Good day
@rvanderbilt ;
Keep em' coming. "SPICE" is still a relatively new subject, and I'm sure there are quite a few watching these posts.
Bear in mind that regardless of IATF 16949 , organizations are subservient to applicable CSR (customer specific requirements).
As you know, the CSR specifically states...
... an assessment of software process
capability/maturity in accordance with CS.00187.
The FCA (Stellantis
CSR under 8.3.2.3 does not directly state SPICE as a requirement. However, you know best what it is the customer is asking for and I do not have access to referenced document CS.00187.
(Is it possible for you to share the gist of that document without violating any trade or copyright rules?)
8.3 is divided between "process" design (no "exemption") and "product" design ("exemption" if logic).
We are currently discussing "product design", which, based on what I understand from your description, your organization site is NOT product design responsible. However, this does not exclude requirements placed upon an organization by the customer.
It IS possible, however, that your customer is also new to SPICE and mis-applying the requirements. I would certainly hope that a strong relationship exists with the OEM (and/or will be developed), wherein a frank and open conversation can take place around this subject. It is indeed difficult for me to see how or why the OEM would want to apply any SPICE requirements to your site. Remember, the customer is NOT always correct
Hope this helps
Be well.