Which ISO 9001 clauses are mandatory for certification?

For ISO 9001:2015, certification is based on meeting all applicable requirements in the standard, not on a fixed subset of “mandatory” clauses. In practice, every clause that contains the word “shall” is mandatory unless it is legitimately not applicable to the scope of your quality management system (QMS).

Clauses that are always applicable

Certification bodies will expect the following core clauses to be implemented for every organization, regardless of industry or size:

• 4: Context of the organization
• 5: Leadership
• 6: Planning
• 7: Support
• 8: Operation (with limited, justified exclusions)
• 9: Performance evaluation
• 10: Improvement

Within these, all “shall” requirements are considered mandatory unless your organization can justify them as not applicable under clause 4.3 (scope of the QMS). In regulated industrial environments, auditors typically challenge scope limitations more strictly, especially where product safety, airworthiness, or contractual requirements are involved.

What can be excluded or marked not applicable

ISO 9001:2015 allows exclusions only where requirements cannot be applied due to the nature of your organization and its products and services. The classic example is clause 8.3 (Design and development of products and services).

• Clause 8.3 (Design and development): May be justifiably excluded if your organization truly does not perform design and development under its QMS scope (for example, pure build-to-print machining with no in-scope product or process design authority). You must still control customer specifications, drawings, and changes appropriately.
• Other operational sub-clauses in 8.x: In practice, most manufacturers find that nearly all of 8.x is applicable, because they procure, produce, inspect, and deliver product. Claims of non-applicability for these requirements are often heavily scrutinized in certification and regulatory audits.

Any exclusion must be:

• Explicitly described in your QMS scope (clause 4.3).
• Consistent with your actual operations, contracts, and regulatory obligations.
• Defensible with evidence during audit (for example, no design records, no design authority, contracts that clearly allocate design to another party).

If your operations, contracts, or regulatory environment evolve over time (for example, you start doing in-house tooling design, special process development, or configuration control), previously excluded requirements like 8.3 may become applicable and need to be brought into scope with proper change control and, where required, validation.

Implications in aerospace and other regulated manufacturing

In aerospace, defense, and other regulated sectors, ISO 9001 is often embedded in or superseded by sector standards (for example, AS9100). Even when your certification is directly to ISO 9001, regulators and primes usually expect:

• Very limited use of exclusions, typically only 8.3 and only with strong justification.
• Robust linkage between ISO 9001 clauses and your documented procedures, records, and digital systems (MES, ERP, PLM, QMS).
• Evidence that brownfield systems and legacy processes are included in the QMS scope, not treated as “out of scope” for convenience.

Because equipment lifecycles are long and system replacement carries qualification and downtime risk, many plants run a mix of legacy and newer systems. Auditors focus on whether ISO 9001 requirements are met across that entire ecosystem, not just in newer tools. For example, document control, configuration management, and traceability must work coherently whether records originate in an old on-prem MES or a newer cloud QMS.

How to determine applicability in your environment

To decide which ISO 9001 clauses are applicable for your certification scope:

1. Map your processes from customer requirement through delivery and support, including outsourced processes and special processes.
2. Identify which ISO 9001 requirements touch each process. Most manufacturers find that nearly all of clauses 4 to 10 apply.
3. For any requirement you believe is not applicable, document a specific, factual justification in the scope statement (clause 4.3) and ensure it aligns with contracts and regulatory requirements.
4. Verify that supporting systems (MES, ERP, PLM, QMS, paper-based processes) actually implement the requirement consistently, including in older lines and legacy equipment.
5. Treat scope or exclusion changes under formal change control, with impact assessment on validation, training, and audit trails.

Certification bodies will not accept a generic claim that certain clauses are “not mandatory.” They will expect a clear, justified scope and evidence that all applicable “shall” requirements are implemented and effective across your real operational landscape.