What a certification certifies, and what it does not
An ISO 9001, EN 9100, ISO 13485 or IATF 16949 certification attests that an independent body has audited the company’s management system and judged it compliant with a standard. It certifies neither a product, nor a part, nor a batch. It says that the company has organised its processes (document control, purchasing, production, inspection, corrective actions, improvement) and that it applies them, at the time of the audit and within a given scope.
What it brings
- A documented working method, audited regularly.
- Control of suppliers, measuring equipment and traceability.
- Structured handling of non-conformities and complaints.
What it does not bring
- A guarantee that every part is compliant: inspecting your parts remains necessary.
- A judgement on the workshop’s technical know-how for your specific part.
- A commitment on price, lead time or available capacity.
A non-certified workshop is therefore not a bad workshop, and a certified workshop can deliver a non-conforming part: certification reduces the risk, it does not remove it. A certified workshop has an inspection procedure, but it is your drawing, your specification and your first article that tell you whether the critical dimension of your part is held.
ISO 9001: the common foundation
ISO 9001 is the generic standard for quality management systems, applicable to any organisation, whatever its sector. The 2015 edition, supplemented in 2024 by an amendment on climate change, is the one most certificates cite. As a standard is revised periodically, always check the edition cited: during a revision, certification bodies are given a transition period.
It rests on the process approach, risk management, customer satisfaction and continual improvement. At a subcontractor, it translates in practice into a review of each order before launch, control of purchasing, manufacturing instructions, calibration of measuring equipment, and handling of non-conformities and corrective actions. It is the minimum foundation expected of a workshop that produces runs for industry.
A workshop can legitimately declare certain requirements not applicable, for example design if it manufactures only to its customers’ drawings: the certificate then states this in its scope.
A three-year audit cycle
A certification follows a cycle: initial audit, surveillance audits (generally every year), then a renewal audit after three years. A valid certificate therefore means the workshop was audited recently; it can nevertheless be suspended or withdrawn between two audits if serious non-conformities are not corrected.
EN 9100, ISO 13485, IATF 16949: requirements specific to each sector
| Standard | Sector | Link with ISO 9001 | Added requirements (examples) |
|---|---|---|---|
| EN 9100 | Aerospace, space, defence | Takes up the requirements of ISO 9001 and adds to them | Configuration management, operational risks, product safety, prevention of counterfeit parts, first article inspection |
| ISO 13485 | Medical devices | Draws on it, but remains a distinct standard | Regulatory compliance, risk management, reinforced traceability, validation of special processes, supplier control |
| IATF 16949 | Automotive (production runs) | Builds on ISO 9001 and adds to it | Defect prevention, control plans, FMEA, production part approval, measurement system analysis, statistical control |
EN 9100. It is driven by the IAQG, the international grouping of the aerospace industry, which maintains a database of certificates (OASIS). It should not be confused with Nadcap accreditation, specific to certain special processes (heat treatment, non-destructive testing, welding, chemical treatments), which some buyers require in addition.
ISO 13485. It is not equivalent to CE marking: the medical device manufacturer bears the regulatory responsibility. It defines how it assesses and controls its suppliers, according to the risk of each part.
IATF 16949. It is issued by bodies recognised by the IATF (International Automotive Task Force). Car manufacturers require it first and foremost from their direct suppliers; for lower tiers, the requirement varies.
Other standards exist depending on the industry: ISO 14001 (environment), ISO 45001 (occupational health and safety), EN ISO 3834 (welding quality), EN 1090 (steel and aluminium structures), ISO 22163 (rail).
How to check a certificate: body, scope, validity
Ask for the certificate itself, as a PDF: a logo on a website proves nothing. Also beware of “certifications” with no standard or independent body: a self-declaration of conformity is not a certification. Then check the points in the table.
| Point to check | What to look at | Warning sign |
|---|---|---|
| Entity and site | Company name and address of the site that will make your parts | Certificate in the name of another company or another site |
| Certification body | Its name and accreditation (in France, Cofrac, the national accreditation body, or an accredited body that is a signatory of the IAF recognition arrangements); for EN 9100, a body recognised by the IAQG | Unknown body, no accreditation mentioned |
| Standard and edition | Exact standard and year (for example ISO 9001:2015) | Standard different from the one announced, outdated edition |
| Scope | Activities and sites covered, any exclusions | Scope unrelated to your need |
| Dates | Issue date, expiry date (generally three years, with interim surveillance audits) | Certificate expired, suspended or withdrawn |
| Confirmation | The body’s database, the OASIS database for EN 9100, online databases listing accredited certificates, such as IAF CertSearch | Unable to find the certificate where it should appear |
Cofrac publishes the list of bodies it accredits. If in doubt, ask the body directly to confirm the validity of the certificate, and ask the workshop about its latest audit (date, non-conformities found, action plan): a serious workshop answers without difficulty.
