How long should aerospace NCR records be retained to satisfy AS9100 and regulatory audits?

AS9100 does not set one universal retention period for aerospace NCR records. To support AS9100 and regulatory audits, retain NCR records for the longest applicable requirement from your documented QMS retention schedule, customer contract and flowdowns, regulatory obligations, and internal risk-based policy. In aerospace, ten years is common, but it is not a safe universal answer. Some programs, safety-critical parts, serialized assemblies, life-limited items, concessions, and MRB decisions may require much longer retention.

What AS9100 actually expects

AS9100 requires organizations to control and retain documented information needed as evidence of conformity and effective quality system operation. For nonconforming outputs, the record normally needs to show what was nonconforming, what action was taken, whether a concession was granted, who authorized the disposition, and what follow-up was required.

The standard expects your organization to define retention and disposition controls. An auditor will usually look for a documented retention schedule, evidence that records are retrievable and protected, and consistency between the policy, contracts, customer requirements, and actual system behavior. AS9100 certification does not remove the need to meet customer-specific or authority-specific record rules.

Use the longest applicable retention requirement

A practical aerospace retention rule is to keep NCR records for the longest of the following:

• Your approved QMS record retention procedure.
• Customer purchase order, quality clause, supplier manual, or contract flowdown.
• Applicable aviation, defense, space, or national authority recordkeeping requirements.
• Program-specific requirements for serialized, critical, flight, safety, or life-limited parts.
• Internal requirements tied to warranty, field performance, escape management, CAPA, or risk history.

If these sources conflict, the shorter period should not be used without documented review and, where required, written customer or authority approval. Disposal should also be controlled; deleting old records because a system storage limit was reached is not a defensible retention process.

What must be retained

For audit purposes, retaining only a PDF summary of the NCR is often not enough. The useful record package may include the NCR, affected part numbers, serial numbers or lots, operation and work order references, inspection results, photos, attachments, MRB disposition, concession or use-as-is approvals, rework or repair instructions, supplier communications, CAPA links, approvals, electronic signatures, and audit trail history.

This matters in brownfield environments because NCR evidence may be split across QMS, MES, ERP, PLM, document control, supplier portals, email, and shared drives. The retention plan has to cover the whole evidence chain, not just the primary NCR screen in one application.

Common failure modes

The most common failure is assuming that a generic ten-year rule satisfies every aerospace program. It may satisfy some customer requirements, but it may be too short for product families with long service lives, regulatory traceability expectations, or customer-mandated lifetime retention.

Another common failure is losing context during system replacement. Full replacement of QMS, MES, ERP, or PLM platforms is often unrealistic in regulated aerospace operations because of validation cost, qualification burden, integration complexity, downtime risk, and long asset lifecycles. If systems are upgraded or retired, organizations usually need a validated migration, controlled archive, or read-only legacy access that preserves record integrity, signatures, links, timestamps, and audit trails.

Retention clocks should also be defined clearly. Some organizations count from NCR closure, some from shipment, some from contract closeout, and some from product retirement or end of service. The correct trigger is usually driven by contract language, customer requirements, and the approved QMS procedure.

Practical answer

If there is no explicit customer or regulatory rule, many aerospace manufacturers set a minimum such as ten years for NCR records. That can be a reasonable baseline only if it is documented, approved, consistently applied, and not overridden by higher-risk product, program, or customer requirements. For critical or serialized hardware, MRB dispositions, concessions, and records tied to fielded aircraft or defense programs, a longer period should be expected unless the applicable requirements clearly allow otherwise.