IATF 16949 requirements span the same Clause 4 through 10 structure as ISO 9001, but with automotive-specific sub-clauses built in throughout — customer-specific requirements, the AIAG core tools, manufacturing feasibility, and warranty management among them. Understanding which specific sub-clauses carry these additions, and how deeply tools like FMEA and the control plan connect across multiple clauses at once, is what separates a genuine Automotive Quality Management System from a general ISO 9001 QMS with automotive terminology layered on top.
IATF 16949's requirements can feel overwhelming precisely because the standard doesn't separate automotive-specific content into its own section — the additions sit directly alongside inherited ISO 9001 text, clause by clause, sub-clause by sub-clause. Understanding exactly where those additions live, and how connected they genuinely are to each other, makes the standard far easier to work with in practice. This article walks through IATF 16949's requirements with specific attention to the automotive-specific sub-clauses — drawing on the audit experience of Maria Falbo, a Lead Auditor with decades of IATF 16949 experience.
IATF 16949 follows the same Harmonized Structure as ISO 9001 — 10 clauses total, with Clauses 1 through 3 covering scope, normative references, and terms and definitions, and Clauses 4 through 10 containing the actual requirements. What makes the standard distinctive is that automotive-specific requirements sit directly inside that structure as supplemental sub-clauses, rather than existing as a separate automotive appendix — a sub-clause like 8.5.1.1 appears right alongside the base ISO 9001 requirement it extends.
For a broader overview of what IATF 16949 is and how it relates to ISO 9001, see our complete guide to IATF 16949, and for a full comparison of the two standards, see our article on IATF 16949 vs ISO 9001.
Clause 4.3.1 — Determining the scope of the quality management system, supplemental clarifies scope requirements specifically for automotive production, service, and accessory parts.
Clause 4.3.2 — Customer-specific requirements is the mechanism that pulls every OEM's individual expectations into the QMS itself, rather than leaving them as a separate framework sitting outside it. For a complete guide to what CSRs are and how to audit them, see our customer specific requirements in IATF 16949 guide.
Clause 5.1.1.3 — Process owners requires top management to identify specific individuals responsible for managing the organization's processes and their outputs, with those process owners required to clearly understand their role and be competent to perform it.
Clause 5.3.2 — Responsibility and authority for product requirements and corrective actions requires top management to ensure personnel responsible for product conformity have the authority to stop shipment and stop production to correct quality problems — with a specific provision where immediate stoppage isn't feasible in some industries, requiring the affected batch to instead be contained and shipment prevented. It also requires personnel with corrective action authority to be promptly informed of nonconforming product or processes, and requires every production shift to be staffed with personnel responsible for conformity.
Clause 6.1.2.1 — Risk analysis requires organizations to specifically incorporate lessons learned from product recalls, product audits, field returns and repairs, complaints, scrap, and rework into their risk analysis, with documented evidence retained.
Clause 6.1.2.3 — Contingency plans is one of the most detailed automotive-specific planning requirements in the standard. Organizations must identify risks to manufacturing processes and essential infrastructure, define contingency plans proportional to risk and customer impact, and specifically prepare for scenarios including key equipment failure, supplier interruption, natural disasters, fire, utility interruptions, labor shortages, and infrastructure disruptions. The plans must include a customer notification process, be tested periodically, reviewed at least annually by a multidisciplinary team including top management, and formally documented with a revision history. Critically, the clause also requires validating that manufactured product still meets customer specifications after production restarts following an emergency shutdown that didn't follow normal shutdown procedures.
Clause 7.1.3.1 — Plant, facility, and equipment planning requires organizations to apply risk identification and mitigation methods when developing and improving facility and equipment plans.
Clause 7.1.5.1.1 — Measurement systems analysis requires statistical studies analyzing the variation present in the results of each type of inspection, measurement, and test equipment identified in the control plan, using analytical methods and acceptance criteria conforming to recognized MSA reference materials — or alternative methods, if the customer approves them and the organization retains records of that approval. This clause explicitly connects forward to Clause 9.1.1.1's monitoring requirements, tying MSA directly into the standard's ongoing process monitoring rather than treating it as an isolated, one-time study.
Clause 7.1.5.2.1 — Calibration/verification records requires organizations to retain records of risk assessments conducted when a measuring device is found out of specification.
Clause 7.2.3 — Internal auditor competency requires general audit training aligned with ISO 19011, as well as technical knowledge of the specific process, equipment, and AIAG core tools involved, and IATF 16949 standard knowledge — three distinct competency requirements, not one general auditing credential.