When to require a certification
| Your situation | Certification often expected | Note |
|---|---|---|
| Parts for aerospace and space or defence | EN 9100 (or its American equivalent, AS9100) | Often imposed by the higher-tier buyer: check what it requires of you and your subcontractors, special processes included. |
| Components for medical devices | ISO 13485 for critical parts | The device manufacturer sets its purchasing requirements according to the risk of the part. |
| Parts for the automotive industry (suppliers, production runs) | IATF 16949 or ISO 9001, depending on the supplier’s tier | Requirements vary with the manufacturer and the level in the chain. |
| Recurring industrial runs, safety parts | ISO 9001 | A mark of basic rigour; does not replace first article inspection. |
| Prototype, one-off part, small non-critical run | Rarely necessary | First article inspection and a material certificate are often enough. |
This table describes common practice: it replaces neither your contract nor the regulations applying to your product. If your own customer imposes a certification on you, pass the requirement on in your request, with the exact standard.
When requiring it becomes oversized
Requiring a sector certification for a part that does not come under it rules out competent workshops and can raise the quote, because certification has a cost that the workshop passes on. A few signs are unmistakable: EN 9100 requested “on principle” for a non-critical guard or bracket, ISO 13485 for a component unrelated to a medical device, IATF 16949 for a need outside automotive, or a certification required for a few prototype parts.
Other evidence often gives more information than a certificate:
- the first article and its dimensional report (see the guide on dimensional inspection and first article);
- the 3.1 material certificate and batch traceability;
- the workshop’s control plan and measuring equipment;
- comparable references, a visit or a trial order;
- the other criteria in the guide choosing an industrial subcontractor.
For a small workshop, obtaining and maintaining a certification takes time and resources: making it the only selection criterion sometimes means going without the best know-how.
Conversely, do not underestimate the requirement when the part is critical: a defect on a safety or structural part costs far more than the price difference of a certified workshop. It is the criticality of the part, not the size of the order, that should guide your requirement.
What to specify in your quote request
- the certification required, with the standard and edition (for example “ISO 9001:2015”);
- whether it is a contractual requirement from your own customer or a preference;
- the scope expected: machining, welding, heat or surface treatment, inspection;
- the documents to provide: copy of the certificate with its expiry date;
- the product documents: 3.1 material certificate, inspection report, first article report, certificate of conformity;
- the level of traceability: batches, heat numbers, part marking;
- the requirements regarding onward subcontracting: must special treatments entrusted to a third party also be qualified?
On Meaflow, posting a request is free and commission-free: you state your requirements, workshops reply and you talk by messaging. Then ask the suppliers that interest you for their certificates and check them as described above.
Frequently asked questions
Does ISO 9001 certification guarantee the quality of my parts?
No: it attests that a management system has been audited and judged compliant, not that every part is. It reduces the risk of uncontrolled defects, but replaces neither inspection of your first part nor your requirements for drawing, material and traceability.
How do you check that a certificate is valid?
Check the company name, the site, the issuing body and its accreditation, the standard, the scope and the dates, then confirm with the body or in an online database (for example OASIS for EN 9100). A certificate that is expired, in the name of another entity or unrelated to your need has no value for your order.
Do you need EN 9100 to make an aerospace part?
Aerospace buyers often require it from their suppliers, but it is not a universal rule: it depends on the contract, the supplier’s tier and the criticality of the part. Ask for your buyer’s exact requirements, special processes included.
Is ISO 13485 mandatory for a medical device subcontractor?
Not systematically. It is the device manufacturer, responsible for regulatory compliance, that defines how it assesses and controls its suppliers according to the risk of the part. It may require ISO 13485 for critical components and settle for other assurances for simple parts.