IATF 16949 Automotive Supplier: What It Means

IATF 16949 is the quality management system standard for the automotive supply chain, published by the International Automotive Task Force and built on ISO 9001. A certificate proves that one named manufacturing site runs controlled processes across a defined scope of work. It says nothing about how well the material you are buying performs.

That gap is where most supplier qualification goes wrong. A buyer receives a PDF, sees the IATF logo, files it, and moves on. Nobody reads the site address, the scope statement, the certificate number, or the validity dates — the four fields that decide whether the document in your hand has anything to do with the parts you are about to buy.

This guide is written for the buying side of that exchange: quality engineers, sourcing managers and thermal designers who are qualifying a materials supplier for an automotive programme, and who need to convert a certificate into a decision. It covers what the standard certifies, why the certificate belongs to a site rather than a company, the five checks worth running before you approve a supplier, and the requirements the certificate does not replace. If you manufacture to this standard and a customer has just asked you for your certificate, the same five checks are what they will run against you.

What IATF 16949 Certifies — and What It Does Not

The current version, IATF 16949:2016, was released on 1 October 2016 and replaced ISO/TS 16949. IATF publishes the revision levels and purchase channels for every language edition on its publications page, and the first edition date on that page is the fastest way to spot a supplier quoting an obsolete revision.

The standard is not standalone. It incorporates ISO 9001 in full and adds automotive-specific requirements on top — product safety, contingency planning, supplier development, three types of internal audit (system, manufacturing process and product), and the discipline of learning from recalls, field returns and warranty data. A site cannot hold IATF 16949 without meeting ISO 9001; where a supplier holds only one certificate, the audit behind it covered both.

What the standard certifies is a management system: how the site plans, controls, measures and improves its processes. It is not a product standard and not a material standard. Nothing in an IATF 16949 certificate asserts a thermal conductivity value, a thickness tolerance, a flammability rating, a dielectric strength, or a substance declaration. Those are separate documents, from separate systems, and a later section of this guide lays them out.

So the honest reading of "our supplier is IATF 16949 certified" is narrower and more useful than it sounds: this site has a documented, audited, externally checked system for making the class of product it says it makes.

Why the Certificate Belongs to a Site, Not a Company

Certification is granted to a location, not to a brand or a group. IATF's own Rules 6th Edition Q&A document draws the eligibility line: organisations which "only provide services such as sorting, kitting, testing, inspection, packaging, and warehousing … are not eligible for IATF 16949 certification". A certificate therefore attaches to a place where value-added manufacturing actually happens — assembly, mixing, moulding, die-cutting, heat treatment and similar processes. Corporate headquarters, sales offices and design centres are audited as part of a site's system, but they cannot hold an IATF 16949 certificate in their own name: a remote support location is certified only alongside the manufacturing site it supports.

The practical consequences show up in three situations buyers meet constantly:

• A group with several plants. Each site holds its own certificate, with its own scope statement, its own certificate number and its own validity dates. A parent-company certificate, or the certificate of a sister plant in another country, does not travel. If your production is scheduled at Plant B, ask for Plant B's certificate.
• Buying through a distributor or trading company. IATF 16949 is built for manufacturing sites that add value; a distributor's role is one of the activities the scheme deliberately excludes from its scope. When a quotation arrives from a trading company, the certificate you want to see is the one held by the factory that will actually mix, mould or convert the material.
• A certificate that has stopped being valid. Certificates can lapse, be suspended, or be withdrawn by the certification body after a failed audit. Under IATF's Rules 6th Edition and its sanctioned interpretations, a certificate's life is three years minus one day at most, confirmed by an annual surveillance audit, with recertification completed before it expires — so a certificate dated years ago is not evidence of anything today.

That is also where the familiar Tier language becomes concrete. A Tier 1 supplier delivers assemblies directly to the vehicle manufacturer and is almost always expected to hold IATF 16949. A Tier 2 supplies Tier 1 and is usually driven to the same standard by contract rather than by the scheme itself. A Tier 3 supplies raw or processed material. Your position in that chain, and the position of the supplier you are qualifying, determines which certificate is actually the relevant one — and a materials supplier sitting behind several tiers often satisfies the requirement through the minimum automotive quality management system requirements that IATF publishes for sub-tier suppliers instead.

How to Verify an IATF 16949 Certificate Before You Qualify a Supplier

Five checks, in this order. The first three take minutes; the last two are the ones that catch the failures that audits never see.

Step 2 is the one buyers skip, and it is the strongest check available. IATF maintains a public certificate validity check — its own site lists it under that exact name — so a certificate number can be resolved against the issuing body's record rather than against a PDF the supplier rendered themselves. Ask for the certificate number in writing, separately from the PDF. When the number does not resolve, the conversation is over: no amount of explaining substitutes for the register.

Step 4 protects you from a specific and expensive failure mode. Certification only counts when it comes from a body IATF recognises. IATF publishes both directions of that list — bodies under contract with IATF and bodies whose contract has been terminated — so a certificate issued by a body that lost its recognition is worth exactly nothing, however official the PDF looks.

Step 5 has a calendar dimension buyers underestimate. Under the current Rules for Achieving IATF Recognition — the 6th Edition, published in April 2024 and effective 1 January 2025 — the certification bodies that issue these certificates are held to a risk-based audit programme. The buyer-visible consequence is simple: the certificate date is not the only date that matters. Ask when the last surveillance audit was completed, and treat a site that cannot answer as a site whose certificate you are holding but not verifying.

None of this requires access to the audit report. Audit reports are confidential between the site and its certification body, and no supplier should hand them over. What you are entitled to see is the certificate, the register entry behind it, and the recency of the audits that keep it alive.

