MAQMSR: Automotive Quality Management System Guide

If an automotive customer has sent you a document called MAQMSR and asked when you'll be compliant, here's the short version: it's the IATF's minimum set of automotive requirements for sub-tier suppliers, and it sits between a basic ISO 9001 system and full IATF 16949. For a small or mid-sized supplier, it's often the first real step toward an automotive quality management system that a Tier 1 customer will accept.

This guide covers what MAQMSR is, who it applies to, how it compares to ISO 9001 and IATF 16949, what it requires, and a practical path to compliance, even if your quality team is one person.

What is MAQMSR?

MAQMSR stands for Minimum Automotive Quality Management System Requirements for Sub-Tier Suppliers. It's published by the International Automotive Task Force (IATF), the same body behind IATF 16949, and the current version is the Second Edition, dated September 2017.

MAQMSR isn't a new standard written from scratch. It's a short list of IATF 16949:2016 sections that the IATF selected for supplier QMS development. Each MAQMSR requirement points back to one or more IATF 16949 clauses, so "meet MAQMSR" really means "meet these specific parts of IATF 16949, on top of your ISO 9001 system."

Why your customer is asking for it

Under IATF 16949 section 8.4.2.3, a certified organization has to require its automotive suppliers to develop, implement, and improve a quality management system, with the ultimate goal of eligible suppliers becoming certified to IATF 16949. The IATF's sanctioned interpretation of that clause tells certified organizations to use a risk-based model to set a minimum acceptable level and a target level of QMS development for each supplier.

That interpretation lays out a development path, and MAQMSR is one of the named steps on it:

1. Compliance to ISO 9001, verified through second-party audits
2. Certification to ISO 9001 through third-party audits
3. ISO 9001 certification plus compliance to customer-defined QMS requirements, such as MAQMSR or equivalent, verified through second-party audits
4. ISO 9001 certification plus compliance to IATF 16949, verified through second-party audits
5. Certification to IATF 16949 through third-party audits

Unless the customer authorizes otherwise, ISO 9001 certification is the starting minimum. So when a Tier 1 asks you to "move to MAQMSR," they're usually asking you to climb from step 2 to step 3. It's also why the document may have arrived straight from your customer: the IATF allows organizations certified to IATF 16949 to reproduce MAQMSR in full and share it with their suppliers to support this development work.

Who needs to comply with MAQMSR?

MAQMSR is a customer requirement, not a law. It applies when an automotive customer, typically an IATF 16949-certified Tier 1 or higher, makes it part of what they expect from you. In practice that means Tier 2 and Tier 3 suppliers of parts, materials, or processing services that end up in a vehicle. Your customer's supplier quality manual and customer-specific requirements (CSRs) are where the target level, deadline, and audit method will actually be spelled out, so start there.

MAQMSR vs. ISO 9001 vs. IATF 16949

The three aren't alternatives; they're layers. ISO 9001 is the foundation for any industry. IATF 16949 adds automotive-specific requirements and can't be used on its own; the IATF describes it as a supplement to be used in conjunction with ISO 9001. MAQMSR is a subset of those IATF 16949 additions, sized for suppliers earlier in their development.

One practical consequence: you can't get certified to MAQMSR the way you certify to ISO 9001 or IATF 16949. Your customer verifies compliance through second-party audits. For how ISO 9001 handles supplier control in the first place, see our breakdown of ISO 9001 section 8.4; the logic your customer applies to you, you'll apply to your own suppliers.

Key MAQMSR requirements

The Second Edition organizes its requirements into nine areas, plus a normative annex on control plans. Here's what each one covers in plain terms.

Control plans, work instructions, and traceability

You need control plans for your products, operator work instructions and visual standards, verification of job set-ups, preventive maintenance, and identification and traceability. MAQMSR also pulls in two requirements the IATF flags as new in IATF 16949: verification after shutdown, and control of temporary changes to process controls, which means keeping a list of your primary process controls and any approved backup or alternate methods.

Process approach

Define your product realization system: every process and sub-process, how each is implemented and controlled, how the processes interact, and how you monitor them for effectiveness. MAQMSR points to ISO 9001:2015 section 0.3 for further guidance.

Performance, supplier monitoring, and problem solving

This area covers customer satisfaction, verifying that incoming product conforms to requirements, monitoring your own suppliers, and problem solving with root cause analysis. Problem solving also brings in error-proofing, warranty management, and customer complaint and field failure analysis. If corrective action is a weak spot, our guide to what CAPA is walks through the full process.

Internal auditing

MAQMSR expects quality management system audits (verifying compliance with MAQMSR), manufacturing process audits, product audits, an internal audit programme, and qualified internal auditors. Two concessions help smaller suppliers: auditor competency only has to cover ISO 9001:2015 and MAQMSR, and the requirement for a documented auditor-competency process can be waived if audits are run under the guidance of a qualified customer second-party auditor.

Control of nonconforming product

You need processes for nonconforming and suspect product (including any process your customer specifies), reworked and repaired product, customer notification, and getting customer authorization, through a concession or deviation, before shipping anything that differs from what's approved.

Part approval and change control

This area covers the product approval process, engineering specifications, statutory and regulatory requirements, products with embedded software, monitoring and measurement of manufacturing processes, measurement system analysis (MSA), calibration and verification records, and change control, including notifying your customer of changes.

