Customer approval requirements and the risk analysis are interrelated. IATF increased the control of rework by adding customer approval, risk assessment, rework process confirmation,...etc. As your example, it is indeed a simple rework and was probably regarded as no risk by your viewpoints before. I think the new extra control are from many cases similar to yours and the customers suffered some unexpected outcome. The automotive customers took their lesson learns, and I don't think it bad to involve the customer for the risk evaluation, including the possible late delivery. After all, better safe than sorry.
Or another way is to set an agreement for permitted rework types with corresponding approval requirements in advance. That's how we did with our automotive customers before.
Or another way is to set an agreement for permitted rework types with corresponding approval requirements in advance. That's how we did with our automotive customers before.

