What ISO 9001:2015 Certification Actually Verifies for a CNC Machining Supplier — and When IATF 16949, AS9100D or ISO 13485 Is Required Instead

What the certificate does and does not prove

ISO 9001:2015 certifies that a named legal entity and site runs a documented general quality management system inside a stated scope^8,16,27. That system covers document control, corrective action, traceability and process discipline — the machinery that keeps quality work repeatable¹⁶.

It is a qualification gate, not evidence that any particular part will conform¹⁶. The gap is deliberate.

ISO 9001 does not prove a supplier can hold a specific tolerance on a specific material, feature or production volume¹⁶. Process capability depends on machine condition, thermal control, tooling, fixturing and inspection method — none of which the certificate audits¹⁶.

A certificate on the wall is not the same thing as a fit-for-purpose quality system for your part⁸. So the useful question changes from "are you ISO 9001?" to "what does your certificate actually cover, and what part-specific evidence can you show?"^8,16

Does the certificate cover the entity, site and processes that will make your part?

A certificate does not automatically cover every service line, so the scope statement and exclusions decide whether CNC machining, turning, milling, heat treat or assembly are inside the certified system⁸. The legal entity and manufacturing site must match where the parts are actually made¹⁸.

• ✓Read the scope statement and exclusions — confirm CNC machining, turning, milling, heat treat and assembly are named, not assumed
• ✓Confirm the legal entity on the certificate is the entity that will manufacture the parts
• ✓Confirm the site on the certificate is the site where the parts will be made
• ✓Check that company name, address and contact details agree across quote, invoice, quality certificate and shipping documentation
• ✓If the supplier operates through trading entities or subcontracts, ask which legal entity manufactures and at which site
• ✓Ask which processes are in scope, how nonconformities are handled, and how corrective action is documented
• ✓Ask whether inspection records are tied to specific lots or revisions

Which QMS standard does your part's industry call for?

Sector-specific standards build on ISO 9001 and add controls the general standard does not contain^8,9,16. For regulated industries the sources describe the sector-specific standard as required rather than optional^16,21,28.

What part-specific evidence to demand in the RFQ

The certificate will never answer whether the supplier can hold your tolerances, so the RFQ has to carry the evidence request¹⁶. For parts with GD&T, positional tolerances or complex 3D features, CMM inspection is described as necessary to prove conformance²³.

Regulated-industry standards require documented material traceability, process validation records and first-article inspection data alongside the certificate²⁵.

• ✓Request a First Article Inspection report covering all CTQ features
• ✓Request a CMM dimensional report with actual versus nominal values, tied to your datum system
• ✓Confirm the supplier's CMM measurement range covers your part envelope
• ✓Confirm the supplier can measure complex 3D features, internal geometries and thread characteristics
• ✓Agree inspection points before machining begins
• ✓Request original material certifications (MTR) and batch production records
• ✓For regulated parts, request heat lot identification and mill certification confirming alloy composition and mechanical property results

Is the certificate genuine, current and issued by an accredited registrar?

A certificate claim is not a verified certificate. Status should be confirmed directly with the issuing registrar or the relevant database rather than accepted from a PDF^5,27,29.

For AS9100D that means the IAQG OASIS database; for ITAR registration, the DDTC^27,29. Ask for certification numbers and expiration dates, not just certification claims²⁹.

Failure signals include an expired certificate, a scope that excludes the machining processes in your program, or a registrar that lacks accreditation²⁷. For ISO 9001:2015 specifically, a certificate that predates the 2015 revision or has expired is a failure signal²⁷.

This check is cheap and it is the one that catches a supplier selling capacity it does not own^18,27.

Are outsourced special processes performed by approved sub-tiers?

NADCAP accredits individual special processes — heat treatment, non-destructive testing, chemical processing and coatings — rather than the whole quality system^28,29. That distinction matters because a certified machining supplier can still send parts to an unapproved heat treater²⁹.

If your part requires any post-machining processing, the finishing vendor performing it should hold NADCAP accreditation for that process²⁹. Programs requiring processes outside a partner's in-house capability require confirmation that those processes are either performed in-house or managed through qualified subcontractors with full traceability²⁶.

Ask the supplier to state which operations are in-house and which are subcontracted, and to provide certification numbers and expiration dates for the sub-tier^18,33.

Who owns first-article approval, shipment release and nonconformance handling?

Where the supplier operates through trading entities or subcontracts, quality control responsibility has to be defined in writing: who approves the first article, who authorises shipment, who handles nonconformance, and whose name appears on the certificate of conformance¹⁸. Those answers define whether you have one accountable supplier or an unmanaged chain¹⁸.

Revision handling is where well-quoted projects go wrong. Ask how the supplier controls drawing revisions — how a change is received, confirmed in writing, and propagated to programming, fixturing and inspection¹⁸.

Written confirmation of the revision in force on the order acknowledgement is a low-cost control that prevents a shop producing to an older revision¹⁸. Audit access should be agreed before the PO.

Some suppliers support on-site factory visits or remote video audits by appointment²⁴. Confirm documented engineering change order processes and BOM revision management²⁶.

What the certification adds to the quote

Certification overhead — metrology equipment and its calibration, quality engineers, documented procedures, internal audits and external surveillance — is spread across every machine hour and does not appear as a line on the quote²⁸. That is why an uncertified supplier can look cheaper on paper while offering a different product²⁸.

Industry-specific certification carries a reported cost premium. One source reports aerospace at +40–80%, medical devices at +30–70%, and automotive at +10–30%, with industrial machinery at the ISO 9001 baseline¹⁹.

Those figures are reported for sheet metal fabrication and are a source-specific observation, not a CNC machining benchmark¹⁹. When comparing quotes, ask whether the supplier's certification sits inside the rate as quality-system overhead, and read the quote with that in mind rather than comparing bottom lines alone^28,34.

Where the sources disagree on whether ISO 9001 alone is enough

The sources split on whether ISO 9001:2015 alone is sufficient, and the split tracks the part's industry rather than the certificate itself^{8,16,19,21,28}.

What the sources do not establish

• No source provides the actual scope statement, exclusions, legal entity or site for any specific supplier's ISO 9001:2015 certificate.
• No source provides Cpk/Ppk values, Gage R&R results, or FAI results for any specific supplier.
• No source provides calibration traceability records or sample material certs/inspection reports for any specific supplier.
• No source provides a specific certificate number, registrar name or database lookup result.
• No source provides tooling/fixture cost, NRE, MOQ, prototype vs production pricing, or quoted lead times for first article and repeat orders for any specific supplier.
• No source confirms any specific supplier's sub-tier NADCAP approvals or special-process outsourcing arrangements.
• No source provides a specific quality agreement, 8D/CAPA clause, or flow-down requirement for any supplier.
• No source cites a governing regulation or customer contract mandating a particular QMS standard for a specific part.