IATF 16949:2016 questions and answers: November 2025 SI update

1. What are SIs and when do they apply?

A Sanctioned Interpretation changes how a rule or requirement is interpreted and can become a basis for a nonconformity. Unless a different effective date is specified, SIs apply on publication.

The November 2025 document revises SI 23 and adds SI 27–30, all effective in November 2025. Earlier SIs have their own dates on pages 1–2. SI numbers do not correspond to FAQ numbers.

This is ITVC’s editorial summary and reading guide, not an official translation or a replacement for the standard. Consult the full text, distinguish deleted text from additions and consider applicable customer-specific requirements.

2. Five November 2025 updates

SI 23: replacement parts in 4.4.1.1

The terminology changes from service parts to replacement parts. Review product categories and outsourced activities without restricting the review to OEM-procured service parts. Material-conformity wording was already present before this November 2025 revision.

SI 27–28: foreword and scope

The wording is aligned with the Rules 6th Edition. SI 28 describes organizations manufacturing and, where applicable, designing and developing automotive products for automotive customers, with reference to the definitions in 3.1. Reading an SI does not by itself establish certification eligibility.

SI 29: revised definitions in 3.1

• Automotive customer: an organization in the automotive supply chain purchasing automotive products.
• Automotive products: encompasses parts and processed materials made to customer specifications and integrated during vehicle manufacture; OEM-specified accessories procured or released by the OEM; and replacement parts and materials, including remanufactured parts.
• Replacement parts and materials: covers service, aftermarket and remanufactured parts and materials used in vehicle repair and maintenance.
• The previous standalone accessory part, aftermarket part and service part definitions are struck through. Do not reproduce those deleted definitions as the current SI 29 text.

SI 30: design outputs in 8.3.5.1

Item i) now addresses replacement part requirements. Review forms, checklists and design-output records for consistency with SI 29. The change does not remove the other design outputs in the clause.

3. SI 1–30 reference guide

Each entry gives a brief topic summary and the starting page in the PDF. These summaries do not reproduce every condition or exception.

SI 1 — 3.1 · Customer requirements

For an audited vehicle manufacturer, its subsidiary or joint venture, the relevant customer is specified by those entities. See page 3.

SI 2 — 4.4.1.2 · Product safety

Special approval of safety-related requirements or documents may be required by the customer or internal processes. See page 3.

SI 3 — 6.1.2.3 · Contingency plans

Address supply disruptions including cyber-attacks and pandemics; test effectiveness, review at least annually with top management, train personnel and validate product conformity after restarting under the circumstances specified. See page 4.

SI 4 — 7.2.3 · Internal auditor competence

Distinguish common competencies from additional competencies for system, manufacturing-process and product auditors. Retain evidence of trainer competence for internal training. See page 6.

SI 5 — 7.5.1.1 · QMS documentation

Document where customer-specific requirements are addressed. A table, list or matrix may be used; a matrix alone is not mandatory. See page 7.

SI 6 — 8.3.3.3 · Special characteristics

Identify special characteristics consistently in relevant product or manufacturing documents, risk analysis, control plans and work instructions. See page 8.

SI 7 — 8.4.2.1 · External provision controls

For pass-through characteristics or components not validated or controlled by the organization, ensure appropriate controls exist at the point of manufacture. See page 8.

SI 8 — 8.4.2.3 · Supplier QMS development

Set minimum and target QMS levels using risk. The objective of IATF certification applies to eligible suppliers; customer authorization governs acceptance of a lower initial minimum level. See page 9.

SI 9 — 8.7.1.1 · Customer authorization

Distinguish rework from repair. The SI clarifies authorization for use-as-is and repair dispositions; deviations from approved products or processes must be handled under this clause. See page 10.

SI 10 — 7.1.5.3.2 · External laboratories

Check the accreditation scope. For a non-accredited laboratory, retain evidence of assessment against 7.1.5.3.1 under the conditions stated in the SI. Integrated equipment self-calibration does not meet calibration requirements. See page 11.

SI 11 — 8.5.6.1.1 · Temporary changes to process controls

List primary controls and approved backup or alternative methods where these exist. An alternative is not required for every primary control. See page 13.

SI 12 — 5.1.1.2 · Process effectiveness and efficiency

Management reviews effectiveness and efficiency to improve the QMS. Determine which processes need efficiency measures rather than imposing identical measures on every process. See page 13.

SI 13 — 9.3.2.1 · Management review inputs

Clarifies efficiency measures for product-realization processes where applicable. Read together with SI 16 for the added review input. See page 14.

SI 14 — 9.2.2.2 · Internal QMS audits

Retain a three-year audit cycle with an annual programme. Cover all processes and applicable requirements; justify individual process frequencies using risk and performance. See page 15.

