Combining ISO 9001 and AS9100 for Aerospace Suppliers

Aerospace suppliers ask me some version of the same question almost every time we start a certification project: do we need ISO 9001 and AS9100, or does AS9100 just replace it? The short answer is that you build one quality management system and run one audit. AS9100D contains the entire text of ISO 9001:2015, word for word, and then layers aerospace-specific requirements on top of it. Treat the two standards as one system with an aerospace overlay, and the certification project gets a lot simpler. Treat them as two separate standards to satisfy, and you'll duplicate documents, duplicate audits, and duplicate cost for no real benefit.

This guide walks through what AS9100D actually adds to the ISO 9001 baseline, how the international AS9100 family works, how a combined audit gets scheduled and certified, and where I've seen suppliers get the integration wrong.

Why AS9100 and ISO 9001 Aren't Two Separate Systems

AS9100 was built by the aerospace industry so companies wouldn't have to run parallel quality systems. The current revision, AS9100D, was released in September 2016 and follows the same ten-clause Annex SL structure as ISO 9001:2015. Every clause number and every requirement of ISO 9001:2015 appears inside AS9100D. The aerospace-specific text is added inline and called out separately, rather than bolted on as a separate appendix.

That structural choice does real work for you. A supplier's quality manual, procedures, and records can satisfy both standards from the same document set, as long as those procedures also cover the aerospace additions where ISO 9001 is silent. It also means one accredited audit, run by an auditor qualified for both scopes, generates evidence for both certificates. I have yet to see a legitimate reason for an aerospace manufacturer to maintain a standalone ISO 9001 system next to a separate AS9100 system. If your consultant or certification body is quoting two systems, ask why.

The International Aerospace Quality Group (IAQG) owns and publishes the 9100 series of standards and coordinates its use across the aerospace, space, and defense supply chain worldwide. IAQG doesn't write ISO 9001 — that's ISO Technical Committee 176 — but it builds the 9100 series as a superset of it, and revises it on roughly the same cycle ISO uses for the base standard.

What AS9100D Adds to the ISO 9001:2015 Baseline

The additions aren't cosmetic. They target the specific failure modes that matter in aerospace manufacturing: parts that don't trace back to their source, configurations that drift from what was designed, counterfeit components entering the supply chain, and errors that get written off as "operator error" instead of investigated. Here's exactly where AS9100D departs from ISO 9001:2015.

Three of these deserve a closer look, because they're where I see suppliers underbuild their systems.

Configuration management (8.1.2) trips up companies that come from a general manufacturing background. In a typical ISO 9001 shop, document revision level is tracked, but the as-built configuration of a delivered unit isn't tied back to a specific engineering baseline. Aerospace customers expect more. They want to know exactly which drawing revision, which approved deviation, and which component lot went into a specific serial-numbered part. If your system tracks document control but not product configuration against baselines, that's the gap AS9100D will find first.

Prevention of counterfeit parts (8.1.4) is a newer addition, and it exists for a documented reason. A 2012 U.S. Senate Armed Services Committee report, Inquiry into Counterfeit Electronic Parts in the Department of Defense Supply Chain, traced thousands of suspect counterfeit electronic parts into the defense supply chain and pushed the industry toward the controls now written into clause 8.1.4. Buying from your usual distributor isn't enough anymore. The standard expects a documented, risk-based approach: approved-source purchasing, incoming inspection tuned to detect suspect parts, and training for the people who handle procurement and receiving.

Human factors (10.2.1) is the one people are most surprised by. ISO 9001 asks you to correct nonconformities and address root cause. AS9100D goes further and specifically requires you to consider whether human error — fatigue, workload, unclear instructions, poor lighting, a rushed procedure — contributed to the nonconformity before you close the corrective action. It's a small addition in word count. In practice, it's a large one, because it forces investigations past "operator error" as a closing statement.

Two related documents round out the picture, even though neither is part of AS9100D itself. AS9102 governs First Article Inspection, the detailed dimensional and characteristic verification aerospace customers commonly require on new or changed parts. AS9101 is the audit criteria document IAQG-recognized certification bodies use to conduct the audit and score nonconformities — worth reading if you want to understand exactly how an auditor will structure your audit, since it dictates the report format and the process-based audit methodology IAQG requires.

The Global Family: AS9100D, EN 9100, and JIS Q 9100

Aerospace supply chains are global, and IAQG built the certification scheme to match. The technical requirements are identical across regions. What differs is the regional designation and which standards body distributes the document.

IAQG owns the 9100 series and coordinates it as one harmonized scheme; SAE International, ASD-STAN, and SJAC serve as the regional bodies that publish and distribute it in their respective markets. If you're a U.S.-based supplier selling only to U.S. primes, you'll certify to AS9100D and rarely think about the other two. If you supply into European or Japanese aerospace programs, or a customer's purchase order specifically calls out EN 9100 or JIS Q 9100, know that the underlying requirements match AS9100D clause for clause. A certification body accredited for one can typically issue any of the three, since they're harmonized documents under the same scheme. Confirm with your certification body which designation your specific customer contract requires — don't assume AS9100D alone covers every contract.

How a Combined Audit Actually Works

This is where "one system, one audit" becomes concrete. When a certification body audits you to AS9100D, it is, by definition, auditing every ISO 9001:2015 clause plus the aerospace additions. Most accredited certification bodies will issue both an AS9100D certificate and an ISO 9001:2015 certificate from that single audit, provided your scope statement and their accreditation cover both. There's no requirement to run a second audit for the ISO 9001 certificate alone.

