The short version of the as9100 vs iso 9001 differences question is simple. ISO 9001 is the general quality management standard that any manufacturer can adopt, while AS9100 is the aerospace version of that same standard, carrying all of the ISO 9001 requirements plus a large set of extra rules for flight-critical and defense work. If you build parts that go into an aircraft, a missile or a satellite, your customer will almost certainly require AS9100 rather than plain ISO 9001. If you build plastic housings, packaging film or industrial components with no aerospace customer on the books, ISO 9001 is the standard that matches your business.
That framing matters because the two are not competing systems. AS9100 was built by taking the ISO 9001:2015 text and appending aerospace requirements to it, so a good AS9100 quality management system already satisfies ISO 9001 in substance. The decision you are really making is how much extra rigor your customer base requires, and how much of that rigor you want to carry into work that has nothing to do with aviation.
Below I break down the differences clause by clause, cover audits and certification, and give a decision framework you can apply to your own shop or supplier network.
Table of Contents
- AS9100 vs ISO 9001 Differences at a Glance
- What Is the Difference Between ISO 9001 and AS9100?
- Industry Scope and Applicability
- Quality-System Requirements
- Process Control and Risk-Based Thinking
- Documentation and Record-Keeping Burden
- Supplier and Subcontractor Requirements
- Audit, Certification and Accreditation Requirements
- Implementation Time, Cost and Practical Impact
- Which Should You Choose?
- Frequently Asked Questions
- Conclusion
AS9100 vs ISO 9001 Differences at a Glance
Here is the comparison most quality managers want first. Read down the Extra requirements and Documentation rows, because those two lines explain almost every practical difference you will run into.
| Criterion | ISO 9001 | AS9100 |
|---|---|---|
| Purpose | Prove an organization can manage quality consistently | Prove an organization can produce flight-critical and defense hardware to a documented, traceable standard |
| Industry scope | Any sector, from food packaging to medical devices | Aviation, space and defense, plus suppliers into those industries |
| Baseline relationship | The base standard | Reproduces ISO 9001 clause for clause, then appends aerospace requirements in bold or italic text |
| Extra requirements | None beyond ISO 9001 | Operational risk management, product safety, counterfeit parts prevention, configuration management, special requirements, key characteristics, human factors in key processes |
| Risk approach | Risk-based thinking, largely self-directed and qualitative | Formal operational risk management feeding prevention, FMEA and process validation |
| Documentation | Documented information to support the system, no fixed retention detail | Added traceability, retention and control of records, including lot-level records and product transfer records |
| Audits and certification | Certification by any accredited certification body | Certification by an OASIS-accredited certification body, listed in the IAQG database, with aerospace-trained auditors |
| Supplier flow-down | Control of purchased products, flow-down where needed | Explicit flow-down of aerospace requirements to suppliers and mandated supplier approval and monitoring |
The table is a summary. The rest of this guide explains why each row matters and what it looks like inside a real quality management system.
What Is the Difference Between ISO 9001 and AS9100?
ISO 9001 is an international standard published by the International Organization for Standardization. It sets out the requirements for a quality management system: the policies, objectives, responsibilities, documented information and processes an organization needs in place to consistently produce goods and services that meet customer and regulatory requirements. It says nothing about your industry, your product or how hard your product is to make.
That last point is exactly why a second standard exists. The same ISO 9001 system can look completely different at a commercial food plant and at a shop machining titanium blade retainers, and ISO 9001 itself does not care. Aviation and defense customers cared. They wanted extra controls that a general manufacturing standard leaves optional.
AS9100 is the result. The International Aerospace Quality Group, the industry body behind the standard, takes the ISO 9001:2015 text and reproduces it without deleting clauses, then adds requirements specific to aerospace. Current revision is AS9100 Rev D, published in 2016 and aligned to ISO 9001:2015. Europe and several other regions use the equivalent EN 9100 designation, and work continues toward a harmonized international aerospace standard under the IA9100 name, so check with your certification body and customer on which designation they require.
Two practical consequences follow from that construction. First, you do not choose between the clause structures; AS9100 keeps the familiar Plan-Do-Check-Act shape and adds to it. Second, an ISO 9001 certificate is not a shortcut to AS9100, because the additions are where the certification effort actually sits.
Industry Scope and Applicability
ISO 9001 fits organizations that want a disciplined quality system without an external regulator or prime contractor dictating the details. Injection molders, extrusion shops and packaging converters land here naturally, along with machine shops, fabricators and service businesses. If you have read our guide to extrusion vs injection molding differences, you already know how much process variation this kind of shop manages; ISO 9001 gives you the structure to document it, and it stops there.
