Quality certifications get thrown on purchase orders constantly, often by buyers who aren't sure what they're actually requiring. ISO 9001 and AS9100 are the two you'll see most. They sound similar. They aren't.
ISO 9001: The baseline
ISO 9001 is the international standard for quality management systems. It doesn't prescribe how a manufacturer makes parts. It defines how they organize their processes so that quality is consistent and repeatable.
An ISO 9001 certified shop has:
- Documented processes for every step from quoting to shipping
- Management review of quality objectives and performance
- Internal audits to catch problems before customers do
- Corrective action procedures when things go wrong
- Calibrated inspection equipment with documented traceability
- Training records for all personnel
What ISO 9001 does NOT guarantee:
- That the shop can hold your tolerances
- That their equipment is capable of your process
- That they've made parts like yours before
- That your parts will be defect-free
ISO 9001 is a system certification, not a product certification. A shop with ISO 9001 has a quality system. Whether that system is effective for your specific part is a separate question entirely.
AS9100: Aerospace-grade quality
AS9100 includes every ISO 9001 requirement, then adds roughly 100 additional aerospace-specific clauses on top. If ISO 9001 is the foundation, AS9100 is the entire building plus the fire suppression system, seismic bracing, and 24/7 surveillance.
Key additions over ISO 9001:
- First Article Inspection (FAI) per AS9102, a documented verification that the production process can produce conforming parts before full production runs
- Special process controls for heat treating, welding, NDT, and surface treatments, which must be performed by NADCAP-accredited processors (or equivalent)
- Configuration management to track design changes and their impact on production
- Risk management with formal identification and mitigation of quality risks across all business processes, not just the general "risk-based thinking" ISO 9001 calls for
- Counterfeit part prevention with controls that go beyond an approved supplier list. AS9100 clause 8.1.4 requires you to prevent suspect parts from re-entering the supply chain, and clause 8.4.3 requires flowing that requirement down to every external provider
- On-time delivery tracking as a measurable quality objective, not a nice-to-have metric
- Customer property controls for handling customer-furnished material, tooling, and data
- OASIS database registration, which is mandatory. If a certified supplier refuses to register in the IAQG OASIS database or set up an OASIS administrator, the certification body is required to revoke their certificate
When do you actually need AS9100?
You need AS9100 when:
- You're supplying parts directly to an aerospace OEM (Boeing, Airbus, Lockheed Martin, etc.)
- Your customer's purchase order requires it
- The parts are for a flight-critical or safety-critical application
- You need access to aerospace supply chains. Most primes won't add you to their approved supplier list without it.
You probably don't need AS9100 when:
- You're making commercial or industrial parts that happen to run on the same equipment
- You're prototyping or in early development
- Your customer hasn't specifically requested it
- You're making ground support equipment or non-flight hardware (though some programs still require it)
The cost difference
These numbers matter. For a small-to-midsize manufacturer (10 to 50 employees), here's what the certifications actually cost:
ISO 9001: Total cost from zero to certified runs $8,500 to $15,000, including consultant support and registrar fees. A toolkit-based approach where you build the system yourself with templates can cut that to $5,000 to $8,000. Certification timeline is typically 2 to 6 months.
AS9100: Total three-year cost lands between $20,000 and $45,000, broken down roughly as $10,000 to $20,000 in registrar fees and $8,000 to $20,000 in consultant or implementation costs. Registrar day rates run $1,500 to $2,500 per day, and some certification bodies bury extra fees in the proposal. Implementation takes 12 to 18 months if you're starting from ISO 9001, or 18 to 24 months from scratch.
On the production side, expect 10 to 30% higher per-part costs from AS9100 shops. That premium reflects longer inspection times, FAI documentation, full material traceability, and the overhead of maintaining a system that gets audited harder and more often.
Annual surveillance audits take 1 to 3 days per year. The auditor reviews everything from your corrective action log to your supplier evaluations. The most common finding across the entire OASIS database? Supplier controls under Clause 8.4.1. Shops get dinged for having an approved supplier list that exists as a document but no active monitoring or re-evaluation process behind it.
That premium buys you a level of process control and traceability that commercial manufacturing doesn't provide. Whether you need it depends entirely on your application.
Other certifications worth knowing
- IATF 16949 is the automotive equivalent of AS9100, required by most auto OEMs.
- ISO 13485 covers medical device quality management and is required for FDA-regulated manufacturing.
- ITAR is not a quality certification but a compliance registration for handling defense-related technical data and hardware.
- NADCAP is accreditation for special processes (heat treating, NDT, welding, plating) used within the AS9100 ecosystem.
Bottom line
Don't require AS9100 if you don't need it. You'll pay 2x to 3x more for the certification alone and limit your supplier pool to shops that have made that investment. But if your application demands it, don't try to save money with an ISO 9001-only shop. The gap between the two standards is real. It shows up in how nonconformities get investigated, how suppliers get monitored, how material gets traced. And it matters most when something goes wrong.