AS9100 expects operational risk assessments to be specific enough that risks can be understood, owned, and controlled at the process and part/program level. High-level “generic” risk lists are not sufficient. The right depth depends on your process complexity, customer/regulatory expectations, and the maturity of your QMS and data.

AS9100 Rev D does not throw out existing configuration management practices, but it tightens expectations and aligns them with risk-based thinking and lifecycle control. Most changes are about integration with design, production, and change control, not replacing your CM system. Impact depends heavily on how mature and disciplined your current CM processes already are.