What ISO 19443 is
ISO 19443 sets out specific requirements for applying ISO 9001 in organizations of the nuclear supply chain that supply products and services important to nuclear safety (ITNS). It does not replace ISO 9001: it follows it clause by clause and adds sector-specific requirements where needed.
It covers the whole plant life cycle, from design and construction to operation and decommissioning, and applies to component manufacturers, material suppliers, engineering firms and service providers. The ISO/TR 4450 guidance explains how to apply it, with practical examples.
What it adds to ISO 9001
A company already certified to ISO 9001 has a head start, but the nuclear requirements change the way it works in several areas:
- Nuclear safety culture: management must promote and demonstrate it, and staff must understand how their work affects plant safety.
- ITNS products and services and the graded (progressive) approach: starting from the classification defined upstream, each company identifies its own ITNS and applies controls progressively, according to their importance to safety.
- CFSI: preventing, detecting and handling counterfeit, fraudulent and suspect items throughout the supply chain.
- Flowing requirements down to sub-suppliers and controlling externally provided processes as carefully as internal ones.
- Traceability of materials and activities, control of documented information and retention of records for the periods the customer requires.
- Qualified special processes, staff competence and awareness of their role in safety.
- Nonconformity management with customer notification, and change control.
Who needs it
ISO 19443 is not a legal requirement: the market asks for it. It is customers who impose it: major nuclear stakeholders require it from their tier-1 suppliers of components important to nuclear safety. From there the requirements cascade down the supply chain, as a matter of responsibility: each link answers to the one above for what it supplies.
So certification may be required in specifications or, even where it is not asked for explicitly, compliance may be required with broader nuclear requirements, such as nuclear safety culture (NSC) and CFSI prevention, which ISO 19443 covers. Demonstrating compliance with nuclear requirements through ISO 19443 certification is an excellent calling card, both for companies entering nuclear and for existing suppliers.
ISO 19443 and other nuclear standards
ISO 19443 does not replace the sector's other references; it works alongside them. In the United States, and in projects that follow US rules, ASME NQA-1 and 10 CFR 50 Appendix B apply; in Canada, CSA N299; for component design and construction, the ASME III and RCC-M codes. The same supplier may have to meet several of them, depending on the project and the customer.
So the useful work is not adding one system per standard, but building a single system that meets the applicable requirements and can demonstrate it to each customer.
The path to certification
The same path we follow with the 1000eng cycle, in six steps:
- 01 FRAMEContext and goals: which customers, which ITNS products, which standards besides ISO 19443, which certification body.
- 02 ASSESSRequirement-by-requirement gap analysis, based on evidence: what is in place, what is missing, and the priorities.
- 03 PLANAn action plan with owners, deadlines and resources, sized on the real gaps rather than on a template.
- 04 IMPLEMENTProcedures, processes and training: the system stays yours, written with your team and around your product.
- 05 VERIFYInternal audit, management review and closure of corrective actions before the external audit.
- 06 CERTIFYThe certification body's audit in two stages (Stage 1 on documentation and readiness, Stage 2 on implementation), then annual surveillance and recertification every three years.
Time and effort
As a guide, it takes 9 to 12 months with a dedicated internal team. Timing depends mostly on the starting point: a mature ISO 9001 system, already used to customer requirements, shortens the path considerably.
In terms of resources, the common experience is that one person needs dedicated time for the project, while the quality organisation largely stays as it is.
Why a consultant rather than the certification body
Accredited certification bodies cannot provide consultancy to the companies they certify: it is an impartiality rule (ISO/IEC 17021-1). They can train and audit, not build the system with you.
A consultant works on your side: translating the requirements into your context, helping you choose the certification body and supporting you through the audits. The goal is not the certificate itself, but a system that is genuinely applied and also holds up under customer audits.
Frequently asked questions
Do we need ISO 9001 first?
ISO 19443 contains all ISO 9001 requirements, so an ISO 9001 certificate is not a prerequisite; in practice, though, starting from a working ISO 9001 system shortens the path considerably.
Who decides what is ITNS?
Upstream, the nuclear technology licensee: through the preliminary safety analysis report (PSAR) it classifies the structures, systems and components that perform a safety function, from which the ITNS emerge. Each certified company must then define its own ITNS (the processes, components and services it supplies) and grade its approach accordingly.
Does ISO 19443 replace ASME NQA-1 or customer qualifications?
No. Some customers accept it instead of part of their own audits, but NQA-1, 10 CFR 50 Appendix B or customer-specific requirements may still apply depending on the project.
How long is the certificate valid?
Three years, with annual surveillance audits and a recertification audit at the end of the cycle.
Where should we start?
With a gap analysis: in a few days it shows where you stand, what is missing and how much work is really needed. It is also the basis for a sound quote from the certification body.