AS9100 fits organizations whose output ends up where failure is expensive in a way that is hard to reverse. That includes airframe and engine manufacturers, avionics and component suppliers, space hardware builders, defense contractors, and the maintenance, repair and overhaul providers who keep those systems flying. It also covers distributors who handle aerospace parts, though those organizations usually hold AS9120 rather than AS9100.
The boundary question for a lot of suppliers is whether aerospace work is incidental or central. A job shop that runs one small aerospace program next to a mostly commercial book of business can qualify, but it will carry aerospace requirements across the whole system rather than running a separate one. Shops where aerospace demand is the growth plan get a better return by building aerospace requirements into the system from the start.
Automotive suppliers face a parallel situation and often the same confusion about layering standards. Our piece on IATF 16949 vs ISO 9001 differences explained covers that logic in detail, and the shape of it is identical: an industry standard sits on top of the ISO 9001 framework and adds sector-specific demands.
Quality-System Requirements
Both standards share the same foundation. Context and scope of the quality management system, leadership and commitment, planning, support, operation of processes, performance evaluation and improvement. In practical terms, you still need documented information control, competency requirements, communication rules, internal audits, management review and a method for controlling nonconforming outputs and corrective action.
The as9100 vs iso 9001 differences show up in what gets added on top of that foundation, and the additions cluster around three ideas: anticipate failure, prove what you built, and never let an unverified part move.
What AS9100 Adds That ISO 9001 Does Not Require
Product safety. AS9100 requires the organization to determine whether its products and services can affect safe operation or personal safety, and where they can, to plan and carry out processes that prevent or reduce those effects. A plastic housing maker can skip that analysis. A supplier of pressurised or flight-critical assemblies cannot.
Ethical behavior. AS9100 states that the organization shall consider the impact of its activities on the workforce and take appropriate action to prevent and mitigate negative effects, including considerations of impartiality and the influence of others. Audit teams ask how, not just whether.
Counterfeit parts prevention. Where counterfeit or suspect parts could enter the supply chain, AS9100 requires a process to prevent detection of counterfeit parts, prevent their delivery, control or handle them if they are found, and train personnel on the risks. This sits alongside supplier approval and product traceability controls.
Configuration management. AS9100 requires identification and control of configuration, including baselines, status accounting and configuration audits. For most organizations that means managing which revision of which drawing and specification a part was built to, and proving it later.
Special requirements and key characteristics. Products and processes can carry special requirements that go beyond the standard. Those must be identified in the product and process information, and the results recorded so conformity can be demonstrated. Key characteristics, those features tied to fit, form, function or safety, get the same treatment.
Work transfer and human factors. AS9100 adds requirements for control of work transfers and for considering human factors in key processes, including recognition of roles, workload, communication and the effect on product conformity. In practice this turns into clearer work instructions and fewer errors caused by fatigue or ambiguity.
None of these additions change the ISO 9001 framework underneath. They expand it, which is why an organization moving up to AS9100 is extending an existing system rather than replacing it.
Process Control and Risk-Based Thinking
ISO 9001 asks organizations to determine the risks and opportunities that could affect conformity and customer satisfaction, and to plan actions to address them. In practice most systems handle this as a general list of business risks reviewed once a year.
AS9100 raises the bar at the operational level. It requires determination of operational risks related to realization of intended products and services, and it ties those risks to the planning for product realization, process validation and the control of changes. Risk work feeds prevention rather than sitting in a register.
The tools differ too. Failure Mode and Effects Analysis is common practice in aerospace organizations, either as a standalone study or as the analysis phase of a process FMEA. Process validation requirements mean special processes get verified or validated, with revalidation triggered by changes in process, equipment, material, personnel or supplier changes.
Nonconforming outputs get similar treatment. Both standards require identification, control and disposition, with the AS9100 addition that nonconforming product shall be recorded and the records retained. Action taken on nonconforming product shall be proportionate to the effects of the nonconformity, which is a direct product-safety link.
On supplier oversight, ISO 9001 requires the organization to verify that purchased products meet requirements, and to let its suppliers know what it expects. AS9100 spells out an approval process for suppliers whose products affect conformity, documented criteria, information communicated to suppliers, and monitoring of supplier performance. The gap between those two statements is the difference between asking for a certificate and verifying it.
Documentation and Record-Keeping Burden
This is where the difference is most visible to anyone who has to run the system day to day. ISO 9001 requires documented information to support operation of processes and provide confidence in conformity, but it deliberately leaves the volume and format to the organization.
