You won the contract. Now the purchase order says AS9100, and the clock is running. This guide explains what AS9100D actually adds on top of ISO 9001 — configuration management, product safety, counterfeit parts prevention, first article inspection, on-time delivery and more — along with how certification works, how long it realistically takes, and the mistakes that slow first-time aerospace suppliers down.
You Won the Contract. Now What?
The purchase order arrived, and buried in the quality clauses is a requirement you've never had to meet: an AS9100-certified quality management system. Maybe your prime contractor gave you a deadline. Maybe they're letting you ship under a waiver while you get certified. Either way, the clock is running and the production schedule doesn't care.
AS9100 isn't a completely different world from ISO 9001. It's ISO 9001 plus a set of requirements the aerospace and defense industry added because the consequences of failure are higher. If you already run ISO 9001, you have a foundation. If you don't, you have more work, but it's well-defined work.
This guide explains what AS9100D adds, how certification works, and how to avoid the mistakes that slow first-time aerospace suppliers down.
What AS9100D Adds to ISO 9001
AS9100D includes the full text of ISO 9001:2015 and adds aerospace-specific requirements. The ones that most often catch new suppliers off guard include these.
Operational risk management: a structured process for identifying, assessing, mitigating, and monitoring risks to product and delivery, beyond ISO 9001's general risk-based thinking.
Configuration management: controlling the product's configuration, meaning which drawing revision, which specifications, and which changes apply, throughout its life.
Product safety: identifying and controlling the aspects of your product and processes that affect safety.
Counterfeit parts prevention: processes to prevent counterfeit or suspect parts from entering your products, including controlled purchasing sources and verification.
First article inspection: verifying that the production process produces parts that meet every requirement, typically documented per AS9102.
Special requirements, critical items, and key characteristics: identifying and controlling the features that matter most.
On-time delivery and product conformity: measuring and improving delivery performance, not just quality.
Human factors and awareness: making sure people understand their contribution to product safety and conformity, and the importance of ethical behavior.
Flow-down: passing applicable requirements, including customer requirements, down to your own suppliers.
First Article Inspection: The Requirement That Trips People Up
If there's one AS9100-related area where new suppliers struggle, it's first article inspection. AS9102 defines a standard process and three forms: Form 1 for part number accountability, Form 2 for product accountability (materials, special processes, and functional testing), and Form 3 for characteristic accountability, where every design characteristic is listed with its requirement and actual result.
The most common mistake is missing characteristics. Every dimension, note, and specification call-out on the drawing needs to be identified, usually by ballooning the drawing, and accounted for. The second most common mistake is incomplete material and special process certifications. Heat treating, plating, and non-destructive testing often need approved sources and certifications that trace to the part.
Know what triggers a new or partial FAI. Typically this includes a design change, a change in manufacturing source, process, tooling, or location, or a lapse in production. Your customer's requirements define the specifics.
Contract Flow-Downs: Read Before You Build
Defense and aerospace contracts often carry quality clauses and flow-downs beyond AS9100 itself. Depending on your customer and product, these might include source inspection, specific record retention periods, approved special process sources, material traceability, counterfeit parts provisions, and cybersecurity requirements for handling controlled information.
AS9100 is usually required through your customer's purchase order and supplier quality requirements, not universally by law for every defense contract. That's why the first step is a careful contract review: list every quality requirement, who it applies to, and when it takes effect. Clause 8.2 of AS9100 expects exactly this kind of requirements review before you commit.
How AS9100 Certification Works
AS9100 certification is performed by certification bodies accredited under the aerospace industry's certification scheme. Certified organizations are listed in the industry's supplier database, which is where customers verify your status.
The process follows the familiar two-stage pattern: a Stage 1 readiness review and a Stage 2 certification audit, followed by surveillance audits and recertification. Aerospace audits tend to be more rigorous about process effectiveness and performance data, including on-time delivery and product conformity.
How long does it take? It depends almost entirely on your starting point. A shop with a working ISO 9001 system can often close the AS9100 gaps in a matter of months. A shop starting from nothing needs longer, because the certification body will expect the system to be operating, with internal audits and a management review completed, before Stage 2. Be skeptical of anyone who promises a fixed timeline without seeing your operation.
A Practical Sequence for Getting There
Start with a gap assessment against AS9100D. If you have ISO 9001, focus on the aerospace additions. If you don't, assess the whole standard.
Review your contract and flow-downs so the system is built around your actual customer requirements.
Build the aerospace-specific processes first, especially risk, configuration management, FAI, counterfeit parts prevention, and supplier flow-down, because they take the longest to generate evidence.
Train your people. Operators, inspectors, and buyers all need to understand what changes for them. Internal auditors need AS9100-specific training.
Run the system and generate records. Complete a full internal audit and management review.
Run a pre-certification mock audit, close the findings, then schedule Stage 1 and Stage 2.
Mistakes That Slow First-Time Aerospace Suppliers
Treating it as a documentation project. Auditors will follow a part through your process and ask to see the evidence at every step.
Buying a template manual. Generic templates describe someone else's shop. Auditors notice quickly when procedures don't match reality.
Ignoring on-time delivery. AS9100 expects you to measure delivery performance and act on it. Many shops don't track it honestly until the auditor asks.
Underestimating supplier control. Your special process suppliers and distributors become part of your certification story. Flow-downs and counterfeit parts controls need to reach them.
Waiting too long to start. Records take time to accumulate. Every week you wait is a week less of evidence at Stage 2.
How We Help New Aerospace Suppliers
Our AS9100 work starts with discovery: your contract, your flow-downs, and your current system. From there we build a path that fits your deadline, train your team on what changes for them, implement alongside you, and verify readiness with a mock audit before the certification body arrives.
Our work is led by an active third-party auditor certified across more than nine standards. If you just won defense work and need AS9100, see our page on winning a defense contract, or tell us what's going on.
Sounds like your situation?
“Won a defense contract, need AS9100”
See exactly how we approach this situation, what you'll have at the end, and request a Situation Review with our team.
Frequently Asked Questions
What is the difference between AS9100 and ISO 9001?
AS9100D includes all of ISO 9001:2015 and adds aerospace and defense requirements such as operational risk management, configuration management, product safety, counterfeit parts prevention, first article inspection, special requirements and critical items, and on-time delivery performance.
How long does AS9100 certification take?
It depends on your starting point. A shop with a working ISO 9001 system can often be ready in a matter of months. A shop starting from scratch usually needs longer, because the certification body will want to see the system operating with completed internal audits and a management review before Stage 2.
Is AS9100 required for every defense contract?
Not always. AS9100 is usually required through the prime contractor's or customer's purchase order and quality clauses rather than by law for every contract. Read your contract and quality flow-downs carefully to confirm what is required and by when.
What is AS9102?
AS9102 is the aerospace standard for first article inspection. It defines the forms and process used to verify and document that a new or changed part meets every drawing and specification requirement before production.
