The useful sourcing question is: which certification is required by the customer or supply chain, does the certificate cover the legal entity and manufacturing site that will make the parts, and what order-specific evidence must supplement it?
Choose the system from the product risk and customer flow-down
Start with contractual requirements, not a preference for the longest certificate list. A general industrial fixture may be adequately sourced within an ISO 9001 quality system. Flight hardware may require AS9100 and aerospace-specific controls. An automotive OEM program may flow down IATF 16949 requirements and customer-specific manuals. A medical-device component may need an ISO 13485-aligned supplier and regulatory evidence defined by the device manufacturer.
This decision sits under the broader standard di lavorazione CNC framework. The certificate governs how the organization manages quality; the drawing, purchase order, control plan, and inspection records govern the specific part.
Four standards, four different sourcing signals
| System | Primary context | Buyer should investigate |
|---|---|---|
| ISO 9001 | General quality management across sectors | Scope, process control, calibration, nonconformance, corrective action, and continual improvement |
| AS9100 / 9100 | Aviation, space, and defense supply chains | Configuration, product safety, counterfeit-part prevention, risk, traceability, FAI, and customer flow-down |
| IATF 16949 | Automotive production supply chain | Customer-specific requirements, APQP, PPAP, control plans, process capability, contingency, and supplier development |
| ISO 13485 | Medical-device quality systems and regulatory requirements | Risk management, traceability, cleanliness, validation, records, change control, and device-maker responsibilities |
These are selection signals, not interchangeable achievement levels. An automotive certificate is not a substitute for an aerospace requirement, and ISO 13485 does not simply mean “ISO 9001 with stricter tolerances.”
ISO 9001 changed in 2026—check the edition and transition
ISO published ISO 9001:2026 in September 2026, replacing the 2015 edition as the current standard. Existing certified organizations do not transform their systems and certificates overnight; certification bodies establish transition arrangements. Therefore, a buyer should not reject a certificate merely because it still states 2015 without first checking its validity and transition status.
Use the official ISO 9001 page for current edition information. Then verify the supplier’s actual certificate with the issuing certification body or recognized database. Marketing text is not the certificate.
Read the certificate like a controlled document
Do not stop at the standard number. Check these fields:
A trading company’s certificate does not automatically cover a subcontract machine shop. Likewise, a head office certificate may exclude the production address shown on the packing list.
What certification cannot tell you about your CNC part
A valid QMS certificate confirms that an audited management system conforms within its scope. It does not prove that the supplier has the right spindle, fixture, cutting tool, CMM program, clean handling, or process capability for your geometry. Close those gaps with part-specific evidence.
The site’s capacità di qualità page can support an initial supplier review. The RFQ should still state which reports, certificates, inspection records, and approval gates are required for the actual order.
Match sector certification to the actual program
For aviation, space, and defense work, the IAQG 9100 series adds sector requirements to quality management. Buyers may also require AS9102 first article inspection, special-process approvals, export controls, source inspection, or customer-approved suppliers. The site’s AS9100 machining services page covers the commercial service intent; the purchase order remains the authority for program-specific approval.
Automotive: a certificate does not replace customer-specific requirements
IATF 16949 is closely tied to automotive customer requirements and core tools. Buyers should identify required PPAP level, capacity evidence, capability targets, labeling, warranty or traceability rules, and portal submissions before launch.
Medical: define the supplier’s role in the device lifecycle
ISO 13485 focuses on medical-device regulatory quality management. A component drawing still needs material, cleanliness, biocompatibility where applicable, validation, traceability, and change-notification requirements. The finished-device manufacturer remains responsible for determining regulatory suitability.
A three-gate supplier qualification method
A supplier should pass all three. Certification without technical fit creates quality escapes; technical skill without a required certificate can make the supplier contractually ineligible.
Certification questions procurement teams ask
It may be enough for a general commercial program if the customer does not require a sector-specific system and part-level controls are adequate. High-risk sectors often add other requirements.
Does AS9100 include ISO 9001 concepts?
AS9100 uses the ISO 9001 foundation and adds aviation, space, and defense requirements. Buyers should still verify the exact certificate and customer flow-down.
Can a supplier claim compliance without certification?
An organization may use elements of a standard without third-party certification, but that is not equivalent to holding a valid accredited certificate. Use precise wording in qualification records.
Should the lowest-risk prototype require the production certificate?
That depends on customer and regulatory rules. If prototype data or parts support formal verification, the same supplier controls may be required earlier than expected.
Choose certification as an entry condition, not a substitute for engineering judgment. The strongest supplier decision combines a verified certificate, demonstrated process capability, and order-specific controls tied to the released drawing.