Customer-Specific Requirements: VW, Stellantis, and Ford Compared

Customer-Specific Requirements, or CSRs, are the extra layer each automotive OEM adds on top of the IATF 16949 baseline to reflect its own quality expectations, portals, and escalation procedures. Volkswagen Group, Stellantis, and Ford each publish their own CSR documentation, and a supplier certified to IATF 16949 alone is not automatically compliant with any one of them. Because these documents change frequently and are managed directly by each OEM, the only reliable comparison is a structural one — what categories of requirements to expect — paired with a habit of checking the current published version before every audit or launch.

What CSRs actually are, and why IATF 16949 alone isn't enough

IATF 16949 sets a common baseline: a quality management system built for automotive production and service parts, with requirements around risk-based thinking, product safety, and embedded software. But the standard was designed to be supplemented. Each OEM that participates in the IATF scheme is required to publish its own CSRs, which suppliers must integrate into their quality management system alongside the base standard. An auditor assessing a supplier against IATF 16949 checks not only the standard's clauses but also whether the applicable CSRs for that supplier's customers have been identified, documented, and implemented.

This matters because a supplier can run an technically excellent quality system and still fail an audit or lose a launch approval if it missed a customer-specific portal requirement, a specific PPAP submission level, or an escalation threshold that only applies to one OEM. CSRs are not optional add-ons — they carry the same audit weight as the standard itself once a supplier ships to that customer.

Where the three OEMs diverge structurally

Rather than compare specific clause numbers — which change with each CSR revision and vary by commodity — it's more useful to understand the categories where Volkswagen Group, Stellantis, and Ford tend to differ in emphasis and mechanism.

Volkswagen Group (Formel Q)

Volkswagen Group's supplier quality framework is known as Formel Q, and it applies across VW, Audi, Škoda, SEAT/CUPRA, and other group brands, sometimes with brand-specific annexes. Formel Q is built around a structured supplier qualification and capability assessment process that runs from sourcing through series production, with defined maturity levels a supplier's project must pass before parts are approved for delivery. Group-wide portal systems are used for document exchange, problem reporting, and capacity confirmation, and suppliers are expected to actively monitor these systems rather than wait for direct communication.

Stellantis

Stellantis was formed in 2021 from the merger of Fiat Chrysler Automobiles (FCA) and Groupe PSA (Peugeot, Citroën, Opel/Vauxhall). Because of that history, suppliers working across former FCA and former PSA brands should expect that legacy supplier quality requirements from each predecessor organization may still be referenced or in transition toward a unified Stellantis CSR set, depending on the plant, brand, and commodity involved. In practice, this means a supplier serving multiple Stellantis brands cannot assume one CSR document covers all of them — the applicable requirement set should be confirmed per program and per sourcing location rather than assumed from a single group-wide reference.

Ford

Ford publishes its CSRs directly through the official IATF CSR database alongside the other participating OEMs, rather than through a separate proprietary portal structure for the CSR document itself, though Ford maintains its own supplier-facing systems for program management, PPAP submission, and problem resolution. Ford's CSRs typically address specific expectations around control plan content, error-proofing verification, and read-across requirements — the practice of checking whether a defect found on one part or program could affect similar parts or programs elsewhere in the supplier's operation.

Categories every automotive supplier should check, regardless of customer

Whichever OEM a supplier serves, CSRs consistently touch the same functional areas. The specific requirement in each category is what differs by customer and changes over time — so treat the table below as a checklist of what to look for, not a source of specific values.

Practical impact: why static comparisons fail suppliers

CSRs are published and revised by each OEM through the official IATF CSR task force database, and revisions can happen multiple times a year without a predictable cycle. A supplier that relies on a comparison chart from a training deck, a consultant's summary, or last year's audit notes risks working from an outdated requirement — which shows up as a nonconformance the moment an auditor or customer quality engineer checks the current published document against what the supplier's quality system actually implements.

The safer operating discipline is to treat the IATF CSR database as the single source of truth, check it against the specific customer and commodity code before every PPAP submission or system audit, and document the version and date checked as part of the supplier's own change-control records. Multi-OEM suppliers — which is most of the automotive supply base — need a way to track which CSR version applies to which program and to spot when a new revision has been published.

Common mistakes

• Applying one OEM's CSR across all Stellantis brands. Given the FCA-PSA merger, assuming a single unified requirement set exists for every Stellantis plant and brand can miss a legacy requirement still in force at a specific location.
• Treating IATF 16949 certification as sufficient on its own. Certification confirms the baseline system; it does not confirm CSR compliance for any individual customer.
• Working from a cached or printed CSR copy. Because CSRs are revised on the OEM's own schedule, a document saved to a shared drive months ago may no longer reflect what an auditor will check.
• Missing flow-down obligations. Some CSRs require the Tier 1 supplier to pass specific requirements to Tier 2 and beyond — an obligation that's easy to overlook if the CSR review stops at the supplier's own system.
• Assuming CSR scope is uniform across commodities. The same OEM can publish different requirements for, say, electronics versus stamped metal parts, even within one brand.

This is where a documentation gap becomes an audit finding: when the answer to "which CSR requirement applies here" depends on someone remembering the right portal, the right version, and the right commodity code. Igera's AI reads an organization's own quality documentation — CSR files, control plans, PPAP records, internal procedures — and answers questions by citing the exact source document, so a quality engineer can confirm what actually applies to a given program instead of relying on memory or an outdated printout.

Frequently asked questions

Are CSRs part of IATF 16949 certification itself?

CSRs are not clauses within the IATF 16949 standard text, but IATF auditors are required to verify that applicable CSRs have been identified and implemented as part of a certification or surveillance audit. A supplier can hold a valid IATF 16949 certificate and still receive a nonconformance for a CSR gap.

Where can a supplier find the official, current CSR for a given OEM?

The IATF maintains an official CSR database where participating OEMs publish and update their customer-specific requirements. This is the authoritative source; supplier-facing OEM portals often link back to it or host a synchronized copy.

Do Stellantis suppliers need to track FCA and PSA legacy requirements separately?

In many cases, yes, at least during the transition period following the 2021 merger. Which legacy requirement set applies can depend on the specific plant, brand, and program, so this should be confirmed directly rather than assumed.

How often do OEMs update their CSRs?

There is no fixed schedule, and it varies by OEM and by commodity. Some CSR documents are revised more than once a year. This is precisely why a static comparison table becomes unreliable quickly and why checking the current published version is the only dependable approach.

Does a higher PPAP level always mean a stricter customer?

Not necessarily — PPAP level requirements are typically tied to part risk, program phase, and prior supplier performance rather than being a fixed attribute of one OEM versus another. The same OEM can require different levels for different parts.

What happens if a supplier misses a CSR update?

Consequences range from an audit nonconformance to a hold on PPAP approval or a supplier status escalation, depending on the severity of the gap and the customer's own supplier management process. Repeated misses can affect a supplier's overall quality rating with that OEM.

Can a quality management software substitute for reading the actual CSR document?

No single tool replaces confirming the current CSR text for a specific customer and commodity. What software can do is make an organization's own stored CSR files, control plans, and procedures searchable and traceable to their source, reducing the risk of working from an outdated or misremembered version.

This article is for general informational purposes and does not constitute legal, regulatory, or certification advice. Customer-specific requirements change frequently and vary by OEM, brand, plant, and commodity — always confirm current requirements directly through the official IATF CSR database or with a qualified automotive quality professional before making compliance decisions.