AS9100 keeps that structure and adds record-keeping specifics. Records have to show conformity of products and services, the people who authorised and performed work, and management responsibility. Where needed, the organization documents the results of review and the actions taken, and manages documented information to assure availability, protection and retention for defined periods.
In an aerospace shop that retention requirement turns into practice. You keep inspection records, material certifications, traceability links between a part and the material lot it came from, heat treat and coating certificates, tool calibration status and results of destructive testing. When a customer asks for the history of a part built three years ago, somebody has to be able to find it.
Quality managers who come from ISO 9001 backgrounds often assume the paperwork is bureaucratic overhead. The counter-argument is worth taking seriously in flight-critical work: the records are the evidence, and in a dispute or an investigation, evidence is what you are judged on. Lean quality managers have pointed out publicly that organizations with well-run, lean documentation systems move through AS9100 transitions faster and cheaper than organizations carrying bloated document sets.
What does not work is copying an ISO 9001 manual, changing the cover page, and calling it an AS9100 system. The auditor will find the additions, and the finding will still be there later.
Supplier and Subcontractor Requirements
Both standards treat purchased products as part of your own conformity story. The difference is how prescriptive AS9100 becomes and how far up your supply chain the expectations reach.
AS9100 requires the organization to ensure that suppliers of product and services conform to requirements, to establish criteria for supplier evaluation, selection, monitoring of performance and re-evaluation, and to communicate requirements to suppliers through purchasing documents. It also requires flow-down of relevant requirements to suppliers, so the obligations do not stop at your receiving dock.
What that looks like from the buying side: your prime contractor or their customer may require you to audit your own suppliers, keep a list of approved sources, or submit supplier surveillance data through their system. Flow-down clauses in your purchase orders then push the same obligations down to your machining shop and heat treater. If you subcontract plating, NDT or a calibration service, that work needs controls proportionate to the risk, including control of work transfers when a process moves between sites.
Traceability is the other half. Certification of conformity for delivered product, information about the design authority for design work, and lot- and serial-level records where required are all part of the AS9100 expectation. Document control needs to reach suppliers too, so that the revision of a specification a supplier is building to is the one you intended.
Suppliers selling into this environment should expect to be audited on things that never came up during an ISO 9001 audit: how you verify that what you received is genuine, what your calibration program covers, and whether your quality records would survive a random part request two years from now.
Audit, Certification and Accreditation Requirements
The audit structure is similar in shape and different in rigour. Both standards require internal audits at planned intervals covering the full extent of the system, plus a management review covering suitability, adequacy and effectiveness. External certification follows the same two-stage pattern: a Stage 1 readiness review of documentation and readiness, and a Stage 2 certification audit of the implemented system, followed by surveillance audits to keep the certificate active.
The aerospace difference sits in the certification body and the auditor competency. ISO 9001 certificates can be issued by any certification body accredited for that standard under an ISO/IEC 17021 scheme. AS9100 certificates must be issued by a certification body accredited by an IAQG member accreditation body, listed in the Online Aerospace Supplier Information System database, and staffed with auditors trained in the standard. That accreditation requirement is one reason AS9100 certification costs more and why availability of auditors can stretch timelines.
Certification bodies that offer ISO 9001 but not AS9100 are common enough that organizations have switched provider at the Stage 1 stage to avoid paying twice. Ask for the OASIS listing before signing, not after.
Auditor supply is a practical constraint. Aerospace-trained assessors are a small pool, and some regions have reported shortages at their accreditation bodies. Where that is true locally, booking the Stage 1 and Stage 2 dates early matters more than almost anything else you can do for the schedule.
Implementation Time, Cost and Practical Impact
Anyone quoting a single price or a fixed number of weeks for AS9100 certification is guessing. Costs and durations depend far more on how close your existing system already is than on the size of the company.
The cost drivers, in rough order of weight, are consultant and registrar fees, the internal labor needed to write and update documented information, training for auditors and operators, added inspection and test capacity including any new measurement equipment, supplier oversight work, and the corrective action that follows any nonconformity raised at Stage 1 or Stage 2. For a small manufacturer with no formal QMS, the labor and training terms dominate. For an organization already holding ISO 9001 with mature procedures, the registrar fees and the aerospace-specific additions dominate. Get itemized quotes for both and compare like for like.
