IATF 16949, ISO 9001 and ISO 13485: which quality certification does your product need?
Most quote requests we receive name a certification — sometimes the right one, and sometimes one that has nothing to do with the product. The four documents below get confused with each other constantly, and the confusion is expensive in both directions: asking for a standard you do not need adds cost and paperwork you will never use, and missing one your customer requires can cost you the order or the regulatory approval.
- BaselineISO 9001
- AutomotiveIATF 16949
- MedicalISO 13485
- What it provesHow the factory runs
The four documents, and what each one is for
Two of these are management systems, one is a workmanship standard, and they are asked for interchangeably.
| Standard | What the document actually is | Who usually requires it | What it does not tell you |
|---|---|---|---|
| ISO 9001 | A quality management system standard. It describes how a company plans, controls, measures and improves its own processes. | Almost every customer — and almost every factory claims it. | Anything about your particular board, or about processes the company left outside its scope. |
| IATF 16949 | The quality management system standard for automotive production, built on the structure of ISO 9001 with automotive-specific requirements added. Published in 2016, it replaced ISO/TS 16949. | Vehicle makers, and passed down the chain to their tier-one and tier-two suppliers. | Anything about the design of your product — the standard applies to a manufacturing site, not to an OEM's development process. |
| ISO 13485 | The quality management system standard for medical devices. It is organised around risk management, process validation and traceability to regulatory requirements. | Medical device companies, by regulation — and their suppliers, by contract. | Whether your device is approved. That is a regulatory decision about your product, not a certificate about your factory. |
| IPC-A-610 Class III | Not a management system. A workmanship standard that defines what an acceptable solder joint, fillet, and component placement looks like. | Products where a field failure is unacceptable: defence, aerospace, medical, some automotive. | Anything about how the factory is managed, how it traces parts, or what documentation it keeps. |
Read the site, not the logo
This one habit prevents most of the ways a certificate claim goes wrong.
A certificate is issued to a legal entity, at a physical address, against a written scope. It does not cover a brand, a group, a website or a sales office. A company with three plants may hold the certificate at only one of them, and a trading company may hold it while the boards are built somewhere else entirely.
So when a supplier says they are certified, the three questions that carry the information are:
- Which legal entity is named on the certificate?
- Which address does it cover — and is that the address that will build your order?
- What does the scope statement list? Fabrication? Assembly? Design? Test? A scope that names one of those does not cover the rest.
A supplier who cannot produce the certificate document itself has given you a marketing claim, not a certification. Ask for the PDF. This is not an accusation — it is a normal request, and any factory that holds a certificate has the PDF within reach.
ISO 9001 is a floor, not a differentiator
ISO 9001 tells you that a company has a documented, audited process for controlling its work. That is genuinely worth something — it is usually the prerequisite for everything above it, and it is not trivial to maintain. But it is also claimed by so many suppliers that, on its own, it separates almost nobody. If ISO 9001 is the only quality claim a supplier makes, you have learned very little about whether they can build your board. It is the floor you should expect, not the reason to choose.
What the two industry standards actually change
Both are built on ISO 9001. What they add is specific, and it is the part your customer's auditor will ask about.
IATF 16949: what changes on the line
IATF 16949 is the automotive supply chain's answer to a simple problem: a defect that reaches a vehicle may not be discovered for years, and may not be traceable to a batch when it is. What it adds to ISO 9001 is aimed squarely at that:
- Traceability from the component lot to the finished unit, so a problem can be narrowed to specific builds instead of all of them.
- Change notification. A supplier has an obligation to tell you before a part, a process or a site changes — instead of you finding out from a customer complaint.
- A defined set of planning and analysis tools — APQP, PPAP, FMEA, MSA, SPC and control plans — rather than inspection used as the only defence.
- Process capability measured and recorded, so quality is demonstrated to be designed in rather than inspected out at the end.
One consequence is worth understanding before you specify it: IATF 16949 is generally passed down the chain by contract — from the vehicle maker to the tier-one supplier, and from them to whoever builds the boards. If your customer's purchase order requires it, you cannot add it after the fact. Either the supplier holds it or you are not compliant, and no amount of inspection at the end of the line changes that.
ISO 13485: risk, validation and traceability
ISO 13485 is organised differently from ISO 9001, because the problem it solves is different: a defect may reach a patient, and the regulator wants to see how you would have prevented it. What it adds in practice:
- Risk management throughout the process, not as a document produced once at the start.
- Validation of processes whose output cannot be fully checked by inspecting the finished part — which describes most of what happens in an SMT line.
- Documented traceability from raw material through to the finished device, at a level of detail the automotive standard does not require.
- Supplier control treated as part of your own quality system, which is exactly why the certificate question travels down to a contract manufacturer at all.
Note that ISO 13485 is deliberately not organised around continual improvement the way ISO 9001 is. Its organising requirement is that you demonstrate you meet the applicable regulatory requirements — a different obligation, aimed at a different audience.
Where IPC-A-610 fits, and where it does not
It answers a different question, and it is the one you can check with your own eyes.
