A supplier sends a folder of certificates with the quote. ISO 9001, AS9100, ISO 13485, a test report, a row of badges at the bottom of the website. It looks reassuring. It tells you almost nothing about whether this shop can hold the tolerance on your part.
Certificates are worth checking, but they answer a narrow question: does this organisation run a documented quality system, and did somebody audit it? If you are shortlisting an AS9100 machine shop for a flight part, or an ISO 13485 supplier for a device component, the certificate is an entry ticket, not proof of capability. This guide sets out what the common certificates cover, what they cannot tell you, and how to verify one before a deposit leaves your account.
What the four certificates actually cover
| Certificate | What it governs | When you actually need it | Common misuse |
|---|---|---|---|
| ISO 9001 | A general quality management system: documented processes, records, corrective action | General industrial parts, enclosures, brackets, most commercial work | Treated as proof of machining accuracy |
| ISO 13485 | Quality management for medical devices, with traceability and risk controls | Parts that go into a regulated medical device | Requested for non-medical parts, adding cost for no benefit |
| AS9100 | Aerospace quality management, built on ISO 9001 with additional controls | Flight hardware and work flowing to an aerospace prime | Assumed to cover special processes such as heat treatment or plating |
| IATF 16949 | Automotive quality management, with an emphasis on defect prevention and variation | Series production parts in an automotive supply chain | Asked for on one-off prototypes where it changes nothing |
| ITAR registration / NADCAP accreditation | Not quality-system certificates: one is a US regulatory registration, the other covers specific special processes | Only when the contract or the process requires it | Listed alongside ISO certificates as if they were the same kind of document |
Three things a certificate cannot tell you
The scope. The certificate names an organisation and a defined scope of activity. A trading company can hold ISO 9001 for “sales and distribution of metal components” while the machining is done by a workshop that holds nothing. Check the named legal entity against the business licence and the production line, not against the logo on the email signature.
Who issued it, and whether it is current. Ask for the certificate number, the registrar and the expiry date in writing, then confirm them against the registrar’s own register. A scanned PDF with a familiar badge proves very little on its own. Certificates lapse, and scopes change after an audit.
Whether the shop can make your part. A quality system does not tell you the largest envelope on the mill, whether the shop holds the tolerance you need, or whether it owns a CMM. Those are capability questions, and they are answered by machines, sample parts and inspection reports — see how to verify a Chinese CNC machining supplier.
Put the certificate in text, not in a badge image
If you build a supplier qualification page, write the certificate number, registrar, scope and renewal date as plain text rather than an image of a badge. A procurement officer filling in an approved-vendor form can copy it, and so can any search tool that reads the page. The same applies to your own records: a line of text in a supplier file is auditable, a screenshot in an inbox is not.
There is a practical reason to settle this early. The certification route affects which components, materials and subcontractors a supplier can use, so adding a requirement after the design is frozen usually means re-quoting rather than a small paperwork change. Our custom metal parts sourcing guide covers where that decision sits in the sourcing sequence.
Which one you need depends on where the part ends up
Start from the end use, not from the most impressive acronym. General industrial parts — brackets, enclosures, fixtures, machine components — are usually well served by ISO 9001 plus a sensible inspection plan. Asking for AS9100 on a plain steel bracket narrows the supplier pool and raises the quote without adding anything to the part.
Medical and aerospace work is different: the certificate is often a contractual gate, and the buyer’s own compliance team will tell you which one is required. Automotive series production brings IATF 16949 and, with it, expectations around process capability documentation. For prototypes and one-off parts, the process choice usually matters more than the certificate — see CNC vs stamping vs sheet metal.
Verify it during the factory audit, not after
Verification is a short list, not an investigation: match the legal entity on the certificate to the business licence; read the scope; confirm the registrar and expiry; then look at the equipment and the inspection records for the part you are buying. A supplier that can produce a first-article report and a calibration record for its measuring equipment is showing you something a certificate cannot.
If you are buying through an agent, ask how the agent handles this step and whether the factory invoice, inspection report and certificates come to you directly. That is also the point where what a sourcing agent actually does becomes concrete rather than a line on a website.
Certificates do not replace inspection
A certified shop can still send parts that miss a tolerance. Write the general tolerance note and the critical dimensions into the drawing, and put the inspection requirement into the purchase order — ISO 2768 and drawing notes explain how those lines change both the quote and the inspection workload. Ask for an itemised quote so inspection, finishing and certification appear as separate lines; the CNC quote cost breakdown shows what a comparable quote should contain.
Compliance paperwork also follows the shipment. Certificates, material declarations and test reports need to travel with the goods and match the commercial invoice, which is one more reason to settle them before production rather than at the port — see landed cost and documentation.
When a certificate is a red flag instead
- The scope covers trading or distribution, not machining or fabrication.
- The named company is not the one that will receive your deposit.
- The expiry date has passed, or the file looks like an edited copy of somebody else’s certificate.
- The supplier will not give you the certificate number or registrar when asked.
- Every supplier in your shortlist has the same badge and none can explain what was audited.
None of these means the shop cannot make good parts. They mean the certificate is doing the work that an audit, a sample and an inspection report should be doing.
Frequently asked questions
Is ISO 9001 enough for CNC machined parts?
For general industrial parts, usually yes — paired with a clear drawing, an agreed inspection level and a first-article approval. Regulated medical, aerospace or automotive work is different: your customer or compliance team will specify the required standard, and it should be written into the RFQ before any tooling is ordered.
Does AS9100 guarantee aerospace-grade quality?
No. It describes a quality management system with additional aerospace controls. Special processes may need separate accreditation, and the individual part still needs its own inspection evidence. Treat the certificate as a gate to pass, then assess capability and inspection separately.
Can a trading company hold the certificate?
Yes, and that is exactly why the scope matters. A trading company can be certified for sales and distribution while the actual machining happens elsewhere. Check the named legal entity against the business licence and ask who operates the machines that will make your parts.
Should I pay more for a certified supplier?
Only when the end use requires it. Where it does, the cost is part of compliance, not a premium. Where it does not, asking for an unnecessary certificate removes capable workshops from your shortlist. Compare itemised quotes at the same quantity tiers before deciding.
What to do next
Before you send the next enquiry, put the certificate requirement into the RFQ pack alongside the drawings, materials and inspection notes, so every supplier prices the same thing. Our CNC machining RFQ checklist lists the twelve items a shop needs. If you want us to check a supplier’s certificate, scope and inspection records before you pay a deposit, send us the details and we will review them.