Your customer's contract decides which standard you need — not your preference. ISO 9001 is the base quality management standard for any industry; AS9100 is ISO 9001 plus aerospace requirements; IATF 16949 is the automotive version with stricter rules and its own certification scheme. If a buyer told you to "get ISO certified," the first job is to find out which of these they mean.
All three share the same core. AS9100 reprints the full text of ISO 9001:2015 and adds about 100 aerospace requirements. IATF 16949 is written as a supplement — your system must meet ISO 9001 and the automotive additions together. The sector standards demand more records, more supplier controls, and more audit days, so they cost more and take longer.
This guide covers what each standard adds, who requires it, and how to confirm the answer before you spend money. If your customers accept ISO 9001, the common path is to certify to it first and step up only when a contract demands it.
ISO 9001: the base standard
ISO 9001:2015 is the general-purpose quality management system (QMS) standard. It applies to any industry and any company size. It has 10 clauses covering context, leadership, planning, support, operation, performance evaluation, and improvement. The requirements are things a well-run shop should do anyway: control nonconforming product (clause 8.7), qualify suppliers (8.4), calibrate measuring equipment (7.1.5), audit yourself (9.2), review the system with management (9.3), and fix problems at the root (10.2).
Certification comes from a certification body (registrar) accredited under ISO/IEC 17021-1. Audit length is set by IAF MD 5, which ties audit days to your headcount. ISO 9001 proves you have a working QMS. It does not prove you can meet aerospace or automotive rules — that is what the sector standards exist for.
AS9100: aviation, space, and defense
AS9100 (currently Revision D) contains the complete text of ISO 9001:2015, plus roughly 100 added or expanded requirements for aviation, space, and defense. It is published through the IAQG, the aerospace industry's quality group. One AS9100 audit covers both standards, and the certificate typically cites both. The biggest additions:
- Product safety: planned controls across the product's life.
- Counterfeit parts prevention: processes to keep fake or suspect parts out of your product.
- Configuration management, plus control of critical items and key characteristics.
- Flow-down: your customer's requirements must pass down to your own suppliers (an expansion of clause 8.4).
- Production process verification, including first article inspection (usually documented per AS9102).
Two scheme details matter. First, certificates are published in OASIS, the IAQG's online database. Aerospace primes check OASIS before they approve a supplier — if your certificate is not there, you are invisible to them. Second, AS9100 audits run under the ICOP scheme (Industry Controlled Other Party), which means aerospace-approved auditors and extra oversight. Expect more audit days than plain ISO 9001 at the same headcount.
IATF 16949: automotive
IATF 16949:2016 replaced ISO/TS 16949 as the automotive QMS standard. Unlike AS9100, it does not reprint ISO 9001 — it is written as a supplement. Your system must meet ISO 9001:2015 and the IATF additions together, and the IATF 16949 audit checks both. Two things make it the heaviest of the three:
- Customer-specific requirements (CSRs). Each automotive OEM publishes its own extra rules on top of the standard. Auditors check your CSRs, so "certified" means certified against your specific customers' demands.
- The core tools: APQP (advance quality planning for new parts), PPAP (the part approval package you submit before production), FMEA (failure mode and effects analysis), MSA (measurement systems analysis), and SPC (statistical process control). Each one produces records your auditor and your customer will ask for.
The scheme is also stricter. Certification bodies must be approved and monitored by the IATF itself — accreditation under ISO/IEC 17021-1 alone is not enough. Audits happen every year, must cover every shift where product is made, and certificates are tracked in the IATF's own database. IATF 16949 is meant for sites making automotive production or service parts. It is not something to pursue on speculation.
Sidebar: ISO 13485 for medical devices
If your customer makes medical devices, the standard they name is usually ISO 13485:2016. It is a standalone QMS standard built from an older ISO 9001 structure. It leans harder on documentation, traceability, sterile and cleanroom controls, and regulatory reporting, and it drops most of the business-improvement language. It matters in the US market too: the FDA's Quality Management System Regulation now incorporates ISO 13485 by reference. The same decision rule applies — the contract and the regulator tell you what you need.
