Regulators generally do not mandate AS9100 by name. They typically require that organizations have an “acceptable” or “adequate” quality management system, and they may reference ISO 9001 as a baseline. AS9100 is usually required by customers and primes via contract flowdown, not directly by regulation.
Regulators vs. standards bodies vs. customers
In aerospace and defense environments, it helps to separate three different drivers:
- Regulators (FAA, EASA, military aviation authorities, defense ministries) set legal and airworthiness requirements, but usually do not prescribe a specific commercial QMS standard.
- Standards bodies (ISO, IAQG) publish ISO 9001 and AS9100, but they do not have regulatory power.
- Customers / primes / OEMs (Boeing, Airbus, Tier 1s, defense primes) frequently require AS9100 certification contractually as evidence that your QMS meets aerospace-sector expectations.
What regulators typically require
Most civil aviation authorities and defense agencies require that you have and follow a documented quality or production system that:
- Controls configuration, design, and process changes with traceability.
- Ensures only conforming product is released.
- Maintains records to support airworthiness and defect investigations.
- Supports oversight and audits by the authority.
They may accept ISO 9001 or AS9100 certification as supporting evidence that your system is structured and maintained, but they usually stop short of a legal requirement that you be certified to a specific standard.
Where AS9100 comes from in practice
AS9100 is an aerospace-specific extension of ISO 9001, published by the IAQG. The practical pressure to adopt AS9100 normally comes from:
- Prime contractor and OEM requirements that specify AS9100 (or AS9110/AS9120) certification as a condition of being an approved supplier.
- Customer audits that benchmark your QMS against AS9100 clauses, even if they do not formally require certification.
- Industry schemes such as the IAQG OASIS database, where being listed as AS9100-certified simplifies qualification with multiple customers.
So while regulators rarely say “you must be certified to AS9100,” many aerospace supply chains treat AS9100 as a de facto minimum standard for complex or safety-critical work.
Where ISO 9001 fits
ISO 9001 is a generic quality management standard. In aerospace, it is often treated as:
- A baseline for management system structure and documentation.
- A lower bar than AS9100 for organizations doing less critical or non-flight work.
- A stepping stone for shops transitioning to AS9100 once they enter regulated aerospace programs.
Some programs or authorities will accept an ISO 9001-based system for certain work scopes, especially where the risk and regulatory exposure are lower. For higher-risk, safety-critical, or export-controlled work, primes often insist on AS9100.
Implications for regulated, long-life environments
If you operate in a brownfield environment with legacy QMS, MES, ERP, and PLM systems, shifting from ISO 9001-only to AS9100-aligned operations has practical consequences:
- Process changes and validation: AS9100 typically demands tighter configuration control, risk management, and production planning. Updating workflows, forms, and digital systems requires formal change control and, for regulated product, validation.
- Integration complexity: Proving conformity to AS9100 using legacy systems can require additional interfaces, reports, and evidence trails across MES, ERP, PLM, and QMS, not wholesale replacement. Full rip-and-replace strategies often stall under validation and downtime constraints.
- Evidence and auditability: You must be able to show objective evidence against AS9100 clauses (e.g., configuration management, risk, FAI, supplier control) using existing records and systems.
The choice is usually not “ISO 9001 or AS9100” in isolation, but “how far toward AS9100 expectations do we need to go to satisfy our specific customers and authorities, given our current systems and validation burden.”
Bottom line
- Regulators typically do not explicitly require AS9100 certification.
- They rarely require ISO 9001 either, but may reference it as an acceptable model.
- AS9100 requirements usually come from customer contracts and industry practice, not directly from regulation.
- Lack of AS9100 certification can still be a practical barrier to winning or retaining aerospace and defense work.
