The certification hierarchy
Certifications fall into three tiers:
Tier 1 — General: ISO 9001 + ISO 14001. The minimum baseline for any quality CNC supplier. Almost everyone has these.
Tier 2 — Industry-specific: IATF 16949 (automotive), AS9100/EN 9100 (aerospace), ISO 13485 (medical). Required when supplying to specific industries.
Tier 3 — Process-specific: NADCAP certifications for special processes (heat treatment, NDT, chemical processing). Required when those processes are involved.
A supplier doesn't need all of them — they need the right ones for your application.
ISO 9001:2015 — Quality Management baseline
ISO 9001:2015 is the international quality management system (QMS) standard. It's the minimum baseline for serious CNC suppliers. The certification means the supplier has documented processes for: - Customer requirements interpretation - Process control (machining setup, inspection) - Document control (drawings, BOMs) - Corrective action when defects occur - Internal audit verification - Management review
What it tells you: the supplier has documented procedures. It does NOT tell you the supplier consistently produces good parts. A supplier can have ISO 9001 and still have quality issues — the certification verifies process maturity, not quality outcomes.
ISO 14001:2015 — Environmental Management
ISO 14001:2015 is the environmental management system (EMS) standard. The certification means the supplier has documented processes for: - Identifying environmental impacts - Tracking energy consumption - Waste minimization - Chemical handling and disposal - Compliance with environmental regulations
What it tells you: the supplier is serious about environmental compliance. Increasingly required by European customers and EU customers as part of CSRD compliance (mandatory sustainability reporting from 2024+).
IATF 16949 — Automotive QMS
IATF 16949 (International Automotive Task Force) is the automotive industry QMS standard, evolved from ISO/TS 16949. Required for direct suppliers to automotive OEMs (BMW, Mercedes, VW, Stellantis, Toyota, etc.).
Key IATF 16949 requirements beyond ISO 9001: - Customer-specific requirements (CSR) compliance - Failure Mode and Effects Analysis (FMEA) — design and process - Statistical Process Control (SPC) on critical characteristics - Production Part Approval Process (PPAP) Level 3 documentation - Advanced Product Quality Planning (APQP) - Layered process audits - Internal supplier requirements (sub-tier suppliers)
For automotive Tier-2/Tier-3 work, suppliers often align their QMS with IATF 16949 without full certification — their Tier-1 customer audits validate the process maturity. This is acceptable for many programs but not all (some OEMs require direct IATF 16949 certification).
AS9100 / EN 9100 — Aerospace QMS
AS9100 (Americas) / EN 9100 (Europe) is the aerospace QMS standard, based on ISO 9001 + aerospace-specific additions. Required for direct suppliers to aerospace primes (Airbus, Boeing, Embraer, Bombardier).
Key AS9100 requirements beyond ISO 9001: - Configuration management (revision control) - First Article Inspection (FAI) per AS9102 - Counterfeit parts mitigation per AS5553 - Supplier control of sub-tier suppliers - Foreign object damage (FOD) prevention - Special process control (heat treatment, NDT, plating) - Reliability and maintainability requirements
For aerospace Tier-2/Tier-3 work, suppliers can align with AS9100 without full certification, but Tier-1 customers will require process maturity demonstration through supplier audits. Top aerospace suppliers maintain AS9100 certification; specialty Tier-2/Tier-3 may not.
ISO 13485 — Medical Device QMS
ISO 13485:2016 is the medical device QMS standard. Required for direct suppliers to medical device manufacturers (Boston Scientific, Medtronic, Stryker, Lima Corporate, etc.).
Key ISO 13485 requirements beyond ISO 9001: - Document control specific to medical devices (Device Master Record, Design History File) - Risk management per ISO 14971 - Sterilization process validation (ISO 11135 EtO, ISO 11137 gamma, ISO 17665 steam) - Biocompatibility per ISO 10993 - Process validation documentation - Post-market surveillance and complaint handling - Software validation (if applicable)
For medical device Tier-2/Tier-3 work, suppliers often align with ISO 13485 without full certification — your prime medical device manufacturer's audits validate the supplier. This is common and acceptable for most submissions (FDA 510(k), CE MDR).
NADCAP for special processes
NADCAP (National Aerospace and Defense Contractors Accreditation Program) is process-specific accreditation managed by the Performance Review Institute. It applies to special processes: - Heat treatment - Non-destructive testing (UT, FPI, RT) - Surface treatment (plating, coating) - Chemical processing - Welding and brazing - Composites manufacturing
A general CNC supplier typically does NOT have NADCAP certification themselves — but they will have NADCAP-certified subcontractors for the special processes you need. If aerospace work involves heat treatment or NDT, ensure your CNC supplier has a NADCAP-certified partner for that process.
How to verify a certification
Every legitimate certification can be verified at the issuing certification body. To verify: - Get the certification number from your supplier - Visit the certification body's online registry (e.g., DAkkS for German certificates, UKAS for UK, ANAB for US) - Search for the certification number - Verify the scope, dates, and issuer match what was claimed
If you can't find the certification in the registry, it's either expired, fake, or issued by an unaccredited body. Either way: red flag.
For Ginwate specifically: our ISO 9001 certificate is 73025Q06090123R0S and ISO 14001 is 73025E05120042R0S. Both verifiable at the issuer's registry (zhicrz.cn).
Conclusion
Certifications are a useful but limited signal. They prove process maturity, not consistent quality outcomes. Combine certification verification with supplier visits, sample inspections, and reference checks. The best CNC suppliers don't just have the right certifications — they consistently deliver complete documentation packages that pass your incoming inspection on the first pass.