AS9100 vs. ISO 9001: What the Aerospace Standard Actually Adds

What is the difference between AS9100 and ISO 9001?

AS9100 contains ISO 9001 in full and then adds a layer of aerospace requirements on top of it. That is the whole relationship. A shop certified to AS9100D is meeting every clause of ISO 9001:2015 as part of it, plus a set of additional requirements that exist because the general standard was not enough for aerospace.

So the two are not alternatives, and a buyer comparing them is not choosing between two competing systems. One document is larger, and it contains the smaller one.

Which makes an ISO 9001 certificate a real quality credential that is not an aerospace credential. It says a company controls its processes, keeps records, corrects problems, and gets audited on all three. It says nothing about product safety, counterfeit parts, configuration control or flight risk, because ISO 9001 does not ask about them.

Why the aerospace layer exists at all

SAE issued the first AS9100 in March 1999. It added fifty-five aerospace-specific requirements to the ISO 9001 of the day, and the reason it was written is the part worth keeping: ISO 9001 on its own did not satisfy Boeing, Lockheed Martin, NASA and the FAA. Rather than four organizations maintaining four separate supplier standards, the industry built one.

The current certifiable revision is AS9100D, published in 2016 and built on ISO 9001:2015. Four revisions in, the pattern has held. When the underlying ISO standard moves, the aerospace document moves with it.

It is moving again. The AS9100 series is being renamed and revised as IA9100, expected in 2026 or 2027 with a transition window running to roughly 2029 under IAQG guidance. None of that changes what a buyer should do this year. Certificates are issued against AS9100D today, and a quality system built to AS9100D is the system that transitions.

What is shared, and what the aerospace layer adds

The clean way to read the two documents side by side is to separate what AS9100 inherits without change from what it puts on top. Nearly everything a quality manager would recognize as a quality system comes from ISO 9001. The additions are narrow, and they are all about what happens when a part ends up in an aircraft.

Inherited from ISO 9001:2015, unchanged

• Context and leadership. The same clauses, the same requirements for management commitment and a quality policy.
• Risk-based thinking. ISO 9001's own risk framework, kept intact.
• Process control and documented information. Procedures, work instructions, records, and the requirement to keep all of it current.
• Internal audit and management review. The same cycle, on the same terms.
• Nonconformity and corrective action. The same closed loop.

Added by the aerospace layer

• Product safety. Dedicated requirements across several clauses. ISO 9001 has no equivalent.
• Counterfeit part prevention. Its own clause, aimed at material and components entering the supply chain.
• Human factors. Folded into nonconformity and corrective action, so a root cause has to account for the person and not only the process.
• Configuration management. Significantly expanded. This is what keeps a part number, a revision and a drawing in agreement across the life of a program.
• Risk management. Aerospace operational risk merged with ISO's risk-based thinking rather than bolted beside it.
• Project management, design and development controls, external provider management, and post-delivery support. Each one expanded, with flow-down of requirements to sub-tier suppliers written into supplier management.

Check the certificate in OASIS, not on the website

A logo on a supplier's site is not verification, and neither is a PDF of a certificate. A PDF is a static file. It reflects the day it was made and nothing after that.

The record of authority is OASIS, the Online Aerospace Supplier Information System, run by the International Aerospace Quality Group. It holds supplier and audit assessment data for companies holding accredited certification in the AQMS series of standards, which is AS9100, AS9110 and AS9120. Anyone can register for access, so this is a check a sourcing engineer can run without asking the supplier for anything first.

The rule practitioners state is blunt. If an organization's certificate is not listed in OASIS, the IAQG does not recognize it. Accreditation is the thing being verified, and it is not something a printed certificate can demonstrate about itself.

Then read the scope, which is the step that gets skipped

A certificate covers a defined scope of work at a defined site. It is entirely possible for one to be genuine, current, properly accredited, listed in OASIS, and still not cover the work being bought. A scope written around assembly does not cover machining. A scope written around one facility does not cover a second building down the road.

So read the scope statement against the part. That comparison takes about a minute, and it is the difference between verifying a supplier and verifying a logo.

What certification does not tell you

This is the part that often gets left out. AS9100D certification is a gate condition, not a differentiator. Boeing, Lockheed Martin, Airbus and their tier-one partners typically require it before a supplier can be approved at all, which means that by the time a buyer is comparing two certified shops, both of them cleared the same bar in the same way.

