How to get AS9100 certified as a small startup

A small startup gets AS9100 certified in five moves: define a scope that matches the work you really do, build a lean quality management system that meets every requirement of the standard, run it long enough to produce records, complete an internal audit and a management review, and pass the two-stage audit of an accredited certification body. The certification body then registers your certificate in OASIS, where primes and Tier 1 customers check it. None of this needs a large quality department; it needs discipline, evidence and a scope you can defend.

What is AS9100 and why do primes ask for it?

AS9100 is the quality management system standard for aviation, space and defence organisations. Its current revision, AS9100D, takes every requirement of ISO 9001:2015 and adds the ones aerospace customers rely on, such as product safety, configuration management, prevention of counterfeit parts, risk management in operations and monitoring of on-time delivery.

The same standard is published under different names by region. In Europe it is EN 9100, maintained through ASD-STAN, the Brussels-based standards body of the European aerospace and defence industry. Related standards cover other activities: 9110 for maintenance organisations and 9120 for distributors.

Primes and Tier 1 suppliers ask for it because it lets them trust a supplier's process without auditing it themselves. For a startup, the certificate is often what moves a company from "interesting technology" to "approved source".

What does AS9100 add to ISO 9001?

Most of the effort for a startup goes into the requirements that ISO 9001 does not have. In AS9100D the main additions sit in these clauses:

For a design-only startup, configuration management and risk management are usually the biggest new pieces of work. For a small manufacturer, it is supplier control, special processes and first article inspection.

Is your startup ready for AS9100?

Certification bodies certify a system that works, not a set of documents. Before you book an audit, check honestly where you stand.

If most rows show gaps, plan several months of operating the system before the audit. The calendar time is usually set by records, not by writing procedures.

How does the certification process work?

1. Define the scope

Decide which products, services and sites the certificate covers. A startup that designs and builds a sensor includes design and development; one that only machines to customer drawings may justify design requirements as not applicable. Be precise: customers read the scope line on the certificate, and an inflated scope means more audit days and more requirements to prove.

2. Build a lean quality management system

Write what you do, then do what you wrote. For a small company, a short quality manual, a process map and a handful of procedures for the aerospace-specific topics are often enough: configuration management, first article inspection, nonconforming product, counterfeit parts prevention, supplier control and product safety. Use the tools you already have, such as your project management or ERP system, to hold the records.

3. Run the system and collect evidence

Let the system work on real orders, prototypes or development projects. Log nonconformities and corrective actions, measure on-time delivery and product conformity, and train the people who use each process. Auditors look for evidence that the system influences decisions.

4. Internal audit and management review

Audit every requirement at least once, ideally with someone who did not write the procedures, and close the findings. Then hold a management review that looks at the data: customer feedback, process performance, audit results, risks and resources.

5. Choose an accredited certification body

Pick a certification body that is accredited for the 9100 series under the aerospace industry's certification scheme. In Belgium, accreditation of certification bodies is handled by BELAC, the national accreditation body within the FPS Economy; certification bodies from other countries operate under their own national accreditation. Ask for a quote based on your headcount, sites and scope, since audit duration depends on them.

6. Stage 1 and stage 2 audits

The stage 1 audit checks your documentation, scope and readiness. The stage 2 audit checks implementation on the floor and in the records. Major nonconformities must be closed before a certificate is issued.

7. Registration in OASIS and surveillance

The certification body registers the certificate and audit results in OASIS, the Online Aerospace Supplier Information System. Your company appoints an OASIS administrator so you can manage your own entry. After certification, surveillance audits follow during the certificate cycle and a recertification audit before it expires.

What might a twelve-month plan look like?

The calendar depends on how much of the system already exists. As an illustration, a ten-person company starting from little more than good engineering habits could plan like this:

Companies with an ISO 9001 system already in place can usually compress the first phases, because the base processes, internal audit and management review already exist.

What determines the cost?

There is no fixed price. The certification body's fee depends on audit duration, which depends on headcount, number of sites and scope, so ask several accredited bodies for quotes on the same scope. The larger cost for a startup is internal time: someone has to own the system, write the procedures and keep the records. A consultant can shorten the design phase, but the system still has to be run by the people who do the work, or it will not survive the stage 2 audit.

