Supplier qualification: the part of the sale that happens after they say yes

The buyer said yes in March. The first purchase order arrived in September.

Nothing went wrong in between. The machine builder still wanted the module, the price never moved, the champion never wavered. What happened in those six months is that a company of twelve people discovered it was not being sold to. It was being qualified. And qualification is a different game with a different scoreboard, run by people who were not in the room when the yes was given.

If you sell hardware, materials, components or anything that ends up inside somebody else's production line, this is the part of the process nobody warns you about. The sale ends with agreement. Qualification decides whether the agreement is allowed to become money.

They are not checking your product. They are building a file.

A plant that stops for a day loses more than most deeptech companies raise in a seed round. Every new supplier is a new way for that to happen. Qualification is how a manufacturer converts an unknown company into a bounded, documented risk, and, just as importantly, how it proves to an auditor or its own customer that the conversion was done properly.

That second half explains behaviour that otherwise looks irrational. The buyer is not slow because they doubt your technology. They are assembling a file that has to survive review by people who will never meet you, some of whom will read it two years from now during an investigation into why a shipment failed. Anything that is not written down does not exist in that file. Your best demo does not exist in that file.

Once you see it as file construction rather than persuasion, the whole process gets easier to run. You stop trying to convince and start trying to supply evidence faster than they can ask for it.

How hard they check depends on what your part can break

Peter Kraljic laid the logic out in the Harvard Business Review in 1983, in Purchasing must become supply management, and it still governs how industrial procurement thinks. Items get sorted by two things: how much they affect profit, and how risky the supply market is. Low impact and low risk items get bought with a credit card. Items that are both high impact and hard to source get treated as strategic, which means slow, formal and heavily documented.

Deeptech parts almost always land in that strategic corner. Novel technology, single source, deep in the process, no proven alternative. So you get the maximum version of the procedure, not because you are small but because of where your part sits on their map.

This is worth asking about directly. If a buyer tells you your component is classified as strategic, you have just learned that the qualification will be long and that they are unusually motivated to see it finish. If they call it a bottleneck item, they need it and have no leverage, which is the best commercial position you will ever be in. Ask the question in the first call.

The questionnaire is a filter, not paperwork

First formal contact is usually a self-assessment questionnaire from procurement. Legal entity and ownership, turnover for the last two or three years, headcount, certification numbers and expiry dates, manufacturing sites including anything subcontracted, reference customers in the same industry, insurance limits, code of conduct, conflict minerals, REACH and RoHS declarations, and increasingly a block of specific cyber security control questions.

It reads like admin. It is a screen, and two mistakes kill submissions at this stage.

The first is answering aspirationally, describing the company you intend to be in eighteen months. Every claim is checked at audit. A gap between the questionnaire and reality is not filed as a capability problem, it is filed as an integrity problem, and that judgement follows you into every later stage.

The second is leaving fields blank. A blank field reads as a no.

Your bad credit report is survivable. Your silence about it is not.

Procurement will run you through a credit and risk service, and usually a sanctions and adverse-media screen too. For a young company the credit report is thin or poor. Everyone involved expects that. What it changes is terms: favourable payment terms are unlikely, a parent guarantee may be requested, and the buyer may quietly cap the annual spend they are prepared to place with you.

Get ahead of it. A one-page financial summary, a plain statement of runway, the names of your investors, and a direct answer to the question they are too polite to ask, which is what happens to their supply if you fail. Large manufacturers will take a young supplier surprisingly often when a continuity arrangement exists: escrowed drawings, a documented second source, or a licence that lets them have the part made elsewhere in a defined failure scenario. Nobody offers you that arrangement. You propose it.

Three closed problems beat zero problems

Engineering and quality then check whether you can make the thing repeatably, and they do it on documents before they do it on a visit. Quality manual, certification with the correct scope, process flow, control plan, FMEA, calibration register, training records, non-conformance history, sub-tier supplier list, business continuity plan. If you hold ISO 9001, most of this already exists in some form. If you do not, this is where five weeks disappear.

The item worth dwelling on is the non-conformance history. Founders instinctively want to present a clean sheet. Auditors do not believe clean sheets and read them as either inexperience or concealment. What they are looking for is evidence of containment, root cause and a corrective action that held. A supplier with three documented, closed reports is more credible than one claiming nothing has ever gone wrong.

The auditor will ignore your presentation and pick up a gauge

A first on-site audit for an industrial part is typically one to two days with one or two auditors. They will take a recent order and trace it forward: raw material certificate, goods-in inspection, work order, operator sign-offs, in-process checks, final inspection, packing, despatch. They will pick a gauge off the shop floor and ask for its calibration certificate on the spot. They will ask an operator, not a manager, what they do when a part is out of tolerance. They will check that the drawing revision at the machine matches the current released revision.

Findings get graded. Minors need a corrective action plan with dates and the process continues. A major blocks approval until it is closed and verified. The realistic target for a first audit is not zero findings. It is no majors, and a credible plan for the minors, sent with evidence attached rather than promises.