Side-by-side comparison
| Standard | Industry | Adds to ISO 9001 | Scheme and registry | Typical driver |
|---|---|---|---|---|
| ISO 9001:2015 | Any | — (this is the base) | Registrars accredited under ISO/IEC 17021-1; audit days per IAF MD 5 | Customer contracts, RFQs, supplier approval |
| AS9100 Rev D | Aviation, space, defense | ~100 additions: product safety, counterfeit parts, configuration management, flow-down, first article inspection | IAQG ICOP scheme; certificates published in OASIS | Prime contractor and defense flow-down clauses |
| IATF 16949:2016 | Automotive production and service parts | Customer-specific requirements plus core tools (APQP, PPAP, FMEA, MSA, SPC) | Registrars approved directly by IATF; yearly audits, all shifts; IATF database | OEM and tier-1 sourcing mandates |
| ISO 13485:2016 | Medical devices | Standalone standard: device files, traceability, sterile controls, regulatory reporting | 17021-1 accredited registrars; MDSAP where regulators require it | Device regulation and device-maker supplier rules |
The decision rule: your contract tells you
You do not pick a standard the way you pick software. Your customer already picked it. Find the requirement in three places:
- The purchase order and its quality clauses. Aerospace and defense POs often carry lettered "Q clauses" that name the standard and revision.
- The customer's supplier quality manual or terms, usually posted on their supplier portal.
- The RFQ or supplier survey they sent you — certification questions there are requirements in disguise.
Then confirm with the buyer in writing. Ask three questions: Which standard? Which revision? Do you require an accredited certificate, or is a compliant (uncertified) QMS acceptable for now? Some customers accept "compliance with" a standard for early orders and require the certificate at a volume threshold. That difference is worth months and thousands of dollars.
The common path: ISO 9001 first
If your customers accept ISO 9001, certify to it first. This is the normal route for small manufacturers. A sound ISO 9001 system is most of the work for AS9100, which sits on top of it, and required content for IATF 16949. Upgrading later is an expansion, not a restart: your registrar audits the difference, your procedures grow, your records deepen.
Go in with honest numbers. Registrars typically quote by the audit day, and IAF MD 5 ties days to headcount — a 10-100 person shop usually lands between two and seven days for the initial ISO 9001 audits, plus yearly surveillance. AS9100 adds audit days, scheme fees, and OASIS administration at the same size. IATF 16949 adds yearly audits across every shift, plus the standing cost of core-tool records and PPAP submissions. The sector standards also demand more records day to day: first article reports, configuration logs, CSR evidence. Budget staff time, not just registrar fees.
For the documentation itself you have three options: write it in-house, adapt generic templates, or have it built for you. ISO Delivered, for example, sells a $500 Readiness Report and a flat $8,000 documentation package — about 44 documents (manuals, procedures, work instructions, and forms) delivered two to four weeks after a questionnaire — plus a free public-visibility snapshot at /free-assessment. No documentation provider sells certification: that comes only from an accredited registrar, and you will need about three months of operating records before your Stage 2 audit.
One last rule: do not certify to a sector standard on speculation. AS9100 and IATF 16949 cost real money every year. Certify to what your customers require now, and step up when a contract — in writing — demands more.
Frequently asked questions
Does AS9100 include ISO 9001?
Yes. AS9100 contains the full text of ISO 9001:2015 plus the aerospace additions. One AS9100 audit covers both sets of requirements, and the certificate typically cites both standards. You do not need a separate ISO 9001 certificate if you hold AS9100.
Can I be certified to IATF 16949 without ISO 9001?
IATF 16949 is a supplement to ISO 9001:2015, so your system must meet all of ISO 9001 plus the automotive additions, and the IATF audit checks both. You do not have to hold a separate ISO 9001 certificate first. Many shops still certify to ISO 9001 first because it is most of the work and satisfies non-automotive customers along the way.
What is the OASIS database?
OASIS is the IAQG's online system where AS9100-series certificates are published. Aerospace primes and their buyers search OASIS to verify a supplier's certification status before approving them. If your AS9100 certificate does not appear there, many aerospace customers will treat you as uncertified.
What are the automotive core tools?
Five methods that IATF 16949 expects you to use and keep records of: APQP (quality planning for new parts), PPAP (the approval package you submit before production starts), FMEA (risk analysis of designs and processes), MSA (proving your gauges measure reliably), and SPC (statistical control of processes). Auditors ask for the records, and automotive customers demand PPAP submissions directly.
Is ISO 9001 enough for aerospace or automotive customers?
Sometimes. Some buyers accept ISO 9001 for non-critical parts, or accept ISO 9001 plus specific clauses flowed down in the purchase order. Only your contract answers this, so ask the buyer in writing before you commit to a standard.
How much more do AS9100 and IATF 16949 cost than ISO 9001?
There is no fixed figure, but the direction is always up. Registrars typically quote more audit days for AS9100 than for a same-size ISO 9001 audit, and the ICOP scheme adds auditor and OASIS fees. IATF 16949 requires audits every year covering all shifts, plus the ongoing cost of core-tool records and customer-specific evidence. Budget more money and more staff time, not just a higher registrar invoice.