Our IATF 16949 Internal Auditor course covers every requirement from Clause 4 through Clause 10, including how the core tools connect across the standard.
Clause 8 carries the largest concentration of automotive-specific sub-clauses in the entire standard, and its Design and Development section is where the AIAG core tools are most explicitly required.
Clause 8.3.2.1 — Design and development planning, supplemental requires a multidisciplinary approach to planning, explicitly citing project management methods like APQP as an example, alongside development and review of both product design risk analysis (FMEA) and manufacturing process risk analysis.
Clause 8.3.4.4 — Product approval process requires organizations to establish a product and manufacturing approval process conforming to whatever requirements the customer defines. The clause itself doesn't name PPAP specifically — it's written generically around customer-defined approval — but AIAG's Production Part Approval Process is the near-universal industry method organizations use to satisfy it in practice.
Clause 8.3.5.1 — Design and development outputs, supplemental explicitly requires design risk analysis (FMEA) as one of several required output elements, alongside items like reliability study results and product special characteristics.
Clause 8.3.5.2 — Manufacturing process design output requires the manufacturing process FMEA as one of its documented output elements too — appearing alongside the control plan itself, tooling and equipment capability studies, and process flow charts, confirming that FMEA and the control plan are meant to be built together, not developed as separate, disconnected exercises.
A misconception I see fairly often is the assumption that Clause 8.3.4.4 literally names PPAP as a requirement. It doesn't — the clause requires a customer-defined approval process, full stop. That distinction matters in practice: an organization can't assume PPAP satisfies the requirement automatically if a specific customer's CSR defines something additional, and an auditor checking this clause needs to verify against what that particular customer actually requires, not just confirm a generic PPAP submission happened.
Clause 8.2.3.1.3 — Organization manufacturing feasibility requires an assessment of the organization's capability to meet a customer's performance and timing targets.
Clause 8.4.2.3.1 — Automotive product-related software or automotive products with embedded software requires organizations to hold their suppliers of embedded automotive software to a formal software quality assurance process, using a defined development assessment methodology and requiring the supplier to retain documented information from a risk-prioritized software development capability self-assessment.
Clause 8.4.2.4 — Supplier monitoring requires a documented process evaluating supplier performance against a specific, named set of indicators at minimum: delivered product conformity, customer disruptions at the receiving plant (including yard holds and stop-ships), delivery schedule performance, and the number of premium freight occurrences — with special-status customer notifications and dealer returns, warranty, field actions, and recalls added where the customer provides that data.
Clause 8.4.2.4.1 — Second-party audits requires organizations to include second-party audits in their supplier management approach, applicable to supplier risk assessment, monitoring, QMS development, and product or process audits. The frequency and scope must be documented based on risk, including product safety and regulatory considerations, supplier performance, and QMS certification level — and notably, where a second-party audit assesses a supplier's QMS, the clause requires the approach to be consistent with the automotive process approach itself, the same methodology covered in our how to conduct an IATF 16949 internal audit guide.
Clause 8.4.2.5 — Supplier development requires organizations to determine the priority, type, and timing of supplier development actions based on defined inputs — performance issues from supplier monitoring, second-party audit findings, third-party QMS certification status, and risk analysis — and to act on unresolved performance issues rather than simply tracking them.
Clause 8.5.1.1 — Control plan is one of the most technically demanding requirements in the standard. Organizations must develop control plans at the system, subsystem, component, and material level, with pre-launch and production versions that show real linkage to the design risk analysis, process flow diagram, and manufacturing process FMEA outputs. The control plan must specify the controls used for manufacturing process control, methods for monitoring special characteristics, and a defined reaction plan for when nonconforming product is detected or the process becomes statistically unstable. Critically, the clause requires the control plan to be actively reviewed and updated — not just created and forgotten — triggered by events including shipped nonconforming product, any change affecting the product or process, a customer complaint and its resulting corrective action, or simply a set frequency based on risk analysis.
Clause 8.5.1.2 — Standardized work requires operator instructions and visual standards to be communicated to and understood by the employees performing the work, legible, presented in a language personnel actually understand, accessible at the work area — and to include rules for operator safety specifically.
Clause 8.5.1.3 — Verification of job set-ups requires verifying set-ups whenever an initial run, material changeover, or job change occurs, maintaining documented information for set-up personnel, using statistical verification methods where applicable, and performing first-off/last-off part validation with records retained for comparison against subsequent runs.
Clause 8.5.1.4 — Verification after shutdown requires organizations to define and implement actions ensuring product compliance following any planned or unplanned production shutdown.
