IATF 16949 vs ISO 9001: PPAP & Supplier Checklist

ISO 9001 establishes a general quality-management-system baseline; IATF 16949 adds automotive requirements such as APQP, PPAP, FMEA, control plans, MSA, SPC and customer-specific requirements. Buyers should select the required standard from the end-use contract, then verify that the certificate covers the legal entity, manufacturing site and processes that will make the parts.

This article explains quality-system requirements for supplier selection. DRAmetal holds ISO 9001, IATF 16949, AS9100D and ISO 13485 certifications. Certification details are available on request for supplier qualification; the buyer should confirm the applicable scope against the proposed order.

The official baseline

ISO 9001

is the international standard for quality management system requirements. It applies across industries and focuses on a controlled system for meeting customer requirements, managing processes, measuring performance and improving over time.

Status as of July 2026: ISO 9001

remains the published certifiable edition. ISO lists the replacement edition as under publication with an expected September 2026 publication date. Buyers should verify the edition printed on a certificate and follow the transition rules issued after the new edition is formally published; a draft or expected date is not a certification basis.

IATF 16949

is the automotive quality management system standard. It is aligned with ISO 9001 and adds automotive-sector requirements. IATF has also announced revision activity, so long-running automotive programs should watch customer-specific transition requirements instead of assuming a certificate note will never change.

This guide focuses on the ISO 9001 vs IATF 16949 sourcing decision, then explains where aerospace and medical quality-system requirements create a different qualification path.

Quick comparison for sheet metal buyers

Question	ISO 9001 supplier	IATF 16949 supplier
Is there a documented QMS?	Yes	Yes, with automotive additions
Is PPAP expected by default?	Usually no	Yes, when required by the customer/program
Are APQP and launch planning expected?	Not necessarily	Yes
Are control plans standard practice?	May be project-specific	Core automotive requirement
Is FMEA normally used?	Optional unless required	Expected as part of risk planning
Is MSA used to validate gauges?	Optional unless required	Expected where measurement systems affect acceptance
Is SPC used for process control?	Optional unless required	Expected where characteristics require statistical control
Are customer-specific requirements central?	Limited	Central
Is the certificate enough by itself?	No	Also no - scope and execution still matter

The key point: IATF 16949 is not just “ISO 9001 with an automotive logo.” It changes how the supplier plans, approves, measures and controls production.

What ISO 9001 is enough for

ISO 9001 is suitable for many sheet metal programs:

• Industrial machinery guards, brackets, panels and covers.
• Electrical enclosures and control cabinets outside automotive production.
• HVAC, telecom, generator, kiosk and general equipment enclosures.
• Prototype and low-volume fabrication.
• Build-to-print parts where the buyer defines inspection requirements.
• Programs where industry-specific certification is not required by contract.

For these projects, a capable ISO 9001 supplier can be the right choice if it also has the right equipment, engineering support, inspection discipline, material control and communication. The certificate is only the starting filter.

When auditing an ISO 9001 fabricator, focus on practical evidence:

• Does the supplier control drawing revisions?
• Are first articles measured against the drawing?
• Are material certificates available when required?
• Are welding, bending, hardware insertion and finishing processes controlled?
• Are nonconformities documented and corrected?
• Are packaging and export requirements handled consistently?

Use our sheet metal supplier audit checklist if you need a structured qualification process.

When IATF 16949 matters

IATF 16949 matters when sheet metal parts become part of the automotive production supply chain. That includes more than traditional vehicle bodies. It can include:

• EV battery trays, battery module racks and structural brackets.
• Charging equipment supplied into automotive programs.
• Power electronics housings and cooling-related metal parts.
• Sensor, ADAS, ECU or electronics enclosures.
• Seat, chassis, underbody, thermal or safety-related sheet metal components.
• High-volume repeat parts supplied to Tier 1 or Tier 2 customers.

For these programs, the buyer may need PPAP, APQP records, control plans, capability studies, material traceability and customer-specific evidence. A normal ISO 9001 quote usually does not include that workload unless you specify it.

For EV-related fabrication examples, see our battery tray, battery module rack and EV charging enclosure pages.

PPAP is the big commercial difference

The biggest practical difference for buyers is PPAP. Production Part Approval Process is not just a sample shipment. It is a formal evidence package showing that the supplier understands the design, has planned the process and can produce conforming parts consistently.

Depending on customer requirements, a PPAP package may include:

• Design record and drawing revision.
• Engineering change documents.
• Process flow diagram.
• Process FMEA.
• Control plan.
• Measurement system analysis.
• Dimensional results.
• Material and performance test results.
• Initial process capability studies.
• Appearance approval where relevant.
• Sample parts.
• Part submission warrant.

For a simple bracket, this may feel heavy. For automotive production, it is normal. The buyer should define PPAP level, submission timing and approval owner before placing the purchase order.

APQP changes the launch schedule

Advanced Product Quality Planning affects timing. An IATF-style launch is not simply “send CAD, make samples, approve price.” It includes structured planning before production release.

For a sheet metal part, APQP may require:

• Reviewing drawing feasibility and special characteristics.
• Confirming material, thickness, finish and corrosion requirements.
• Defining tooling, fixtures, gauges and inspection points.
• Running bend, weld, hardware insertion and finish trials.
• Validating packaging and transport protection.
• Preparing control plans and operator instructions.
• Completing PPAP submission before mass production.

This adds discipline, but it also adds lead time and engineering cost. If you need automotive-level controls, budget for them openly. If you do not need them, do not force every prototype program into an automotive launch process.