Which related standards will customers ask for?

AS9100 is often the first of several requirements. Customers commonly add:

• First article inspection following AS9102, which sets the format for proving a new or changed part conforms.
• Advanced product quality planning following AS9145, increasingly asked for in new programmes.
• NATO quality requirements. For defence contracts, the buyer may cite AQAP 2110, NATO's quality assurance requirements for design, development and production. Edition D, Version 1 (2016) builds on ISO 9001:2015 and adds NATO-specific requirements such as access for government quality assurance representatives, quality plans and configuration management plans. It applies through the contract, and NATO countries record their agreement to use it in STANAG 4107.

An AS9100 system covers much of what AQAP 2110 asks, so a defence-oriented startup that builds its system on AS9100 is well placed to accept an AQAP clause in a contract.

Is a new version of the standard coming?

Yes. The International Aerospace Quality Group, which owns the 9100 content, plans to renumber the next revision as IA9100. NASA's quality office reported in April 2024 that the publication estimate had moved to the fourth quarter of 2026, following the revision schedule of ISO 9001, and that candidate themes included advanced product quality planning, cyber and data security and foreign object debris. Certify against the current revision now; certification bodies announce transition periods when a new revision is published, and a working system adapts more easily than a new one.

How do you prepare for the audit days?

Auditors sample. They pick an order, a part or a project and follow it through the system, so preparation means making sure any thread they pull holds together.

• Trace one order end to end yourself before the audit: contract review, planning, purchasing, production or design, inspection, delivery and invoicing.
• Check that every record has an owner and a date, and that the version of each document in use is the current one.
• Brief the people who do the work. Auditors ask operators and engineers, not only the quality lead, how they know what to do.
• Have the numbers ready: on-time delivery, conformity, open corrective actions, supplier performance.
• Close or plan every internal audit finding, with evidence.
• Keep the scope statement on the table, so questions about what is in and out are answered consistently.

Minor findings at stage 2 are normal; a credible corrective action plan closes them. Major findings delay the certificate, which is why the internal audit before should be as demanding as the real one.

Which mistakes cost startups the most time?

• Starting with documents instead of processes. Templates bought online rarely match how a startup works and fail at stage 2.
• A scope that is too wide. Including design, production and repair when you only do one of them multiplies requirements and audit days.
• No records. Booking the audit before the system has run produces findings that delay the certificate.
• Ignoring flow-down. Aerospace customers expect their requirements, such as special processes or key characteristics, to reach your own suppliers.
• Treating it as a one-off. Surveillance audits test whether the system keeps working.

AS9100 or ISO 9001 first?

For a company that targets aerospace or defence customers, going straight to AS9100 avoids a second transition. Because AS9100 contains ISO 9001 in full, one system and one audit cover both. ISO 9001 alone can make sense when aerospace is a small share of the business and customers do not require 9100.

How can a cluster help?

Certification is a gate to supplier qualification, not the end of it. FADEC offers a Capability Qualification Review as an optional membership module: AS9100 or EN 9100 readiness and preparation for a prime's supplier audit. Its Advisory Committees also cover standards and certification. If you are preparing for a first prime contact, read how to pitch to Airbus Defence and Space as a startup.

Quick answers

Is AS9100 the same as EN 9100? They are regional publications of the same aerospace quality standard: AS9100 in the Americas through SAE, EN 9100 in Europe through ASD-STAN and CEN, and JISQ 9100 in Asia.

Can a startup with ten people get AS9100 certified? Yes. The standard does not set a minimum size. What matters is that the quality system covers the real scope of work and has been running long enough to produce records, an internal audit and a management review.

Do I need ISO 9001 before AS9100? No separate ISO 9001 certificate is needed. AS9100 includes all ISO 9001 requirements, so one system and one audit cover both.

Where can a customer check my AS9100 certificate? Accredited certification bodies register 9100-series certificates in OASIS, the Online Aerospace Supplier Information System run by the aerospace quality group IAQG.