Timelines follow a similar logic. Preparation and gap analysis come first, then implementation, then internal audit, then the two external stages, with surveillance starting after certification. Organizations starting from ISO 9001 usually find that a meaningful share of the ISO 9001 documentation survives, but the aerospace additions consume more calendar time than the core system did. Shops that treat aerospace work as a program with named owners and dated deliverables move faster than shops that try to absorb it into everyone’s day jobs.
One operational risk is worth naming directly: implementation effort lands on people who are also running production. Quality managers routinely describe that as the hardest part, not the standard itself. Protect the lead quality person’s capacity or the schedule slips quietly.
Which Should You Choose?
Use the customer, not the industry label, as your starting test. Look at your contracts, your purchase orders and your flow-down clauses. If a customer or a prime contractor above you names AS9100, AS9120 or an equivalent aerospace requirement, you have no real choice; ISO 9001 alone will keep you off the approved supplier list.
Choose ISO 9001 when your customers are commercial and generic, you sell into plastics, packaging, industrial or service markets, you want a working quality management system for internal reasons such as consistency and cost of quality, and no regulator or contract requires anything aerospace. Most manufacturers in that position will never need more.
Choose AS9100 when aerospace or defense is a real part of your revenue, your products are flight-critical or defense-critical, your customer base treats certification as a precondition for business, or your supply chain demands it from you. In that situation AS9100 is not a quality upgrade, it is a license to bid.
Take the staged path when you are a general manufacturer targeting aerospace. Hold ISO 9001 while you land the first aerospace work, use the ISO system to build the operational discipline, then run a documented gap analysis against AS9100 and upgrade once the aerospace revenue justifies the investment. That sequence is common and it works, because the ISO 9001 groundwork is genuinely reusable.
A word on dual certification, since shops ask about it often. ISO 9001 and AS9100 can coexist as one integrated quality management system, since AS9100 already contains ISO 9001’s requirements. Many aerospace organizations maintain a single system and hold one AS9100 certificate. Running two fully separate systems for the same plant is possible but usually wasteful; if your board asks, the better answer is an integrated system with a documented scope statement covering both commercial and aerospace work.
Finally, do not expect AS9100 to do another job’s work. It is a quality management system, not an export control regime and not a cybersecurity certification. If your customers mention ITAR, EAR or CMMC, those are separate obligations with separate frameworks, and they will ask for evidence specific to them.
Frequently Asked Questions
Can a company be AS9100 certified without ISO 9001?
Yes, and most aerospace organizations hold only an AS9100 certificate. AS9100 contains all of the ISO 9001 requirements, so a successful AS9100 audit already demonstrates conformity to ISO 9001. You do not need a separate ISO 9001 certificate first, though an existing one shortens the gap work considerably.
Is AS9100 higher than ISO 9001?
It is stricter and narrower at the same time. AS9100 keeps the ISO 9001 clause structure and adds operational risk management, product safety, counterfeit parts prevention, configuration management and special requirement controls. ISO 9001 covers more industries with less obligation, so neither is simply a harder version of the other.
Do we keep our ISO 9001 certificate after getting AS9100?
It depends on your contract needs and your scope. If AS9100 covers the same sites and activities, many organizations let the ISO 9001 certificate lapse because the AS9100 certificate already covers those requirements. Keep both when commercial customers or other regulators specifically ask for an ISO 9001 certificate by name.
Should we use AS9110 or AS9120 instead of AS9100?
Pick the standard that matches what you actually do. AS9110 is written for maintenance, repair and overhaul organizations. AS9120 adds distribution requirements such as handling, storage, traceability of product status and control of customer property. Manufacturers of new parts, including fabricators and machine shops, hold AS9100.
How long does AS9100 certification take?
Most organizations land somewhere between six months and two years from first gap analysis to certificate, and preparation work often starts earlier. The gap between those ends is driven by how developed your quality system already is and by auditor availability in your region, which is worth checking early.
Does AS9100 satisfy ITAR and CMMC requirements?
No. AS9100 addresses quality, and it covers some supplier and information controls as a byproduct, but it is not an export control standard and it is not a cybersecurity framework. ITAR and EAR obligations come from export regulations, and CMMC is a separate cybersecurity certification for controlled unclassified information.
Conclusion
ISO 9001 gives any manufacturer a workable quality management system, and AS9100 gives the same framework plus the aerospace requirements that flight-critical and defense work demands. Choose based on your contracts and your customer base rather than on ambition or on what a peer company did last year.
Start by pulling your active purchase orders and top ten customer contracts and reading the certification language in each one. If aerospace or defense requirements show up there, begin a documented gap analysis against AS9100 and confirm your registrar is OASIS-accredited before you commit to a schedule.