Clause 8.5.1.5 — Total productive maintenance requires a documented system covering, at minimum, identification of necessary process equipment, replacement part availability, maintenance resourcing, and documented maintenance objectives — explicitly citing metrics like OEE, MTBF, and MTTR — with performance against those objectives feeding into management review.
Clause 8.5.1.6 — Management of production tooling and manufacturing, test, and inspection equipment requires a system covering maintenance and repair, storage and recovery, set-up, tool-change programs for perishable tools, and modification documentation, with customer-owned tools and equipment permanently marked to identify ownership, and outsourced tooling work monitored under the same system.
Clause 8.5.1.7 — Production scheduling requires production to be scheduled to meet customer orders using methods like Just-In-Time, supported by an information system giving visibility at key process stages, incorporating planning inputs like supplier on-time delivery performance, capacity, lead time, and preventive maintenance status.
Clause 8.5.2.1 — Identification and traceability, supplemental strengthens traceability beyond ISO 9001's base clause.
Clause 8.5.6.1 — Control of changes, supplemental requires FMEAs to be reviewed for any manufacturing or product change before that change is implemented, directly linking change management discipline to core tools currency.
Clause 8.6 carries several supplemental sub-clauses: 8.6.1 (release of products and services, requiring alignment with the control plan), 8.6.4 (verification of externally provided product conformity), and 8.6.5 (statutory and regulatory conformity). Clause 8.7.1.2 — Control of nonconforming product, customer-specified process simply requires compliance with whatever customer-specified controls apply. Clause 8.7.1.6 — Customer notification requires immediate notification when nonconforming product has shipped, with detailed documentation following that initial communication.
The control plan review triggers in 8.5.1.1 are the detail I find gets skipped most often, even at organizations that have a well-built control plan. Teams build a solid document once, at launch, and then treat it as finished. The clause doesn't allow for that — a shipped nonconformity, a process change, a customer complaint, or simply the passage of time under a defined risk-based frequency are all supposed to trigger a real review. A control plan that hasn't been touched since initial certification, sitting alongside a production floor that's clearly evolved since then, is one of the more reliable signs an audit will find a gap between documentation and practice.
Clause 9.2.2.1 is the clause that establishes the three-part audit structure — quality management system audits (9.2.2.2), manufacturing process audits (9.2.2.3), and product audits (9.2.2.4) all have to appear on the program. For a full explanation of how these three audit types work in practice, see our IATF 16949 Internal Audit: The Complete Guide.
Clauses 9.1.1.1 and 9.1.1.2 connect directly to the core tools — 9.1.1.1 governs monitoring and measurement of manufacturing processes, and it's the clause 7.1.5.1.1's MSA requirement explicitly points back to, while 9.1.1.2 covers identification of the statistical tools used, tying SPC into the standard's formal monitoring requirements.
Clause 10.2.5 — Warranty management systems requires organizations to implement a warranty management process when the organization is required to provide warranty for its products, or when specifically required by the customer — including a defined method for warranty part analysis covering No Trouble Found (NTF) cases, parts returned as defective during a service event that, on analysis, show no identifiable fault.
No — both share the same 10-clause structure. IATF 16949 adds automotive-specific sub-clauses within that structure rather than adding entirely new top-level clauses.
Not by name. The clause requires a product and manufacturing approval process conforming to whatever the customer defines. AIAG's Production Part Approval Process is the standard industry method used to satisfy this requirement in practice, but the clause's actual authority rests with the specific customer's requirements.
Manufacturing feasibility, addressed under Clause 8.2.3.1.3, is an assessment of the organization's capability to meet a customer's performance and timing targets, applying to new programs and significant changes to existing processes or designs alike.
Clause 8.5.1.1 requires review when any change affects the product, process, measurement system, or supply source, following an internal nonconformance, a customer complaint and its corrective action, or at a defined frequency based on risk analysis — a control plan isn't a document that's finished once and left alone.
Only when the organization is required to provide warranty for its products, or when specifically required by the customer, per Clause 10.2.5. Where it applies, the process must include a method for analyzing warranty parts, including No Trouble Found cases.
Maria Falbo has over 25 years of experience working as a Lead Auditor for certification bodies worldwide. She founded Logix ISO with the mission of making expert-level ISO training accessible to organizations of all sizes. Her work spans Quality, Environmental, Occupational Health and Safety, Food Safety, Automotive, and Energy management systems.
Learn more about Maria →Self-paced · 365-day access · Training certificate included