Depends on if your customer in production is required to comply with PCI via a QSA assessor or if they can self attests