The 90-day IATF window — what the clock actually means

The 90-day window is the timing rule in IATF 16949 that quality managers most often misunderstand. The misunderstanding is not what the rule says. The misunderstanding is what triggers it and what stops it.

Here is what the rule says. From IATF 16949:2016 clause 8.7.1.4 and the associated sanctioned interpretations: when a non-conformity is identified that affects product safety or could cause customer dissatisfaction, the supplier has 90 days from the trigger date to complete the corrective action — including containment, root cause, corrective action, and verification of effectiveness — and to provide objective evidence.

Three things to notice.

First, the trigger is not "the customer told you about it." The trigger is the supplier identifying or being formally notified of the non-conformity. SCAR receipt is the most common formal notification, but an internal NCR that meets the same conditions starts the clock equally. Many quality teams start the count from the SCAR email date and lose ten to fifteen days from the front of the window thinking they have more time than they do.

Second, the clock does not stop at "action shipped." The 90-day window includes the effectiveness verification step. If the fix ships at day 80 and effectiveness review is scheduled for the next production lot, which lands on day 110, the CAR is out of compliance even though the action was timely. This is the trap that the previous post described.

Third, if the supplier cannot meet the 90-day window, the rule does not allow indefinite extension. It allows the supplier to document a justified extension with the customer's acknowledgment. If extension acknowledgment is not on file, the auditor counts the CAR as failed, even if the fix eventually closed.

In practice, the operational pattern that survives IATF audits is:

1. Trigger date is the SCAR or NCR receipt date — not the date you got around to opening it.
2. Containment goes in within seven days — bracket the suspect parts, hold the lot, alert downstream.
3. Root cause and corrective action by day 30 — the bulk of the team's technical work happens here.
4. Action ships by day 45 — leaves headroom for verification.
5. Effectiveness review at day 60 — measure the next two production lots, attach evidence.
6. Closure with documented evidence by day 75 — fifteen-day buffer for the unexpected.

Soltreya surfaces every open CAR's days-remaining on the dashboard and tags every CAR approaching day 75 as at-risk. The reminder fires whether the quality manager opens the app or not. The pattern is mechanical, because the rule is mechanical. The shops that lose scorecard points are not the shops with hard quality problems. They are the shops that lost track of which CAR was on day 78.