But holding a certificate and passing an audit are two different things. Many quality teams can recite clause numbers on command, yet freeze the moment an auditor asks for proof that a process actually belongs to someone. That gap between knowing the standard and demonstrating ownership of it is where avoidable nonconformities pile up.
This guide breaks down all 10 clauses of AS9100 Rev D, explains what auditors actually check in Clauses 4-10, compares AS9100 against ISO 9001, and flags the mistakes that trip up quality teams most often.
Key Takeaways
- AS9100 adds roughly 100 aerospace-specific requirements on top of ISO 9001:2015
- Only Clauses 4–10 are audited; Clauses 0–3 are introductory and definitional
- Rev D’s biggest additions: Product Safety, Counterfeit Parts Prevention, and stronger Configuration Management
- Certification uses a two-stage initial audit, annual surveillance, and recertification every three years
- Most nonconformities hit Clause 8 operations, supplier flow-down, and weak root cause/CAPA evidence
What Is AS9100 and Who Needs It?
AS9100D is the quality management system standard published under the International Aerospace Quality Group (IAQG) for organizations that design, develop, or supply aviation, space, and defense products and services.
It's built on ISO 9001:2015, then layered with requirements specific to how aerospace products get designed, built, and tracked through the supply chain.
The standard isn't a solo document. IAQG maintains a small family of related standards depending on what your organization actually does:
| Standard | Who It's For |
|---|---|
| AS9100 | Organizations that design, develop, or produce aviation, space, and defense products |
| AS9110 | Aviation maintenance, repair, and overhaul (MRO) organizations |
| AS9120 | Distributors of aviation, space, and defense parts |
Most Tier 1, 2, and 3 suppliers don't pursue AS9100 out of curiosity — it's written into their contracts. OEMs and prime contractors require it as a condition of doing business, which makes certification more of a market entry requirement than an optional quality initiative.
Current version: AS9100D, revised in September 2016, remains the standard in force today, built to align with ISO 9001:2015.
IAQG's Annual Report confirms a full revision of the 9100 series is underway, timed to follow the next ISO 9001 update, with a planned publication target of Q1 2027.
The final designation hasn't been confirmed, so treat any reference to "AS9100E" as speculation until IAQG or SAE officially names it.
The 10 Clauses of AS9100: Requirements Broken Down
AS9100 follows the Annex SL structure now standard across ISO management system standards: 10 clauses, arranged the same way whether you're looking at ISO 9001, ISO 14001, or AS9100 itself.
Clauses 0 through 3 (Introduction, Scope, Normative References, and Terms and Definitions) are informative. Auditors read them for context but don't score you against them.
Clauses 4 through 10 are where the real work happens. Layered into these seven clauses are more than 100 aerospace-specific requirements beyond baseline ISO 9001, covering everything from configuration control to counterfeit parts prevention. Certification bodies spend most of their audit time on this ground.
Clauses 4-7: Building the Management System Foundation
- Clause 4 (Context of the Organization): Requires identifying interested parties, defining QMS scope, and mapping how your processes actually interact. Auditors want this to reflect your real operation, not a downloaded template.
- Clause 5 (Leadership): Top management must show visible commitment beyond a signed policy. Rev D still requires a designated management authority with unrestricted access to top leadership, even without a fixed "management representative" title.
- Clause 6 (Planning): Risk-based thinking has to show up in operational decisions, not sit in a spreadsheet nobody opens after the audit.
- Clause 7 (Support): Covers resource adequacy, staff competence, calibrated equipment, preserved organizational knowledge, and controlled documented information.
Together, Clauses 4-7 build the skeleton every other clause hangs on. Skip the foundation work and Clause 8 findings tend to follow.
Clause 8: Operation — Where Aerospace-Specific Requirements Live
Clause 8 is the largest clause in the standard, and it's where AS9100 stops resembling generic ISO 9001 and starts looking like aerospace. It covers product and service realization end to end.
Four sub-clauses exist only in AS9100, not in baseline ISO 9001:
- 8.1.1 Operational Risk Management: managing risk inside production operations, not only at the strategic level
- 8.1.2 Configuration Management: controlling product configuration and changes across the lifecycle
- 8.1.3 Product Safety: building safety into realization rather than adding it at final inspection
- 8.1.4 Prevention of Counterfeit Parts: detecting and blocking counterfeit parts from entering the supply chain
AS9100D defines a counterfeit part as an unauthorized copy, imitation, substitute, or modified part knowingly misrepresented as a genuine part from an original or authorized manufacturer. That distinction matters. Auditors will ask how your process tells an honest supplier error apart from a deliberate misrepresentation.
Clause 8 also carries the bulk of supplier management requirements:
- Maintaining an approved supplier register
- Flowing down applicable customer and regulatory requirements to sub-tier suppliers
- Monitoring supplier performance on an ongoing basis, including after onboarding
Beyond that, expect controls covering design and development verification, First Article Inspection, Foreign Object Debris (FOD) prevention, and nonconforming product handling. If your organization is going to get dinged somewhere, this is usually where it happens.
Clauses 9-10: Performance Evaluation and Improvement
Clause 9 asks whether your QMS actually works:
- Internal audits run on a planned schedule, including well before the registrar arrives
- Management review that drives decisions instead of rubber-stamping them
- Performance indicators management actually uses
Clause 10 covers what happens when something goes wrong. Auditors want genuine root cause analysis, corrective action tied to that root cause, and verification that the fix actually prevented recurrence. A corrective action that closes the paperwork without closing the loop is the most common finding tied to this clause.
