OEM quality requirements reach your shop as flow-down: a clause on a purchase order, a line in a supplier quality manual, or a checkbox on a survey that purchasing treats as a gate. ISO 9001:2015 does not invent that pressure. It tells you how to review it (8.2.2 and 8.2.3), how to pass the relevant parts to your own suppliers (8.4.3), how to keep identity through the job (8.5.2), and how to release product against those requirements (8.6).
Six to nine months is typical for a first certification. That is the planning range for documenting the system, running it long enough to produce records, and completing Stage 1 and Stage 2 with an accredited certification body. It is not a promise that any OEM will add you to an approved-vendor list on a given date.
This guide walks the flow-down path in the order an auditor samples it: what you accepted, what you sent downstream, how you identified the work, and what evidence you used to ship.
What flow-down is
The OEM holds its own ISO 9001, IATF, AS9100, or customer-specific duties. Clause 8.4 of their system says they must control you. The cheap, scalable control is a quality clause that names a standard, a record set, or a right of access, and then a requirement that you flow the same ideas to anyone who touches the product. You are not being singled out. You are being used as a control they can show their auditor.
- Purchase-order quality clauses, including lettered Q-clauses and referenced specifications.
- Supplier quality manuals and terms on the OEM portal — they bind when the PO, master agreement, or accepted terms incorporate them; verify incorporation and version.
- RFQ and survey questions about certification; a "yes" you cannot support becomes a contract problem later.
Clause 8.2.2 — determining the requirements
Clause 8.2.2 requires you to determine the requirements for the products and services, including those the customer did not state but that are necessary, and the statutory and regulatory ones. For OEM work that means reading past the part number. Pull the quality clauses, the drawing notes, the spec revision list, packaging rules, and any customer-specific requirements the supplier manual attaches to your commodity.
A common miss: the PO says "certify to print" and the portal says ISO 9001 plus lot traceability plus a PPAP level. Portal terms bind when the PO, master agreement, or accepted terms incorporate them. Verify incorporation and version, and use clause 8.2.3 review to resolve any discrepancy in writing before acceptance. Clause 8.2.2 is how the incorporated requirements enter your system together.
Clause 8.2.3 — review before you commit
Clause 8.2.3 is the review that happens before you accept the order. You confirm you can meet the requirements, including delivery, and you resolve differences between the quote and the PO. If the OEM added a quality clause after the quote, the review is where you catch it — not the week of shipment.
Keep a record of the review. For a small shop that can be a signed estimate packet, a checklist on the order, or an email thread that names the clauses you accepted. Auditors sample 8.2.3 by picking a live job and asking who decided the shop could do it.
Clause 8.4.3 — information for external providers
Clause 8.4.3 is the flow-down you issue. Communicate to external providers what you need: the process or product, the specifications, competence, calibration, control of their suppliers, and any verification or right-of-access terms you accepted from the OEM. A generic PO that only names price, quantity and a due date is insufficient unless the applicable requirements reach the supplier through another controlled, incorporated source — a specification, a quality agreement or portal terms the supplier has accepted.
You do not have to paste the entire OEM manual onto every PO. You do have to send the applicable pieces. If the OEM requires a specific heat-treat spec and a certificate of conformance with stated tests, those words belong on your PO to the heat-treater.
Clause 8.5.2 — identification and traceability
Clause 8.5.2 requires you to identify outputs, to identify inspection status, and to control unique identification when traceability is a requirement. OEM clauses often make traceability a requirement even when ISO 9001 would otherwise leave it optional. Heat lots, date codes, serials, and split-lot rules need a method that survives your process and your suppliers' processes.
If a finisher mixes lots, your 8.5.2 method failed at 8.4.3 — you did not tell them, or you did not verify they could do it. Auditors follow one serial or one heat through receiving, production, and shipping. Broken identity is a flow-down finding, not a paperwork nit.
Clause 8.6 — release against the flowed requirements
Clause 8.6 is planned verification at appropriate stages and retained evidence of release, including who authorized it. On OEM work the release checklist should include the flowed items you accepted in 8.2.3: dimensional results, material certs, special-process certs, traceability, and any customer-required ship documents. Releasing because the dock is full is not 8.6.
Product that fails a check is nonconforming output under clause 8.7, not an 8.5 production note. Hold it, decide rework, scrap, or OEM concession, record the decision, then re-release under 8.6 if it ships.
| Clause | Question the auditor can ask | Evidence that answers it |
|---|---|---|
| 8.2.2 | How did you know what the OEM required on this job? | PO clauses, drawing notes, supplier-manual extract, spec list |
| 8.2.3 | Who accepted those requirements before you started? | Order review record that names differences you resolved |
| 8.4.3 | What did you tell the special-process supplier? | Your PO with the applicable specs, certs, and access terms |
| 8.5.2 | Show this heat or serial from receiving to ship. | ID method, traveler or labels, supplier certs, packing list |
| 8.6 | What was checked, and who released the lot? | Release record with results and the name of the releaser |
A practical sequence before the next OEM PO
- Collect the OEM's quality clauses and supplier manual for your commodity.
- Review them under 8.2.2 and 8.2.3 before you accept the next order.
- Rewrite supplier POs so 8.4.3 carries the applicable specs and record requirements.
- Check that 8.5.2 identity would survive one full job, including outside processing.
- Align the 8.6 release checklist with those same items.
Six to nine months is typical for a first certification if you are also building the rest of the QMS around this path. A $500 Readiness Report maps the shall-statements to how you already review and ship OEM work. Full documentation is the $8,000 set of manuals and policies, procedures, work instructions, and forms, sized to how your company runs. The Public-surface scan is a free look at what your public site already shows. A documentation provider does not issue the certificate; an accredited certification body does, and the conformity decision stays with that body.
Frequently asked questions
What is quality-requirement flow-down?
It is the OEM passing its quality obligations to you, and you passing the applicable parts to your suppliers. In ISO 9001:2015 the receiving side is 8.2.2 and 8.2.3; the sending side is 8.4.3. Traceability (8.5.2) and release (8.6) are how you prove the chain held for a given job.
Do we have to flow the entire OEM manual to every supplier?
No. Clause 8.4.3 requires the applicable information — specs, records, competence, verification, and access terms that apply to that provider's work. Sending a 200-page manual with no highlighting is not the same as telling the heat-treater which spec and cert to return.
What if the PO and the supplier portal disagree?
Portal and supplier-manual terms bind when the PO, master agreement, or accepted terms incorporate them. Verify incorporation and version, and resolve any discrepancy in writing under clause 8.2.3 before you accept. Ignoring an incorporated portal is how shops fail customer audits and then fail their own 8.2.2 sample.
Is an ISO 9001 certificate enough to satisfy every OEM clause?
No. The certificate speaks to the management system. OEM clauses still add drawing notes, special-process specs, PPAP or first-article packages, and record formats. Review those under 8.2.2 and 8.2.3; do not assume the certificate covers them.
How long should we plan if an OEM just required ISO 9001?
Six to nine months is typical for a first certification. Use live OEM jobs as the records for contract review, supplier flow-down, traceability, and release so Stage 2 has something to sample.