ISO 9001 and PPAP III: What Our Certifications Mean for Your Supply Chain

Certifications on a supplier profile are easy to skim past. But if you are the person who has to sign off a new spring or clip supplier, the gap between "ISO 9001 certified" and "IATF 16949 certified, PPAP Level 3 submission" decides how much of the qualification burden lands on your own quality team. Here is what each one actually covers, what it does not, and what to ask for before the first purchase order.

WHAT ISO 9001 ACTUALLY CERTIFIES

ISO 9001 certifies a management system, not a part. It says the supplier has documented processes for incoming inspection, process control, calibration, nonconformance, and corrective action, and that a third-party auditor has verified those processes are being followed in practice.

Two things it deliberately does not tell you:

• First, it says nothing about whether a given part meets your drawing — that is what first-article inspection and PPAP are for.
• Second, every certificate is scoped: it carries a scope statement naming the sites and activities covered.

A certificate held by a parent company does not automatically cover the plant that will run your job. So, ask for the certificate itself, check that the scope statement names the manufacturing site, and verify the accreditation body behind it. An unaccredited certificate is just a printed page. Seyunda has held ISO 9001 since 2013 and IATF 16949 since 2021.

THE 2026 REVISION: WHAT CHANGES ON 16 SEPTEMBER

ISO 9001:2015 is being replaced. ISO 9001:2026 is scheduled for publication on 16 September 2026, with a three-year transition window running to September 2029. It is an evolutionary update rather than a rewrite: quality culture and ethical behavior move into the requirements around leadership and awareness, and risks and opportunities are separated more clearly so that the actions for each are considered on their own.

Three practical consequences for a buyer:

• A supplier's existing ISO 9001:2015 certificate stays valid through the transition. Nothing expires in September.
• Between now and 2029, ask where a supplier sits in its transition plan. One that has not considered it by 2028 is telling you something about how the system is actually run.
• A 2015 certificate is entirely normal today and a warning sign by 2029. Judge it against the calendar.

PPAP IS A SUBMISSION LEVEL, NOT A GRADE

PPAP — Production Part Approval Process — comes from the AIAG, and it is an automotive tool. It exists to prove, before serial production starts, that a process can make the part to drawing repeatably.

The AIAG PPAP manual defines 18 elements: design records, engineering change documents, dimensional results, material and performance test results, process flow diagram, PFMEA, control plan, measurement systems analysis, initial process capability studies, sample parts, master sample, checking aids, and the Part Submission Warrant that summarizes the lot.

The five submission levels are the part most often misread. They do not describe five qualities of a part. Every element is produced and retained at every level; the level sets only how much is sent to you rather than held on file at the supplier. Level 3 — warrant, samples, and the complete data pack — is the default for new tooling and engineering changes at most OEMs.

So "PPAP Level 3 capable" is a statement about documentation, not about tolerance. It means the supplier can hand over the full package on request. What it does not tell you is the capability figure on your critical characteristic — ask for that separately.

WHERE PPAP DOES NOT APPLY

This matters, because PPAP gets quoted well outside its scope. PPAP is not a medical device requirement. Medical manufacture runs to ISO 13485, with design history files, process validation (IQ/OQ/PQ), and UDI traceability. A PPAP pack does not satisfy an ISO 13485 auditor, and a supplier offering it as though it does has misread the question.

Nor does it cover aerospace. Flight-critical and structural parts require AS9100, and special processes — heat treatment, plating, non-destructive testing — require NADCAP accreditation of whoever performs them. ISO 9001 does not reach that, and neither does PPAP.

Where a spring or clip is a non-flight-critical, non-implantable component, the customer's own quality system governs and PPAP-style documentation can be supplied as supporting evidence. But it is the customer's standard that decides what is sufficient, not the supplier's certificate.

HOW IATF 16949 SITS ON TOP

IATF 16949 was first published in October 2016, replacing ISO/TS 16949. It is not a standalone standard: it is applied together with ISO 9001 and adds automotive-specific requirements — product safety, contingency planning, embedded software controls, supplier development, and mandated use of the core tools (APQP, PPAP, FMEA, MSA, SPC).

On a spring or clip program, the differences a buyer actually feels are concrete: a control plan that exists in prototype, pre-launch, and production versions rather than one generic document; measurement systems analysis on the gauges used for your characteristics, not just a calibration sticker; and a defined reaction plan when a process drifts out of control, rather than a note in a logbook.

SIX QUESTIONS WORTH ASKING ANY SPRING SUPPLIER

1. Can I see the certificate, with its scope statement and accreditation body?
2. Which site will run this part, and is that site named on the certificate?
3. Which PPAP submission level do you propose, and can I see a redacted example pack?
4. What is your Cpk on the characteristic I have marked critical, and over how many pieces?
5. How are the gauges for that characteristic calibrated, and has an MSA been run on them?
6. Where are you in your ISO 9001:2026 transition?

None of this makes a certificate a guarantee. It makes it checkable, which is the useful part. A supplier who can answer all six without going to look for the file is a supplier whose system is real.

---

Published by the Seyunda Team · 2026