The counter-argument: do not do this at all

There is a serious case for skipping the whole thing. Sell through a distributor, an integrator or a system builder who is already on the approved list, let them carry the qualification burden, and spend your twelve people on the technology instead of on a control plan.

Sometimes that is right. If your part is a component inside a larger assembly, if the margin can absorb a channel, and if you do not need to hear directly from the end user to develop the product, going through a qualified partner will get you revenue a year earlier.

It is wrong when the thing you are selling is the reason the customer changes their process. Then the conversation you need is with the plant, not with the intermediary, and the intermediary has no incentive to explain your technology to anyone. It is also wrong as a permanent strategy, because your first direct qualification is an asset you build once and reuse. The second buyer wants roughly ninety percent of the same file.

Six months, three weeks of which were technical

Here is the shape of a real one, with the numbers rounded. A photonics company with twelve people sells a laser alignment module to a machine builder. Questionnaire in week one. The credit report flags low equity, so the buyer caps first-year spend at 150,000 euro. Quality pack requested in week three; the company holds ISO 9001 but has no control plan and no FMEA, which takes five weeks to build properly. Remote audit in week ten produces one major finding, because drawing revision control lives in a shared drive with no release record. Corrective action, which turns out to be a simple release log with a sign-off, closes in three weeks. First article submitted in week eighteen, rejected once for a missing calibration certificate on a borrowed interferometer, accepted in week twenty-two. Frame agreement in week twenty-four. Trial order of ten units in week twenty-six.

Six months. About three weeks of it was technical. The rest was documentation a research-led team had never needed to produce before, produced in the gaps between everything else, which is exactly why it took six months instead of eight weeks.

How long it takes, by industry

Industry	Typical duration	What makes it long
General industrial and machine building	2 to 5 months	Audit scheduling and sample approval
Automotive tier 1	6 to 12 months	Full PPAP, run at rate, capacity verification
Aerospace	9 to 18 months	Special process approvals and customer flow-down
Semiconductor equipment and materials	12 to 24 months	Tool-level qualification and copy-exact constraints
Pharmaceutical and medical	9 to 24 months	Validation, change control and regulatory impact

Illustrative ranges, not promises. The variable with the biggest effect on the clock is not your readiness. It is whether the buyer has a funded project with a deadline attached to it.

Where new suppliers actually get stopped

• Certificate scope mismatch. The certificate covers design and assembly at one site, the work happens at another. Treated as no certificate.
• No revision control. The most common major finding in small companies. Two versions of a drawing exist and nobody can prove which is current.
• Undeclared subcontracting. A process the buyer assumed was in house turns out to be bought in. The problem is the non-disclosure, not the subcontracting.
• Single points of failure. One machine, one operator who knows the process, one supplier of a critical input, no plan for any of them.
• Slow, fragmented responses. A pack arriving in four instalments over six weeks tells them exactly how you will behave during a quality escape.

The single-file rule

One thing separates companies that get through this in three months from companies that take nine, and it is not quality maturity. It is whether one named person owns the file.

The single-file rule: one person holds every request, every document, every open finding and every date, in one place, and sends the buyer a short status every week even when nothing has changed. Not the founder, because the founder travels and response time collapses the moment they do. Ninety percent of what this buyer wants, the next buyer will want too, so the file is not overhead for one deal. It is the asset that makes the second qualification take a third of the time.

Ask for the whole list of gates and documents on the first call rather than discovering them one stage at a time. Buyers will hand it over if asked, and almost nobody asks.

Common questions

What is the supplier qualification process?

The set of checks a manufacturer runs, covering finance, compliance, quality systems, technical capability and sample parts, before it will place production orders with a new supplier. It ends with approved status on the vendor list, usually with conditions attached.

How long does supplier qualification take?

Two to five months in general industrial supply, six to twelve in automotive, up to two years in aerospace and semiconductor supply chains. The largest single variable is whether the buyer has a funded project with a deadline.

What documents do I need to be qualified as a supplier?

Typically a quality manual, certification with the correct scope, process flow, control plan, FMEA, calibration register, training records, non-conformance history, sub-tier supplier list, business continuity plan, insurance evidence, compliance declarations and financial statements.

Can a startup pass without ISO 9001?

Sometimes, in general industrial and prototype supply, if you can demonstrate equivalent controls and the buyer accepts a conditional approval. In aerospace, automotive and medical it is effectively mandatory.

What is the difference between qualification and approval?

Qualification is the assessment. Approval is the outcome recorded on the vendor list, and it is scoped: approved for specific parts, processes, sites and spend levels, not approved in general.

What happens if we fail the audit?

Minor findings need a corrective action plan and the process continues. A major suspends approval until it is closed and verified, often by evidence rather than a second visit. Outright rejection is uncommon. Delay is the usual outcome.

Start the file before the buyer asks for it

If you are in a live conversation with an industrial buyer and nobody on your side owns the qualification file, that is the thing to fix this week, ahead of anything on the technical roadmap. Build the pack once, name the owner, and ask for the full gate list on the next call.

Next, read how a new supplier gets onto an approved vendor list and what goes into a first article inspection pack.

If you have built the technology and this is the part that is missing, tell us what you have built or see how we run the customer work.