Upgrading from ISO 9001 to AS9100 is usually an evolution, not a ground-up rebuild, but it is still a significant project. AS9100 keeps the ISO 9001 structure and adds aerospace-specific requirements, tighter controls, and more demanding evidence expectations. The real difficulty depends on how mature and disciplined your current ISO 9001 implementation is, not just on having a certificate.
What usually makes it “hard” or “easy”?
Factors that make the upgrade easier:
- Your ISO 9001 QMS is genuinely used to run operations, not just to pass audits.
- Risk-based thinking is already embedded in planning, change control, and NCR/CAPA.
- You have traceable configuration and revision control for drawings, work instructions, and bills of material.
- Supplier management already includes performance metrics, approval criteria, and documented oversight.
- Your MES/ERP/PLM/QMS systems can reliably produce records, histories, and audit trails.
Factors that make the upgrade harder:
- QMS documents mirror ISO clauses but do not match how work is actually done on the floor.
- Limited product or process traceability, especially for special processes or critical features.
- Weak or ad hoc supplier controls and limited visibility into sub-tiers.
- Multiple disconnected or paper-heavy systems so evidence is scattered and hard to reconstruct.
- Poor change control, with operators using work instructions, routers, and drawings that do not align.
Key AS9100 gaps compared with a typical ISO 9001 QMS
AS9100 adds and tightens requirements in areas that often expose gaps, even in certified ISO 9001 systems:
- Risk management and product safety: More explicit and formal risk management at the product, process, and change level, including operational risk and product safety considerations.
- Configuration management: Defined configuration baselines, controls for changes, and the ability to show which configuration was actually built and delivered.
- Special processes: Stronger controls and qualification for processes where output cannot be fully verified by later inspection (e.g., heat treat, welding, NDT, coatings).
- Counterfeit parts prevention: Policies, supplier controls, and incoming verification tailored to counterfeit risk.
- Supplier control: More stringent selection, monitoring, and flowdown of requirements, including risk-based controls and, in some cases, customer or regulatory requirements for specific sources.
- Human factors and ethics: Expectations around awareness, human factors, and reporting culture (e.g., nonconformities, safety, ethical behavior) are more explicit.
- Traceability: Deeper traceability and retention requirements for aerospace hardware and records, especially for critical characteristics and key process data.
Typical workplan and effort
Most organizations go through a structured upgrade process:
- Gap assessment: Map your existing ISO 9001 QMS against the current AS9100 revision. This should include document review, interviews, and at least some sampling of actual shop-floor work orders and records, not just procedures.
- Risk-based prioritization: Rank gaps by product risk, customer impact, and feasibility. Aerospace customers and regulators will care most about traceability, configuration management, special processes, and supplier control.
- Process and documentation updates: Update procedures, work instructions, forms, and records to address the gaps. In a brownfield environment, this often means aligning multiple existing systems rather than replacing them.
- Systems and integration changes: Configure existing MES, ERP, PLM, or QMS tools to capture required data, link records, and maintain audit trails. This may involve incremental digitization of travelers, inspection records, or FAI data rather than a full system replacement.
- Training and behavior change: Train engineers, operators, planners, buyers, and quality staff on new requirements and what changes in their daily work, not just on the standard’s clauses.
- Internal audits and corrective actions: Run internal audits against AS9100 requirements, close out findings, and demonstrate that the new processes are in stable use before any external assessment.
For an already disciplined ISO 9001 organization, this can be executed over several months with focused effort. For plants where ISO 9001 exists mostly on paper or where data and traceability are weak, this can extend well beyond a year and require phased changes, especially when constrained by limited downtime and validation requirements.
Brownfield and system-coexistence realities
Most aerospace and defense suppliers operate in brownfield environments where replacing core systems (ERP, MES, PLM, QMS) is costly, risky, and slow to qualify. Upgrading to AS9100 usually succeeds by:
- Layering additional controls and records on top of existing systems (e.g., digital or structured travelers, added inspection steps, controlled checklists).
- Strengthening document control and revision governance rather than swapping platforms.
- Using targeted integrations to close high-risk gaps in traceability, not trying to fully harmonize every data source at once.
- Validating and controlling changes carefully so that operational disruption, requalification, and compliance risk remain manageable.
Full QMS or MES replacement timed to an AS9100 upgrade often fails or overruns because of validation burden, downtime constraints, integration complexity, and the need to preserve long-term records. Incremental changes, carefully scoped and validated, are usually a lower-risk path.
Risks and failure modes to watch
Common problems when upgrading include:
- Clause-level focus only: Updating the quality manual while leaving unchanged the actual planning, scheduling, and execution practices that drive risk.
- Underestimating supplier-related work: Not allocating enough time to qualify suppliers, update flowdowns, and collect or generate required supplier records.
- Incomplete traceability: Being able to show procedures exist, but not being able to reconstruct which part, lot, or serial followed which revision and process path.
- Tool-only solutions: Assuming that buying a new software module will close process gaps without addressing ownership, training, and change control.
- Evidence gaps: Implementing new processes but not capturing robust, accessible records to demonstrate consistent use over time.
Practical expectation setting
If you have a genuinely functioning ISO 9001 system, you should expect non-trivial but manageable work: several months of focused process, document, and record changes, plus internal audits. If ISO 9001 is weakly implemented or your operations are complex (high mix, deep supply chain, special processes), the upgrade becomes a broader transformation in how you manage risk, configuration, and traceability, not just a documentation update.