AS9100 vs. ISO 9001: What's the Difference?
AS9100D builds on ISO 9001 rather than replacing it. The standard incorporates 100% of ISO 9001:2015's text and structure, then adds aerospace-specific requirements on top. Implement AS9100 correctly and you've satisfied ISO 9001's requirements along the way.
What AS9100 adds:
- Product Safety (Clause 8.1.3)
- Counterfeit Parts Prevention (Clause 8.1.4)
- Configuration Management (Clause 8.1.2)
- Deeper operational risk management (Clause 8.1.1)
- Human factors in corrective action (root cause analysis)
That last point surprises teams coming from a generic ISO 9001 background. AS9100 expects human factors such as fatigue, training gaps, and procedure clarity to be part of the investigation, not an afterthought.
Documentation expectations also differ. ISO 9001 gives organizations flexibility to document processes in a way that fits their context. AS9100 pushes toward more structured, traceable records: detailed production and supply-chain documentation that supports the regulatory scrutiny aerospace products face throughout their service life.
Both standards run on the same two-stage certification model, but AS9100 audits tend to dig deeper and demand more objective evidence per clause, because more is at stake in an aerospace supply chain.
Practical takeaway: If your organization already holds ISO 9001, you're more than halfway to AS9100 readiness. The clause structure and quality principles carry over directly. What's left is the aerospace-specific layer: Clause 8's sub-clauses, supplier flow-down, and the evidence trail auditors expect behind each one.
AS9100 Certification Process: From Gap Analysis to Registrar Audit
Getting certified is a multi-step sequence. Skipping steps rarely saves time in the long run.
Before the audit:
- Run a gap analysis against Clauses 4-10 to identify where your current system falls short.
- Implement the changes and let the system run. Most certification bodies expect at least three months of operation, including a full internal audit cycle and a management review, before scheduling Stage 1.
The two-stage initial audit:
- Stage 1 reviews documentation and readiness, typically completed in a day or two.
- Stage 2, usually scheduled one to two months later, verifies the system is implemented and working on the floor, not just on paper.
Any findings from either stage must be closed before certification is granted. Teams that treat Stage 1 as a formality often underestimate this step.
After certification:
- Annual surveillance audits check that the system is still functioning.
- Full recertification happens every three years.
Across every cycle, pulling together the evidence usually takes more time than the audit itself. Training records scattered across spreadsheets. CAPA history buried in email threads. Document revisions nobody can locate on short notice.
That is the gap QMS Learning's Document Management System was built to close. Instead of chasing records the week before an audit, the platform exports a single indexed Audit-Evidence Package (controlled documents, revision history, and timestamped acknowledgment records) in minutes rather than days. It will not replace the audit, but it removes the scramble that usually comes first.
Common AS9100 Requirements Mistakes to Avoid
Most AS9100 nonconformities trace back to a handful of recurring habits.
Generic, template-copied documentation. Process maps and quality manuals pulled from a template, rather than built around actual operations, are a frequent Clause 4 finding. Auditors spot a copied document within minutes; it never quite matches what's happening on the floor.
Risk management as a filing exercise. Plenty of teams build a risk register, fill it in once, and file it away. AS9100 expects risk-based thinking embedded in daily operational decisions, not a standalone document that only sees daylight during audit week. This is one of the top causes of Clause 6 and Clause 8 nonconformities.
Corrective actions without verified root cause. This is the big one. Teams document a corrective action, close the finding, and move on without confirming the fix addressed the actual cause. The nonconformity resurfaces months later as a repeat finding, which auditors treat far more seriously than a first occurrence.
Closing that gap means matching the right root-cause method to the finding, then proving the fix worked. QMS Learning's AI Workbench, designed by a 20-year practitioner auditor, diagnoses which approach fits a given nonconformity (5-Why, FMEA, fishbone, or similar) and generates an audit-ready CAPA artifact from that diagnosis.
In one documented example, the Workbench classified a supplier issue as a process-control gap, routed it through 5-Why and CAPA, and produced a report the auditor accepted on first review. Teams get verified root-cause discipline without routing every escalation through senior staff.
Frequently Asked Questions
How much does it cost to get AS9100 certified?
Costs vary based on company size, number of sites, and certification body, covering audit fees, gap analysis, training, and any process improvements needed. Request quotes from several accredited registrars to compare, since none publish a fixed rate.
Is AS9100 mandatory?
AS9100 isn't a legal or regulatory requirement — no government body mandates it. It is, however, a de facto business requirement, since most aerospace OEMs and prime contractors won't award contracts to suppliers who don't hold it.
What is the difference between AS9100 and ISO 9001?
AS9100 fully incorporates ISO 9001:2015 and adds aerospace-specific requirements on top, including Product Safety, Counterfeit Parts Prevention, and Configuration Management. Achieving AS9100 satisfies ISO 9001 requirements in the process.
What are common AS9100 mistakes?
The most frequent findings involve generic, template-based documentation, risk management treated as a static exercise rather than daily practice, and corrective actions closed without verifying root cause effectiveness.
How long does it take to get AS9100 certified?
Timelines typically run 6 to 12 months, depending on how mature your existing QMS is and how much implementation work precedes the initial audit. Most certification bodies also require at least three months of the system running before scheduling Stage 1.
What is the current version of AS9100?
AS9100 Revision D, published in 2016 and aligned with ISO 9001:2015, is the current version in force. IAQG has confirmed a future revision is underway, targeted for Q1 2027, though its final designation hasn't been announced.