What the Standard Asks a Materials Supplier to Control

A materials supplier usually is not design-responsible for your part — you specify it. The standard handles that directly: design and development may be excluded from a site's scope where the organisation is not responsible for the customer's product design, but the design of the manufacturing process can never be excluded. The process is the thing being certified.

That is why the documents a materials supplier is asked for cluster around process control rather than product claims:

• The AIAG core tools. AIAG, the industry body that publishes them, defines the five tools a certified site is expected to use: APQP for planning a new part, PPAP for approving it before production, FMEA for failure analysis, MSA for measurement systems, and SPC for process control. For a buyer, the useful artefact is the approval package: a PPAP submission closed by a Part Submission Warrant that ties a specific part number to a specific process at a specific site.
• Customer-specific requirements. Every OEM layers its own requirements on top of the standard, and IATF collects them in one place — its customer specific requirements page currently lists twelve OEMs and links documents for ten: BMW, Ford, Geely, General Motors, IVECO, Mercedes-Benz, Renault, Stellantis, Volkswagen and Volvo. BYD and Jaguar Land Rover appear only as "under development", with no document behind the name. The buyer-side responsibility here is real: your supplier cannot comply with a requirement nobody sent them. Before you quote a CSR in a complaint, confirm you issued it.
• The control plan for a compressible material. A thermal pad or a gap-filling gel is soft, and its critical characteristics are dimensional and mechanical — thickness, compression at a given load, hardness, and the thermal impedance that follows from them. These are perfectly controllable, but only with a measurement system that has been studied. MSA on a soft material is genuinely harder than on a machined part, and a supplier who can talk about gauge reproducibility on a compressible pad has done the work.
• Change control. The standard requires changes to be controlled; in practice the OEM requirements that sit on top of it make notification and approval before a change ships a condition of supply. For a thermal material this covers more than a new formulation — a shift of production site, a change of raw-material source, or a change of thickness range all reach your part. Ask how you will be notified, and whom.
• Sub-tier supplier management. A certified site is responsible for its own suppliers. Where a sub-tier supplier is not certified, IATF's published minimum requirements for sub-tier suppliers are the yardstick — worth asking about if your material depends on a filler, a carrier film or a release liner from a smaller supplier.
• Risk-based thinking and corrective action. The standard expects risk analysis fed by real evidence — recalls, field returns, complaints, scrap and rework — and corrective actions that remove root causes. The buyer-side value is interrogative: ask what the last customer complaint was and what changed afterwards. A site that answers specifically is a site whose system is running.

Where a supplier is also handling regulated substances, the management-system layer extends further. ZIITEK, which makes the thermal materials described in this cluster, holds IATF 16949:2016 alongside ISO 9001, ISO 14001, IECQ QC 080000 for hazardous-substance process management and a UL product certification, with a certificate validity window our records show as 5 January 2026 to 4 January 2029. We publish that window here because it is exactly the field a buyer should be checking against the IATF register — not because reading it on our website counts as verification.

What IATF 16949 Does Not Cover

The most common qualification error we see is a buyer treating one certificate as a substitute for four. These documents answer four different questions, and a supplier can be strong on one and weak on another.

The separation matters most for materials, because substance compliance runs on its own European and customer-specific tracks. The RoHS Directive restricts substances in electrical and electronic equipment. For vehicles the framework has been rewritten: Regulation (EU) 2026/1738, in the Official Journal on 24 July 2026 and in force since 13 August 2026, repeals Directives 2000/53/EC and 2005/64/EC and carries forward the same restriction on lead, mercury, cadmium and hexavalent chromium in vehicle materials, with exemptions listed separately. The repeal is staggered — the Directive goes with effect from 1 September 2028, but that restriction and its exemption annex stay in force until 31 August 2032 — so a declaration citing it is still current, but the instrument it names is already replaced. Automotive material data is reported through IMDS, the industry's material data system, where suppliers create material data sheets against the global automotive declarable substance list and the REACH candidate list it publishes. None of that lives inside an IATF 16949 audit.

Nor does flammability. A flame rating is a property of the material under a specific small-scale test, tested under the UL 94 family of methods and reported per material and thickness — a genuinely different question from whether the site that made it is certified. Our cluster's comparison of UL 94 V-0 and VTM-0 covers that boundary in detail, and the certifications and compliance hub collects the rest of the compliance picture for thermal materials.

What to Ask a Thermal Materials Supplier Before You Qualify Them

Nine questions, in writing, before the first order rather than after the first problem.

Question nine is the one that costs money when it goes unasked. If you are moving to a different pad because of lead time or cost — the situation our drop-in replacement guide walks through — the site's IATF 16949 certificate does not follow the part to a new material, a new thickness or a new plant. The part needs a fresh approval, and the question to ask is who owns that, and on what schedule.

Two supporting references are worth keeping in the file: the thickness and compression data for the pad family you are specifying, and — if your programme touches a battery pack or a power stage rather than a control board — the material set behind EV battery pack thermal management, where the sealing, compression and insulation requirements stack on top of the thermal ones.

What to Do With the Answer

Run the five checks once, and the outcome is one of three things: the certificate covers your scope — approve the site and move to the part-level paperwork. It covers a different scope, a different site or a window that has closed — treat the supplier as uncertified and decide accordingly. Or the register does not resolve the number you were given — stop, ask again, and do not sign.

If you are the supplier reading this because a customer asked, the same three outcomes apply in reverse. Know your site address, your scope wording, your certificate number and your last surveillance date without going to the filing cabinet, and answer with those four items rather than with a PDF attachment. Buyers who are checking these fields are not being difficult; they are reading the certificate the way it was designed to be read. Our thermal pad range is documented to that standard, and the certifications and compliance hub above is the fastest route to the supporting declarations behind each material family.