The certificate says a quality system exists, is documented, and has been audited by an accredited body against the aerospace standard. It does not say the shop has machined a part like yours, holds the tolerance the print calls for, has capacity for the quantity, or picks up the phone when something goes sideways on a Friday afternoon.

AS9100 says as much itself. Clause 8.4 requires the buying organization to determine the type and extent of controls on external providers based on the potential impact on its ability to meet customer requirements. In plain terms, the aerospace standard tells its own certified users to go and evaluate their suppliers anyway. That is why supplier questionnaires, capability audits and first article inspections sit alongside the certificate rather than instead of it.

Point is, the certificate answers one question completely and it was never built to answer the others.

The path the primes wrote for a supplier in the middle

Certification is a two-stage audit by an accredited certification body, and there are prerequisites before either stage runs. The system has to be fully implemented and used long enough to generate records. A complete cycle of internal audits has to be finished. A management review has to be completed. Stage 1 examines the documentation. Stage 2, usually one to two months later, examines whether the documentation describes what actually happens on the floor.

Which means a shop can sit at a precise, nameable point rather than somewhere vague: documentation complete, internal audit cycle complete, management review complete, waiting on the external audit. That is a different statement from working toward certification, and the primes' own supplier documents treat it differently too.

Lockheed Martin's Appendix QJ opens section 1.0 by requiring a third party certified AS/EN9100 quality management system, "except as defined below." What follows is the exception. Sellers not holding that accreditation "will have their QMS validated using the checklist that supports Appendix A Quality Management System Requirements Checklist."

GKN Aerospace's quality requirements are built the same way. A supplier has to maintain a quality assurance system meeting the latest revision of SAE AS9100. Registration by an independent registrar "is not required," though "future registration will be required to maintain the status of active supplier," and in the interim "non-registered suppliers are subject to internal process audits to determine compliance to the latest revision of SAE AS9100."

Not every buyer offers that route. Some will not add a supplier to an approved list without a certificate in hand, and that is a legitimate position for a program to take. But the route exists in real documents from real primes, and a quality manual that contains a validation checklist gives its buyer more room than the certificate list alone suggests.

Standard's quality management system is built to AS9100D and ISO 9001:2015. The documentation is complete, a full internal audit cycle and management review are behind us, and the certification audit is pending. We would rather write that sentence plainly than round it up. If your supplier quality manual has a validation route for a shop in exactly that position, send us the checklist.

Does an AS9100 certificate tell you a shop can make your part?

No. It tells you a quality system exists, is documented, and has been audited by an accredited body against the aerospace standard. It does not tell you the shop has run a part like yours, holds the tolerance on your print, or has the capacity for the quantity you need.

That is not an argument against the certificate. It is the reason the certificate is the start of a supplier evaluation and not the end of one. Verify it in OASIS, read the scope against the work, then ask the questions it was never built to answer.

Questions buyers ask about the two standards

Is AS9100 better than ISO 9001?

It is larger, not better. AS9100D contains ISO 9001:2015 in full and adds aerospace requirements on top of it, so the comparison is not between two competing systems. For a part that is not going into an aircraft, ISO 9001 certification may be exactly the right credential for the job.

Do I need a supplier to hold both AS9100 and ISO 9001?

No, because AS9100 already contains ISO 9001. Some suppliers carry both certificates for commercial reasons and some hold ISO 9001 alone because their work is not aerospace, but a current AS9100D certificate covers the ISO 9001:2015 requirements inside it.

How do I verify that an AS9100 certificate is real?

Search the supplier in the IAQG OASIS database rather than accepting a PDF or a logo. OASIS holds accredited certification data for the AS9100, AS9110 and AS9120 standards and anyone can register for access, and a certificate that does not appear there is not recognized by the IAQG. Then read the certificate's scope and confirm it covers the work you are buying.

What is IA9100, and does it affect a certificate issued today?

IA9100 is the renamed and revised version of the AS9100 series, expected in 2026 or 2027 with a transition window running to roughly 2029 under IAQG guidance. Certificates today are issued against AS9100D, which remains the current certifiable revision, and existing certifications transition during that window rather than lapsing when the new document publishes.

Put us through your own process

If you are qualifying shops for an aluminum aerospace or defense program, the fastest way to find out whether we fit is to run us through the process you already have. Send the supplier questionnaire, or send the print and let the quote do the talking.

Send us your supplier questionnaire by starting your RFQ or reaching out directly. Or call 270.820.7009.