IPC-A-610 does not describe how a company is run. It describes what the work should look like when it is done — the accept and reject criteria for a solder joint, a fillet, a component's placement and alignment. That makes it the standard with the most direct effect on what you actually receive in the box, and the only one on this page you can verify on a finished board without reading any paperwork. What IPC-A-610 Class III actually requires → covers the difference between Class I, II and III in detail, including the fact that bare boards are judged against IPC-A-600 rather than IPC-A-610.
The practical point is that the two kinds of standard are complementary rather than alternatives. A management system is what makes the workmanship repeatable; the workmanship standard is what defines repeatable in the first place. Asking for one and not the other leaves half the question unanswered.
Ten minutes that will tell you most of it
- Ask for the certificate PDFNot the badge on the website.
- Check the datesThe issue date, the expiry date, and whether the certificate is marked withdrawn or suspended. A certificate that lapsed last year is a common find.
- Read the scope statementIf you need fabrication and assembly, a scope that names only one of them does not cover your order.
- Match the addressThe address on the certificate has to be the address that will actually build the boards.
- Match the standard to the productIf no automotive customer requires IATF 16949, there is no reason to demand it — or to pay for the documentation that comes with it.
- Find out who is holding itIf a trading company holds the certificate and a subcontractor builds the boards, you have learned nothing about the factory that matters.
- Ask what arrives with the shipmentA first-article inspection report, AOI or X-ray data, and a certificate of conformance are the practical evidence. A logo on a quotation is not.
What the dates on the certificate actually mean
A management-system certificate runs on a three-year cycle, not an annual one: an initial audit, surveillance audits in years one and two, and a recertification audit in year three. ISO/IEC 17021-1 requires the certificate itself to carry that recertification due date, and a document issued for a single year and renewed annually is not how an accredited three-year cycle is written up.
Two things follow, and both are the ones buyers most often miss:
- A one-year expiry is the thing to query. Ask which date you are being shown, and where the certificate sits in its cycle — one issued three years ago is at the end of that cycle, not the start of it.
- Read the status field, not only the dates. A suspended certificate can still be inside its validity period, and in the IATF database a suspended certificate still appears among the valid ones. Issued, suspended or withdrawn is the line that decides whether the claim means anything today.
Where to check it yourself, before you ask
Two public databases cover everything on this page except the workmanship standard.
| Standard | Where to verify it | What the record tells you |
|---|---|---|
| ISO 9001 ISO 13485 |
IAF CertSearch — the public database of accredited management-system certificates | The certified organisation, the body that issued the certificate, and whether it is currently valid |
| IATF 16949 | The IATF certificate validity check, searched by IATF certificate number | Status, plus the certified site's name, city and country — which is how you confirm it is the site that will build your boards |
| IPC-A-610 | No database — it is a workmanship standard, not a certification scheme | Nothing about how a factory is run. Judge it on the board, not on a website. |
Both databases are public. A supplier who objects to you looking is telling you something the certificate itself would not.
What we hold, and how to check it
Everything on your board happens at one address in Bao'an, Shenzhen — fabrication, component sourcing, SMT and DIP assembly, inspection and functional test — so there is one scope statement to check rather than a chain of subcontractors each holding their own, and each able to blame the last. Check ours the way the list above describes, with the same scrutiny you would apply to any other supplier. If your product is regulated, tell us at the quote stage and we will tell you which standard actually applies to it, including the cases where the answer is that you need less documentation than you asked for.
Common questions
Which quality certification should I ask my PCBA supplier for?
Match it to the product rather than the logo. ISO 9001 is the baseline nearly every factory claims. IATF 16949 is what the automotive supply chain requires and is passed down by contract. ISO 13485 is what medical device companies require of their suppliers. IPC-A-610 Class III is not a management system at all — it is a workmanship standard that describes the solder joints on your board. If no automotive customer requires IATF 16949, there is no reason to demand it, or to pay for the documentation that comes with it.
How do I check that a certificate really covers my order?
Ask for the certificate PDF, not the badge on the website. Check the issue and expiry dates and whether it is marked withdrawn or suspended. Read the scope statement — a scope that names fabrication but not assembly does not cover your order. And match the address on the certificate to the address that will actually build the boards. A certificate is issued to a legal entity, at a physical address, against a written scope, so if a trading company holds it while a subcontractor builds the boards, you have learned nothing about the factory that matters. Certificates run on a three-year cycle with surveillance audits in years one and two, so ask where the certificate sits in that cycle; and read the status field rather than only the dates, because a suspended certificate can still be inside its validity period.
Does ISO 9001 mean the boards I receive will be good?
No. ISO 9001 describes how a company plans, controls, measures and improves its own processes. It says nothing about your particular board, or about processes the company left outside its scope. It is the floor you should expect, and usually the prerequisite for everything above it, but it is claimed by so many suppliers that on its own it separates almost nobody. The standard with the most direct effect on what arrives in the box is IPC-A-610, which is also the only one you can verify on a finished board without reading any paperwork.
Related guides
What IPC-A-610 Class III actually requires
The difference between Class I, II and III, what Class III changes on the line, and how to tell whether your product genuinely needs the strictest one.
From prototype to production: when you have to change supplier
Why a certification requirement often forces the switch, and what re-qualifying a new supplier really costs.
What happens when a component goes obsolete?
NRND, last-time buy and end-of-life — and why swapping in a replacement part usually means re-qualifying the assembly.
