certificate records but cannot create.

Business benefits

How ISO 22163 supports railway delivery and customer confidence

Rail customers remember the delivery the fleet waited for, the first article rejected at goods inwards and the part nobody could trace to its configuration. We start where your business paid for those failures.

• Bids you can deliverTender reviews that test technical, schedule and commercial risk before anything is signed, so contracts start with promises you can keep.
• Projects that keep their datesPlans, milestones, reviews and project risks handled the same way on every contract, with the customer's gates visible to the team.
• Configuration you can proveEvery delivered product traceable to its baseline and approved changes, so a question asked years after handover still has an answer.
• First articles accepted first timeA first article inspection that confirms process, documents and tooling before series supply, instead of a rejection at the customer.
• Products supported for decadesObsolescence watched and life cycle cost understood, so a component leaving production becomes a planned decision, not a fleet-wide emergency.
• Fewer customer auditsUNIFE counts fewer audits among the aims of IRIS Certification®, and detailed results can be shared through the IRIS portal with the customers you choose.

Track a few measures, such as on-time delivery, first-article acceptance and open warranty claims. The IRIS assessment reads your indicators anyway; make them the ones that run the business.

Requirements

What are the main ISO 22163 requirements?

ISO 22163 prints the ISO 9001:2015 text in boxes and adds the railway requirements around it: supplements inside clauses 4 to 10, additional subclauses such as tender management and business continuity, three railway subclauses closing clause 8 and three informative annexes. The table maps them in plain language, with the 2023 subclause numbers. IRIS then assesses on three fronts: enabling factors, through an evaluation matrix built on the ISO 22163 requirements, customer perception and process performance.

Certification process

How do you get ISO 22163 certified?

Build the railway quality system and run it long enough to produce records; then a certification body under contract with UNIFE assesses it under IRIS Certification® Rev. 04. Sterling provides consulting and preparation; the certificate is the certification body's decision and the performance level the IRIS Management Centre's, and that independence gives an IRIS result its standing.

1. 01
   Confirm eligibility and register.Check the site, its certifiable activities and the certification scope against the scheme's categories, choose the full or simplified route, and register on the IRIS portal, keeping company data current.
2. 02
   Gap analysis: review the current system against ISO 22163:2023 and the IRIS Performance Assessment.The gap analysis shows what is missing, from tender and project management to the performance indicators, keeps what already works and sets actions with owners and dates.
3. 03
   Implement and build the record.Railway processes in use and people trained; the scheme expects at least six months of data and records from the activities in scope before the certification audit starts.
4. 04
   Audit, review and prepare the upload pack.Internal audits, process reviews and the management review test the system; we raise findings ahead of the certification body and close each with evidence. The upload pack, from the process list and key-process diagrams to the mandatory indicators and the management review report, reaches the portal at least 60 days before the audit.
5. 05
   Complete the IRIS assessment.The readiness review (stage 1), remote or on site in the 60 days before the audit, where every KO item, the scheme's knock-out requirements, must pass; the on-site certification audit (stage 2); corrective actions closed within 90 days; then the decision, once the audit documents pass the veto check.
6. 06
   Maintain the certificate and the level.On-site surveillance audits every year, with every process assessed at least once across the two, recertification in the third year, and for a full certificate a quality performance level from the IRIS Management Centre each year.

Verify the route before comparing prices. IRIS Certification® is delivered by certification bodies under contract with UNIFE, and every audit result goes to the IRIS portal, where each certificate's status, validity and scope are published. Ask the body to show both before signing. How to choose a credible ISO 22163 provider · The certification buyer's checklist

Cost

How much does ISO 22163 certification cost?

An ISO 22163 price quoted before anyone has seen your site is a guess: a component maker whose ISO 9001 system already works needs a different scope from a maintenance depot building its first railway QMS. What we commit to is an all-inclusive proposal that itemises everything.

Timeline

How long does ISO 22163 certification take?

How long it takes depends on where you start, how much time your people can give, what the gap analysis exposes and when the certification body can come. It is typically six to twelve months, and the scheme sets a floor: at least six months of data and records from the activities in scope must exist before the certification audit starts. A working ISO 9001 system with established project and configuration practice sits near the six-month end.

Bring the tender date or the customer's qualification deadline to the first conversation. We will say plainly whether six months of records can exist by that date, and what has to be decided this month to make it possible. Any certificate date offered before someone has read your contracts is marketing, not planning.

Challenges

Common ISO 22163 implementation challenges

Railway programmes tend to stall at the same five points, and each one has a practical way through.

Your engagement

What your ISO 22163 engagement includes

One team and one all-inclusive proposal take you from the gap analysis to the last closed corrective action, with nothing left to piece together from separate suppliers.

• Scope, eligibility, gap analysis and plan

  Site, activities and certification scope checked against the scheme, the route chosen, and owners, dates and decisions fixed before the work begins.

• Railway processes and documentation

  Tender, project, configuration and change, first article, RAMS and life cycle cost, obsolescence and supply chain processes, built with your people, starting from Sterling's templates.

• Effivity ISO & GRC software

  Your railway QMS runs in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audits, process reviews and management review

  Carried out by us or with your auditors, as agreed; findings closed with evidence and the IRIS upload pack assembled from the records.

• Certification readiness and support

  Readiness for the IRIS review and the on-site audit, help with corrective actions inside their 90 days, and support until the certificate is issued.

Certification decisions remain with the independent certification body.

How we deliver

How Sterling supports your ISO 22163 implementation

Sterling OS™, the delivery operating system behind every ISO 22163 engagement, runs in five phases that each close with agreed deliverables, a decision owner and evidence. How much support you take depends on your capacity; the method, the software and who is accountable stay constant.

1. 01
   Design™Guided implementation: your people build the railway QMS, supported by Sterling's templates, workshops and coaching sessions.
2. 02
   Drive™Fully managed consulting: Sterling consultants deliver the agreed work alongside your engineers, planners and process owners.
3. 03
   Sustain™After certification: internal audits, indicator reviews, surveillance preparation, work on the performance level, refreshers and new-hire training.
4. 04
   Automate™The railway QMS in Effivity: documents, risks, project and change records, first articles, obsolescence cases, audits, actions, indicators and management review, together in one workspace.
5. 05
   Revise™Moving to the next ISO 22163 edition and the IRIS rules that follow it, ISO 9001:2026, and changes in site, activities or scope.

In the first week we fix the engagement team, the day of the weekly session, the deliverables and the sign-off owners; a slipping action then surfaces in that session, long before the readiness review comes round.

Often combined with

Standards organisations pair with ISO 22163 (IRIS)

• AIAG core toolsAutomotive core tools implementation and training: APQP, Control Plan, PPAP, FMEA, MSA and SPC applied on your live parts.
• AQAP 2110AQAP 2110 compliance for defence suppliers: what the NATO contract requirement covers, AQAP 2105 quality plans, government quality assurance and an all-inclusive proposal.
• AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
• AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
• AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.