Customer & Industry Requirements
Six capability levels rated per process
Capability level most OEMs require from suppliers
Current VDA QMC model (2026)
Regulation Overview
Automotive SPICE is a process reference and assessment model for the development of automotive systems and software. It does not prescribe one process. It rates how well a supplier performs each development process, from requirements through verification, against a defined capability scale. ASPICE compliance is therefore a measured result, not a pass or fail certificate.
The model is maintained by the VDA QMC and its Working Group 13, and it draws on the ISO/IEC 330xx assessment family. The current model is PAM 4.1, released in 2026, which refined the 4.0 model of 2023. OEMs and Tier-1s rely on ASPICE compliance to qualify the suppliers that build their electronic control units, embedded software, and mechatronic systems.
ASPICE compliance requires process-level evidence: an assessment report, a capability profile for each process, the assessed scope, and an improvement plan. When a customer sets a new target level or a new program begins, that evidence base has to be reassessed and resupplied across the supply chain.
Tier-1 suppliers developing ECUs, embedded software, or systems for OEM programs
Tier-2 and sub-tier software and hardware suppliers in the OEM flowdown
Embedded-software and EMS houses supplying automotive development programs
System and software teams inside OEMs that are assessed against ASPICE
Semiconductor and high-tech suppliers delivering automotive components with software content
Off-highway and heavy-equipment developers adopting ASPICE for embedded systems
Key Thresholds
Each OEM sets its own ASPICE scope and target level. One customer wants CL3 across SYS and SWE, another accepts CL2 on a narrower scope, a third adds HWE. Your team re-maps the same assessment evidence to every customer's definition by hand, and a single misread scope can stall a nomination.
An assessment is a snapshot. A new program starts, a target level rises, or VDA QMC publishes a new model, and last year's capability profile no longer answers the question. Suppliers hold evidence in slide decks and PDFs, so nobody notices it has expired until a customer requests current proof.
A customer needs to know which processes reached the target level and which did not. That answer sits inside a long assessment report as a per-process profile. Without structured extraction, finding the CL2 and CL3 results, and the gaps against a specific customer's target, means reading every report line by line.
Reports, scopes, assessment dates, and improvement plans live across Tier-1 and Tier-2 suppliers, in different templates and languages. When a prime requests a full evidence pack across a program, assembling it from these fragments takes weeks of chasing, and multi-tier supply chain transparency is almost impossible to show on demand.
Certivo In Action
Certivo in Action — ASPICE Evidence Workflow
Features Tabs
From Manual Report Reading to Exception Management
CORA extracts capability profiles automatically. Your team focuses on the gaps and judgments that need human attention, not on re-reading reports and re-mapping scopes by hand.
Customer Evidence, Always Current
Supplier ASPICE evidence stays complete, mapped to each customer's target, and traceable to source, so a capability request is answered in hours with an audit-ready pack.
Proactive Alignment to the Current Model
When VDA QMC publishes a new PAM or guideline edition, Certivo flags the supplier evidence that needs refreshing, so your evidence base keeps pace with the standard.
Frequently Asked Questions
Is ASPICE a certification?
No. ASPICE compliance is established through an assessment, and the result is a capability profile for each in-scope process, not a certificate issued by a regulatory body. Only intacs-certified assessors produce VDA-recognized results. Certivo stores and structures that evidence; it does not assess or certify.
Is ASPICE mandatory?
ASPICE is not a law and not a type-approval requirement. OEMs impose it contractually through supplier qualification and program requirements, and the exact scope and target level differ by customer. Certivo models each customer's requirement so a supplier can prove ASPICE compliance against every definition it faces.
Which capability level do OEMs require?
In practice, OEMs commonly require capability level 2 or 3 for the processes in the assessment scope, though this varies by customer and program. Levels 4 and 5 rarely appear in supplier assessments. Certivo flags where each supplier process meets or misses a given customer's target.
What changed in PAM 4.1?
PAM 4.1, released in 2026 alongside the Guidelines 3rd edition, is an evolutionary update that clarifies wording and improves consistency rather than restructuring the 4.0 model. A revision of the Automotive SPICE for Cybersecurity model is underway. Certivo's Scout monitors these releases and flags evidence to refresh.
Does ASPICE cover functional safety or cybersecurity?
No. ASPICE rates process capability. It does not demonstrate functional safety, which is governed by ISO 26262, or cybersecurity, which is governed by ISO/SAE 21434 and the related Automotive SPICE for Cybersecurity model. Certivo tracks capability, safety-process, and cybersecurity-process evidence as distinct records.