There is one real operational difference, and it matters for planning: AS9100 audits require the certification body to upload results to the Online Aerospace Supplier Information System (OASIS), a database IAQG maintains at oasis.iaqg.org. Aerospace primes check OASIS to verify a supplier's certification status, audit history, and nonconformity record before placing a purchase order. ISO 9001-only audits have no equivalent public database. If your certification body can't explain how they handle OASIS reporting, that's a sign they may not be accredited for AS9100 work at all. Check before you sign.

The certification scheme itself is governed by IAQG 9104-001, Requirements for Aviation, Space, and Defense Quality Management System Certification Programs. That document sits on top of the general ISO/IEC 17021-1 requirements every accredited certification body must meet for any management system audit. IAQG 9104-001 adds three things ISO/IEC 17021-1 doesn't: auditor competency requirements specific to aerospace processes, minimum audit-duration calculations that account for the extra AS9100D clauses, and stricter rules for how nonconformities get dispositioned and closed. In practice, an AS9100 audit takes longer than an ISO 9001-only audit of a comparably sized facility. The auditor assigned to you needs aerospace-sector experience recognized under the scheme — a general ISO 9001 lead auditor credential isn't enough.

Building One Quality Management System for Both Standards

If you're starting from an existing ISO 9001:2015 system and adding AS9100D, the integration work is narrower than most suppliers expect. A gap analysis should focus on the clauses in the table above, plus five cross-cutting areas:

1. Risk management. ISO 9001:2015 already requires risk-based thinking at the organizational level. AS9100D's clause 8.1.1 pushes that down to the operational level: risk in your processes, your delivery schedule, your post-delivery support. If your existing risk register only covers strategic and business risk, extend it to cover production risk.
2. Documented processes for the new clauses. Configuration management, counterfeit-parts prevention, and product safety each need their own documented process, even if it's short. Auditors look for evidence the process is followed, not just that a policy statement exists.
3. Flow-down to suppliers. Your purchasing controls need updated language, and your supplier agreements need to require sub-tier suppliers to meet the same aerospace-specific obligations you're now bound by, particularly around counterfeit parts and traceability. This is where a lot of the real implementation labor lives — rewriting purchase order terms and getting existing suppliers to acknowledge them.
4. Record retention. AS9100D doesn't set one universal retention number; it requires you to define retention based on contractual, statutory, and regulatory requirements. In practice, aerospace supplier quality clauses commonly specify ten to fifteen years from last shipment, and defense and commercial aircraft programs still in service can push retention to the life of the program, sometimes several decades. Don't assume your general manufacturing retention schedule is long enough — check the specific customer contracts driving your certification.
5. Internal audit and management review. Update your internal audit checklist and management review agenda to explicitly cover the AS9100D additions. An internal audit program that only checks ISO 9001:2015 clauses will miss exactly the areas your external auditor is trained to probe hardest.

Common Mistakes Aerospace Suppliers Make When Integrating the Two

1. Treating AS9100D as an add-on module instead of rewriting the processes it touches. A company will bolt a one-page counterfeit-parts policy onto an otherwise unchanged purchasing procedure and expect it to pass. It doesn't. Auditors want to see counterfeit-parts controls embedded in how purchasing, receiving, and inspection actually operate day to day, not sitting next to those processes as an afterthought.
2. Picking a certification body without verifying AS9100 accreditation scope and OASIS reporting track record. Not every certification body accredited for ISO 9001 is also accredited for AS9100. The audit is a different animal: longer, more technical, and it needs auditors who understand your specific aerospace processes. Verify accreditation before you sign, not after the audit exposes the gap.
3. Underestimating the flow-down work. Suppliers focus their internal effort on their own four walls and treat sub-tier supplier flow-down as a paperwork exercise — updated purchase order boilerplate and nothing more. Auditors increasingly sample sub-tier supplier files and ask how you verified those suppliers actually implement the flow-down requirements, not just acknowledged them on paper.

Get those three things right, and the rest of the integration reads closer to routine ISO 9001 maintenance than a separate certification burden.

FAQ

Do I need separate certifications for ISO 9001 and AS9100, or does one replace the other? AS9100D contains the full ISO 9001:2015 standard plus aerospace-specific additions. Most certification bodies issue both certificates from a single combined audit, so you typically don't need to maintain or audit two separate systems.

Can one audit really cover both standards? Yes. Because AS9100D incorporates ISO 9001:2015 clause for clause, an accredited AS9100 audit generates the evidence needed for both certificates, provided your certification body's accreditation scope covers both.

What's the difference between AS9100D, EN 9100, and JIS Q 9100? None on the technical requirements — they're harmonized under the same IAQG-owned 9100 series. The difference is regional: AS9100D is the Americas designation, EN 9100 the European designation, and JIS Q 9100 the Japanese designation. Which one your contract requires depends entirely on your customer.

What is OASIS and why does it matter? OASIS, the Online Aerospace Supplier Information System, is the IAQG-maintained database where certification bodies report AS9100 audit results. Aerospace primes check OASIS before placing purchase orders, so a supplier's certification status and audit history are effectively public within the industry.

If we're already ISO 9001 certified, how much additional work is AS9100 certification? It depends on how mature your risk management, configuration control, and supplier flow-down processes already are, but the added clauses are narrow and specific. Most ISO 9001-certified manufacturers can close the gap with focused work on operational risk, configuration management, counterfeit-parts prevention, product safety, and supplier flow-down, rather than rebuilding the system from scratch.

If you're weighing whether to pursue AS9100D alongside your existing ISO 9001:2015 certification, or starting both from zero because a new aerospace contract requires it, our ISO 9001 consulting team can run the gap analysis against both standards at once — no reason to pay for two separate assessments when one tells you everything you need. If that same contract carries export-control obligations, which is common in defense-adjacent aerospace work, it's worth reviewing your ITAR compliance posture at the same time, since the two are often audited by the same customer within months of each other.

Last updated: 2026-08-17