SI 15 — 3.1 · Embedded software

Software controlling functions of an automotive component differs from software running production equipment. Manufacturing-process control software is outside this definition. See page 16.

SI 16 — 9.3.2.1 · Design and development results

Include summary measurement results from specified stages of product and process design and development in management review inputs, where applicable. See page 17.

SI 17 — 6.1.2.3 · Combined with SI 3

Cybersecurity contingency-testing content has been incorporated into SI 3. Refer to the combined interpretation rather than treating SI 17 as a separate additional requirement. See page 18.

SI 18 — 7.1.3.1 · Plant, facilities and equipment

Address cyber protection for equipment and systems supporting manufacturing, rather than limiting it to office computers. See page 18.

SI 19 — 8.4.2.4 · Supplier monitoring

Removes occurrences of premium freight from the minimum indicator list in this clause. Other applicable and customer-specific requirements still need consideration. See page 19.

SI 20 — 10.2.3 · Problem solving

Prevent recurrence through containment, root-cause analysis, systemic corrective action, effectiveness verification and updates to relevant documentation. See page 20.

SI 21 — 6.1.2.1 · Risk analysis

Include cyber-attack threats to information technology systems in risk analysis and retain the results. See page 21.

SI 22 — 7.2.1 · Competence and awareness

Training should cover prevention relevant to employees’ responsibilities and work environment, such as recognizing impending equipment failure or attempted cyber-attacks. See page 21.

SI 23 — 4.4.1.1 · Product and process conformity

The November 2025 revision replaces service parts with replacement parts. Coverage includes products, processes and outsourced activities, while retaining material-conformity requirements. See page 22.

SI 24 — Annex A.1 · Automated-process control plans

For highly automated processes managed by systems such as MES, summary controls may directly reference or link to the system holding detailed control information. See page 22.

SI 25 — Annex A.2 · Control plan elements

A common control-plan designation may replace a lengthy part-number list. Product control, process control, methods and reaction-plan sections remain unchanged by this SI. See page 23.

SI 26 — IATF copyright notice

Updates the names of copyright-owning organizations in Italy, France and the UK. This concerns document rights rather than new manufacturing requirements. See page 24.

SI 27 — Foreword · New in November 2025

Aligns replacement-parts terminology with the Rules 6th Edition. IATF 16949 continues to be used with ISO 9001:2015 and applicable customer-specific requirements. See page 25.

SI 28 — 1.1 · Scope · New in November 2025

Clarifies coverage of organizations manufacturing and, where applicable, designing and developing automotive products for automotive customers, at sites where automotive manufacturing occurs. See page 26.

SI 29 — 3.1 · Definitions · New in November 2025

Adds automotive customer, automotive products, and replacement parts and materials; updates manufacturing. Read deleted standalone definitions in the context of the new structure. See page 27.

SI 30 — 8.3.5.1 · Design outputs · New in November 2025

Item i) changes service part requirements to replacement part requirements. Check this scope within the design and development output package. See page 29.

4. Which records should an organization review?

ITVC suggests the following implementation sequence. These are practical recommendations, not additional requirements issued by IATF.

1. Control the source: record the SI edition, effective dates and responsibility for monitoring updates.
2. Assess impacts: map each relevant SI to products, customers, manufacturing sites and QMS scope.
3. Update affected documents: prioritize scope, definitions, design outputs, material controls and outsourced processes under SI 23 and SI 27–30.
4. Check operational evidence: review contingency plans, laboratory evaluations, supplier development, control plans, internal audits and management review.
5. Train and verify: brief relevant functions, sample actual records and track remaining actions.

5. Common questions

Does this PDF replace the entire old FAQ document?

No. SIs and FAQs are separate publications. The PDF identifies some FAQ content as deleted or transferred, including FAQ 18 in relation to SI 14 and FAQ 10 in relation to SI 15. Check the correct interpretation number, clause and edition.

Does every process control need a backup?

SI 11 clarifies that an alternative is not mandatory for every primary control. Approved backup or alternative methods must be included in the controlled list where they exist.

Does a three-year cycle mean auditing only once every three years?

No. SI 14 retains a three-year coverage cycle and an annual programme. Individual process frequency depends on risk and performance, with justification retained. All processes and applicable requirements must be covered within the cycle.

Should SI 17 be applied separately?

Its content was combined with SI 3. Use the combined interpretation when reviewing cybersecurity contingency testing.

6. Source document and ITVC support

Official PDF: IATF 16949 Sanctioned Interpretations, November 2025 (29 pages). This article reflects that specific edition. Before an audit, check the IATF publications and customer requirements applicable at that time.