ISO 9001 vs ISO 13485, IATF 16949 and AS9100: which quality standard does your market expect?

The short answer: your market chooses the standard

ISO 9001 fits any organisation in any sector and is often the only quality standard customers ask for. Three markets expect more: medical devices (ISO 13485), plants making vehicle parts (IATF 16949), and aviation, space and defence (AS9100). None is a higher grade of ISO 9001; each adds the controls its industry will not do without and is certified under its own rules.

ISO 13485 is written for regulatory purposes: notified bodies, MDSAP auditing organisations and regulators work from it, and the FDA's Quality Management System Regulation, which incorporates it by reference, has applied since 2 February 2026. IATF 16949 is owned by the International Automotive Task Force of vehicle manufacturers and national trade associations, and vehicle makers and Tier 1 suppliers expect it before nominating a supplier. AS9100 comes from the International Aerospace Quality Group (IAQG), and primes make 9100-series certification a condition of supplier approval.

What each sector standard adds to ISO 9001, and why

ISO 13485: a quality system regulators can rely on

ISO 9001 judges a system by customer satisfaction and improvement; ISO 13485 judges it by whether each device is safe, performs as intended and can be traced, reported and recalled. Hence a medical device file per family, risk management aligned with ISO 14971, design controls through verification, validation and transfer, validated processes including sterilisation, contamination control, unique device identification where required, and a reportability decision on every complaint. It keeps the ISO 9001:2008 clause 4 to 8 layout; ISO confirmed the 2016 edition in 2025.

IATF 16949: the automotive supplement

IATF 16949:2016 is applied with ISO 9001:2015, with each customer's specific requirements (CSRs) on top. Built for defect prevention and less variation and waste, it adds product-safety controls (4.4.1.2), tested contingency plans covering cyber-attacks (6.1.2.3), the core tools (APQP, PPAP, FMEA, MSA, SPC) with control plans (Annex A), system, manufacturing process and product audits (9.2.2.2 to 9.2.2.4) and documented problem solving (10.2.3).

AS9100: aerospace controls inside the ISO 9001 text

AS9100 Rev D contains all of ISO 9001:2015 and inserts what an industry whose failures can cost lives treats as essential: product safety, configuration management, counterfeit-part prevention, special processes, first article inspection, foreign object prevention, key characteristics, flow-down to external providers and human factors. It is also published as EN 9100 in Europe and JIS Q 9100 in Japan.

How certification differs from an ISO 9001 audit

ISO 9001 certification is decided by an independent, accredited certification body, typically after three to six months of work. The sector schemes add rules on who may certify, how the audit runs and where the result is recorded.

Often missed: an ISO 13485 certificate is not a CE certificate, an FDA clearance or a national registration, so each market's regulatory route needs its own plan.

Is ISO 9001 a prerequisite, or does the sector certificate replace it?

No ISO 9001 certificate is needed before you start any of the three; your role in the market qualifies you, such as manufacturing automotive parts at the site. A working ISO 9001 system still shortens each route, because its process map, document control, internal audit and management review carry over.

IATF 16949 and AS9100 audit the ISO 9001 requirements within the sector standard, so their certificates cover them, but in the 2015 edition. ISO 9001:2026, published on 16 September 2026, has a transition expected to end on 30 September 2029; IA9100 is linked to it, and the IATF's second edition, planned for mid-2027 (indicative), has its transition aligned to the same end date.

ISO 13485 works the other way: its certificate does not claim ISO 9001 conformity, so a device company whose other customers specify ISO 9001 keeps both, ideally on one system with the audits planned together.

Decision table: which quality standard your market expects

Find the row that describes your organisation.

Serving several sectors with one integrated quality system

A machine shop with automotive and aerospace customers gains nothing from parallel quality systems. Build one core and add a sector layer only where a standard requires something different.

• Risk. One procedure, with the method each product needs: an ISO 14971 risk file for devices, process FMEAs feeding control plans for vehicle parts, product-safety assessment for aerospace critical items.
• Internal audit. One programme covering automotive process audits on every shift and product audits, process-based aerospace audits, and all of ISO 13485 for the device scope.
• Management review. One meeting with every scheme's inputs: cost of poor quality and warranty, complaints and regulatory reports, delivery and conformity by customer.

Because ISO 13485 keeps the older numbering, map shared procedures to both clause structures in one cross-reference. Plan the certificates as carefully as the system: each scheme sets its own audit rules and time. A common mistake is treating a sector standard as paperwork on top of ISO 9001, when its auditors look for engineering evidence.

ISO 9001 and the sector standards: questions buyers ask