Certificate scope matters

Do not accept “we are certified” at face value. Verify the certificate scope.

Check:

• Legal company name on the certificate.
• Site address and production site covered.
• Certificate number and issuing certification body.
• Expiration date and surveillance status.
• Scope statement: does it cover sheet metal fabrication, stamping, welding, assembly or only trading/design?
• Whether IATF certification covers the specific site that will make the parts.

This matters for global sourcing. A group company may have one certified plant while another plant is only ISO 9001 or has no automotive certificate. If the certificate scope does not cover the manufacturing site and process, it does not protect your program.

For DRAmetal, the outward-facing brand is DRAmetal, and the formal operating company is Shenzhen Shixin Metal Products Co., Ltd. DRAmetal holds ISO 9001, IATF 16949, AS9100D and ISO 13485 certifications. Request certification details during supplier qualification and confirm the legal entity, site and activities relevant to the quoted work. Project-level inspection records remain separate deliverables, not substitutes for a required quality-system certificate.

When an ISO 9001 supplier can still serve automotive work

Not every automotive-related sheet metal component requires the supplier itself to hold IATF 16949 certification. In some cases, an ISO 9001 supplier can support automotive work if the IATF-certified customer flows down the required controls and manages approval.

This may be acceptable for:

• Prototype parts.
• Tooling, fixtures or non-production equipment.
• Low-risk indirect parts.
• Build-to-print subcomponents controlled by an IATF-certified Tier supplier.
• Programs where the customer explicitly accepts ISO 9001 plus project-specific controls.

The key is written responsibility. If the buyer expects PPAP, control plans, traceability and capability studies, those requirements must be in the RFQ and purchase order. Do not assume they are included because the part is “automotive.”

Audit questions for sheet metal suppliers

Use these questions when comparing ISO 9001 and IATF 16949 suppliers.

Quality system and scope

• What certificates are current, and what site do they cover?
• Does the scope include the actual sheet metal processes used for this program?
• Who owns document control and customer requirement review?
• How are drawing revisions communicated to production?

Launch and process planning

• Can the supplier provide APQP documentation if required?
• Can it prepare process flow, PFMEA and control plan documents?
• Are special characteristics identified on work instructions and inspection plans?
• How are prototype deviations separated from production approval?

Measurement and inspection

• What gauges and fixtures will be used for critical dimensions?
• Is MSA required for any measurement system?
• Are CMM, height gauge, thread gauge, coating thickness and torque checks available?
• How are inspection records tied to lot or serial number?

Process control

• Are press brake, welding, hardware insertion and finishing parameters controlled?
• Is SPC required for any critical characteristic?
• How are nonconforming parts contained?
• What triggers corrective action?

Traceability and supplier control

• Are material heat numbers and MTRs available when required?
• Are purchased components and surface finishing suppliers controlled?
• How are customer-specific requirements flowed down?
• Can packaging lots be traced to production lots?

These questions reveal execution quality better than a certificate alone.

RFQ wording buyers can use

For ISO 9001-level industrial work:

Supplier shall maintain a documented quality management system suitable for sheet metal fabrication. First article inspection, material certification where required, drawing revision control, nonconformance control and final inspection records shall be available on request.

For automotive or IATF-style work:

Supplier shall support automotive production approval requirements, including APQP, process flow, PFMEA, control plan, dimensional report, material records, MSA, capability study and PPAP submission as required by the customer. Customer-specific requirements and special characteristics shall be reviewed before quotation and flowed into production controls.

For any certificate-based requirement, add:

Supplier shall provide current certificates showing legal entity, site address, scope, certification body, certificate number and expiry date. Certificate scope must cover the manufacturing processes used for the quoted parts.

Where AS9100D and ISO 13485 fit

IATF 16949 is not a universal upgrade for every regulated industry. Aerospace and medical-device programs use different quality-system frameworks:

• AS9100D adds aerospace controls such as configuration management, product safety, counterfeit-part prevention and foreign-object damage prevention to the ISO 9001 foundation.
• ISO 13485 applies to medical-device quality systems and places greater emphasis on regulatory requirements, risk management, validation and controlled records.

The end-use industry and contract determine the applicable standard. Buyers should not substitute an automotive certificate for an aerospace or medical requirement, or assume that any certificate automatically covers the quoted manufacturing site and processes. Verify the legal entity, site address, scope, expiry and certification body before supplier approval.

DRAmetal certifications and project qualification

DRAmetal holds ISO 9001, IATF 16949, AS9100D and ISO 13485 certifications. Certification details are available on request for supplier qualification. A quality-system certificate does not by itself approve a specific part, special process or finished product; the buyer should review the relevant certificate scope and project requirements before supplier approval.

For every program, define drawing control, material records, first-article inspection, shipment documentation and nonconformance requirements in the RFQ. These deliverables must be agreed for the order rather than inferred from company certification. Acceptance remains the buyer’s qualification decision and should be based on the end-use risk and contract.

Relevant capabilities include:

• Sheet metal assembly and integration for build-to-print equipment modules.
• Material traceability where heat numbers and MTRs matter.
• Quality inspection for imported parts when buyers need shipment-level evidence.
• EV battery tray fabrication and battery module racks for EV and energy programs.

If your sourcing team needs to compare ISO 9001 and IATF 16949 requirements for a sheet metal program, use the checklist above first. You may send the drawings, annual volume, end-use industry and quality clauses for a fabrication and inspection-scope review, including any certification details required for supplier qualification, before quotation.