The Certificate That Matters Most When Vetting a Lithium Cell Supplier

The certificate that deserves the most scrutiny is the ISO 9001 certificate, and what matters is not the logo but two things on it: the scope statement and the certified site address. A quality management system certificate only counts when its scope names the activity that will actually produce your cells — design, manufacture, or both — when the address on it matches the plant that will build them, and when both can be confirmed in the issuing accreditation body's public registry. Everything else in the supplier's package, including UN 38.3 test reports, is a different category of evidence answering a different question, and mixing the two is the most common way a document review goes wrong.

Pull the certificate up the way I do — not in the email preview, but at 200 percent on a screen wide enough that the scope block and the address block sit in the same view. You are looking for a sentence, usually three to six lines, that reads something like "Design and manufacture of lithium-ion battery cells and battery packs." Read it once for the verbs. Read it again for what is not there. Then drop your eyes to the address underneath and read the street name, the district, the city. Then open a second tab, find the accreditation mark on the certificate, work out which registry that mark points to, and type the certificate number in by hand instead of clicking whatever link the supplier sent.

That is the whole job in miniature. The rest of this is about what you find when you do it.

The logo is the least informative thing on the page

A scanned ISO 9001 certificate is a claim. It is a well-formatted, officially-stamped claim, but it is a claim, and claims are cheap. The registry entry is the fact. When those two disagree — a certificate that looks fine but returns nothing in the registry, or returns a status other than active — the registry wins and the conversation is over until the supplier explains it.

I have had a supplier send a certificate where the number resolved to a completely different company. Not fraud, as far as I could tell: a sales office had grabbed a sister company's PDF out of a shared drive because it looked better than their own. That is the ordinary failure mode. Not forgery. Sloppiness at the boundary between the entity that holds the certificate and the entity that wants your purchase order.

ISO 9001 and UN 38.3 are not the same kind of document

People conflate these constantly, sometimes on purpose. ISO 9001 certifies a management system at a site. It says the plant has documented processes, internal audits, corrective action, management review, and that an accredited body has checked. It says nothing whatsoever about whether a specific cell will pass thermal abuse testing.

UN 38.3 is a test report on a specific cell or battery model — T1 through T8, altitude simulation, thermal cycling, vibration, shock, external short circuit, impact or crush, overcharge, forced discharge. It is a product-level artifact with a model number and a test lab on it.

You need both, and you need them to point at each other. What I do is lay the UN 38.3 summary beside the ISO certificate and check three addresses: the manufacturer address in the test report's cell description, the address on the ISO certificate, and the address on the business license or the proforma invoice. If those three do not converge on the same plant, one of them is describing somebody else.

Where the scope line actually breaks

The scope sentence is where most document packages fall apart, and it fails in a handful of predictable ways.

Watch for "design" being excluded. Plenty of valid certificates read "Manufacture of lithium-ion battery packs" with no design in front. That is fine if you are handing over a mature design and buying build-to-print. It is not fine if you expect the supplier to do the pack architecture, the BMS configuration, and the thermal layout, because the certificate is telling you plainly that design is outside the audited system. Believe it.

Watch for the wrong verb on the cell. A pack assembler whose scope says "assembly of battery packs" is not a cell manufacturer, no matter what the website says. That is not a problem — most of the suppliers you will talk to are assemblers — but it means the cell inside the pack has its own maker, and that maker's certificate and test reports are the ones you need in addition.

Watch for the scope that covers a product family your part is not in. A certificate scoped to small consumer cells does not automatically describe the prismatic cells in a 48V pack. Ask the supplier to point to where your model sits in their scope, in writing.

Group certificates, expired certificates, and the site that isn't on the page

The single most common gap I run into is a certificate issued to the parent or holding company with a scope that sweeps in "and its subsidiaries" or lists a registered office address that is clearly an office tower, not a factory. It may be entirely genuine. It still does not tell you which plant your cells come from or whether that plant was in the audit.

Ask for the site certificate. If there is not one, ask which site is covered by the group certificate and get that address confirmed on letterhead. Then verify the address is a manufacturing address — I have looked up more than one "factory" that turned out to be a trading company's floor in an office building.

Expiry is the other one. Certificates run on a three-year cycle with surveillance audits in between, and a PDF saved to a sales folder has a way of outliving its validity. The certificate itself will not tell you it has been suspended. The registry will. Check the status, not just the dates.

Finally, the accreditation mark. A certificate without one, or with a mark from a body you cannot trace, is not evidence of anything. The mark should identify an accreditation body that is a signatory to the international multilateral recognition arrangement — if you cannot establish that in a few minutes, treat the certificate as unverified rather than assume the worst.

IATF 16949, and when it is the wrong question

IATF 16949 comes up in every automotive conversation and almost nowhere else, and that is roughly correct. It is an automotive-sector supplement layered on top of ISO 9001, site-specific, and tied to the discipline your program will expect — APQP, PPAP, MSA, control plans, a real production part approval flow.

If your program is automotive and the OEM flow-down requires it, the absence of IATF at the building site is a genuine disqualifier for that program, not a negotiating point. If you are building e-bike packs, floor scrubbers, or stationary storage, its absence means very little. I have watched buyers reject competent cell suppliers over a certificate the program never needed, and I have watched buyers accept automotive-adjacent claims without checking that the certificate belonged to the plant making their part. Both are the same mistake: checking for a logo instead of checking for the site.

The document I ask for after the certificate

A certificate proves a system was designed. It does not prove the system is running. So once the ISO 9001 scope and registry check pass, I ask for three more things, redacted where needed:

• The internal audit schedule and the most recent summary of findings, not the raw reports.
• Management review minutes from the last cycle, which will tell you whether anyone is actually reading the audit findings.
• Corrective action records — 8D or CAPA — for the last twelve months, with the customer names stripped out.

What I am reading for is subject matter. Corrective actions about solder joint voids, incoming cell OCV screening limits, torque traceability on busbar fasteners, ESD handling on the BMS line — that is a system doing its job. Corrective actions that are all about missing signatures, late calibration labels, and revised forms are a system auditing its own paperwork. Both suppliers will have certificates. Only one of them will tell you the truth when a lot goes bad.

That is the trade I actually care about. The certificate gets a supplier into the conversation. The corrective action log tells you how they will behave eight months in, when a batch of cells arrives with mismatched internal resistance and you need somebody on the other end of the phone who treats it as a process problem instead of an argument.

Verify the scope, verify the site, verify the registry, then stop looking at the certificate and start looking at what the system has actually caught.