Management responsibility

Top management has to review process effectiveness, set quality objectives, assign responsibility for quality and corrective actions, name a customer representative, run management reviews using the automotive-specific inputs and outputs, and address corporate responsibility.

Risk management and product safety

MAQMSR includes risk analysis, preventive action, and contingency plans, plus product safety: documented processes for managing product-safety-related products and manufacturing processes.

How to implement an automotive quality management system that meets MAQMSR

You don't need a big team for this, but you do need a sequence.

1. Get the source documents. Download MAQMSR, and get copies of IATF 16949:2016 and ISO 9001. MAQMSR mostly lists clause references, so you'll need IATF 16949 to read the actual requirement text. Pull your customer's supplier quality manual and CSRs too.
2. Confirm your baseline and target. Ask your customer which development level they expect, by when, and how they'll assess you. If your ISO 9001 system is shaky, fix that first; MAQMSR is built on top of it.
3. Run a gap assessment. Walk through all nine areas and mark each requirement as in place, partial, or missing. Prioritize product safety, nonconforming product, and customer notification, since gaps there reach your customer fastest.
4. Map your processes. Document how product moves from order to shipment, who owns each process, and how you'll measure whether it works.
5. Build control plans with the risk analysis behind them. Start with your highest-risk part families. Tie each control plan to work instructions operators actually use, and keep traceability records that let you trace any lot back to its materials and process.
6. Set up your reaction processes. Nonconforming product, problem solving, change control, and customer notification should each have a defined owner, a documented workflow, and records. Keep everything under proper document control so revisions and approvals are traceable.
7. Train people and qualify auditors. Operators need training on the work instructions they follow; internal auditors need to understand ISO 9001 and MAQMSR. Keep records of both.
8. Audit yourself, then review. Run your QMS, process, and product audits, fix what you find, and hold a management review before your customer's second-party audit.

Common gaps sub-tier suppliers run into

Most problems come from processes that exist on paper but don't hold up on the floor. Watch for these:

• Control plans that don't match reality. A control plan written once and never updated after process changes is a finding waiting to happen.
• Contingency plans nobody has tested. IATF's sanctioned interpretations of the contingency planning clause call for periodic testing and specifically name cyber-attacks among the disruptions to plan for. Because MAQMSR points to that clause, expect auditors to ask.
• Internal auditors trained only on ISO 9001. MAQMSR narrows the competency scope, but it still includes MAQMSR itself.
• No measurement system analysis. Calibration records alone don't show that your gauges and methods are capable of measuring what matters.
• Changes made without telling the customer. A new material source or a moved machine can trigger customer notification requirements.
• Supplier monitoring with no follow-through. Tracking supplier performance is only half the job. When a supplier causes a problem, a supplier corrective action request is how you get it fixed at the source.
• Corrective actions that stop at "retrained the operator." Auditors want root cause, systemic action, and proof it worked.
• Evidence scattered everywhere. Binders, spreadsheets, and email threads make a second-party audit painful, even when the work was done.

What's changing in 2026 and 2027

The standards MAQMSR sits on are moving. ISO published ISO 9001:2026 on 16 September 2026. The IATF has also confirmed a second edition of IATF 16949 is in development, with publication planned for mid-2027 and the end of its transition aligned with the end of the ISO 9001 transition. One of its five priority topics is Tier N supply chain management: strengthening how lower-tier suppliers are managed and how customer requirements flow down the chain.

The MAQMSR Second Edition still references IATF 16949:2016 and ISO 9001:2015, and we haven't found an IATF announcement of a MAQMSR revision. Build to the current document, and expect more customer attention on sub-tier quality, not less.

How Isolocity supports MAQMSR compliance

Isolocity is a full-suite QMS platform. It won't make you MAQMSR-compliant on its own; your processes do that. What it does is keep the evidence connected in one place, so you can see your compliance gaps at a glance instead of rebuilding them from binders before every audit.

In practice, that means control plans and work instructions live in Document Management with revision control, approvals, and a link to training. Nonconformances, deviations, complaints, FMEA, and supplier issues run through CAPA, including a supplier contribution portal. Inspection handles receiving inspection, calibration, audits, and SPC tracking, and Training tracks who is qualified to do what.

Implementation, training, and support are included at no extra cost. You can see how the platform fits automotive work on our automotive QMS page.

MAQMSR FAQ

Is MAQMSR a certification?

No. The IATF doesn't certify organizations to MAQMSR. Compliance is verified by your customer through second-party audits. Some consultants and assessment bodies offer MAQMSR gap assessments, but those aren't IATF certificates.

Who needs to comply with MAQMSR?

Sub-tier automotive suppliers whose customers require it, most often Tier 2 and Tier 3 suppliers to an IATF 16949-certified organization. Your customer's CSRs set the specifics.

Do I need ISO 9001 before MAQMSR?

Usually, yes. In the IATF's development path, MAQMSR comes after ISO 9001 certification, which is the starting minimum unless your customer authorizes otherwise.

Where can I get the MAQMSR document?

The IATF hosts the MAQMSR Second Edition as a short PDF on its website, and your customer may send it to you directly. You'll still need IATF 16949 itself to read the full text of the referenced clauses.

Get MAQMSR-ready without a big quality team

MAQMSR is a defined list, and every requirement comes down to having a process, following it, and proving it. If you want to see how Isolocity keeps control plans, nonconformances, supplier issues, inspections, and training records connected in one automotive quality management system, book a demo and we'll walk through it with your MAQMSR gaps in mind.