ISO 9001 vs AS9100: What Is the Difference? Aerospace and Defense Quality Standards

Short answer: The difference between ISO 9001 and AS9100 is scope and rigor. ISO 9001 is a general quality management system standard suitable for any industry. AS9100 contains all of ISO 9001:2015 and adds roughly 100 requirements specific to the aerospace, space and defense sector: configuration management, risk and product safety, counterfeit-part prevention, first article inspection (FAI), special processes and end-to-end traceability. In short, every AS9100 includes ISO 9001 — but not every ISO 9001 is AS9100.

One of the most common questions manufacturers ask before entering the aerospace and defense supply chain is: “We already have ISO 9001 — do we really need AS9100 too?” This guide breaks down the difference between ISO 9001 and AS9100 point by point: which extra requirements AS9100 adds, which companies need it, and how an ERP system makes that compliance sustainable.

What Is ISO 9001?

ISO 9001 is the industry-agnostic quality management system (QMS) standard published by the International Organization for Standardization (ISO). Its current version is ISO 9001:2015. It is built on the process approach, risk-based thinking, customer satisfaction and continual improvement (the PDCA cycle), and can be applied by organizations of any size, from manufacturing to services.

What Is AS9100?

AS9100 is the quality management system standard developed for the aerospace, space and defense (AS&D) sector. It is published by the International Aerospace Quality Group (IAQG), and its current version is AS9100 Rev D. AS9100 contains every clause of ISO 9001:2015 as-is and adds sector-specific requirements on top. Its European counterpart is EN 9100 and its Asian counterpart is JISQ 9100; all three share the same core content.

For a deeper look, see our guide: What is AS9100? Aerospace and defense quality management system.

What Are the Key Differences Between ISO 9001 and AS9100?

The table below summarizes the core differences:

Criterion	ISO 9001:2015	AS9100 Rev D
Scope	All industries (general)	Aerospace, space, defense
Publisher	ISO	IAQG
Core content	General QMS requirements	ISO 9001 + AS&D requirements
Configuration management	Not required	Required
Risk & product safety	General risk-based thinking	Operational risk + product safety
Counterfeit-part prevention	None	Required
First article inspection (FAI)	None	Required (AS9102)
Special processes	General	Separate control (e.g., NADCAP)
Traceability	When appropriate	Serial/lot level, advanced
On-time delivery (OTD)	Indirect	Measured mandatory KPI

What Extra Requirements Does AS9100 Add on Top of ISO 9001?

The main additional requirements AS9100 introduces over ISO 9001 are:

• Configuration management: Disciplined control of BOMs and revisions (ECN/ECO). See: configuration management (ECN/ECO).
• Risk management and FMEA: Systematic analysis of operational risks. See: What is FMEA?.
• Product safety: Management of safety-critical characteristics.
• Counterfeit-part prevention: Supply-chain security, especially for electronic components.
• First article inspection (FAI / AS9102): First-article approval for new or changed parts.
• Special processes: Extra oversight of heat treatment, welding, plating, etc.
• Traceability: Serial and lot-level, end-to-end recording. See: serial number tracking and traceability.
• On-time delivery and quality performance: Measured and reported KPIs.

Which Companies Need AS9100 Certification?

AS9100 is usually mandatory for:

• Suppliers making parts or sub-systems for aerospace OEMs (Boeing, Airbus, etc.)
• Sub-contractors in the supply chains of defense prime contractors
• Manufacturers whose exports fall under ITAR/EAR export control
• Defense suppliers doing CNC machining, assembly, composites and electronics production

For a company serving only local commercial customers, ISO 9001 may be enough — but the moment you enter the aerospace-defense chain, AS9100 is effectively an entry ticket.

How Do You Transition from ISO 9001 to AS9100?

For a company that already holds ISO 9001, a typical transition looks like:

1. Gap analysis: Comparing the existing QMS against the AS9100 additional requirements.
2. Updating processes: Adding configuration, risk, FAI, traceability and special-process controls.
3. Documentation and record infrastructure: Establishing a record system that produces evidence.
4. Internal audit and management review.
5. Certification audit: Stage 1 and Stage 2 audits with an accredited body; the record is entered into the OASIS database.

How Does ERP Simplify AS9100 Compliance?

Most AS9100 additional requirements demand disciplined records and traceability; running them on spreadsheets creates major audit risk. An ERP system secures these processes.

The HarmonyERP quality management module offers capabilities that map directly to AS9100 requirements:

• Control plans and inspection records
• Nonconformance management and corrective/preventive action (CAPA)
• FMEA and risk analysis
• SPC / Cpk-Ppk statistical process control
• Periodic calibration tracking — see: calibration tracking
• Supplier quality management and documentation
• Single-database integration with production, procurement and inventory

This lets NATO AQAP audit preparation and AS9100 audits be completed in hours instead of days. For the bigger picture, see: ERP for the defense industry.

Common Mistakes

• Assuming “ISO 9001 is enough”: Aerospace-defense customers usually require AS9100 as a contract condition.
• Skipping FAI and configuration: These are the most common AS9100 audit stumbling points.
• Leaving traceability for later: Without serial/lot records, recalls and audits cannot be managed.
• Keeping calibration and CAPA records scattered: If no evidence can be produced, nonconformity is inevitable.

Frequently Asked Questions (FAQ)

Can ISO 9001 and AS9100 be obtained at the same time? Because AS9100 already contains all of ISO 9001:2015, a company certified to AS9100 also meets ISO 9001 requirements; most organizations certify both in a single audit.

Does AS9100 replace ISO 9001? In scope, yes: if you hold AS9100 you don’t separately need ISO 9001, because AS9100 includes it.

What is the current version of AS9100? The current version is AS9100 Rev D (AS9100D:2016). Its European equivalent is EN 9100.

Is ERP mandatory for AS9100? It is not mandatory; however, running configuration, traceability, CAPA and calibration records manually increases audit risk. ERP secures these records.

Can an SME-scale supplier achieve AS9100? Yes. With the right processes and record infrastructure, small suppliers get certified too; HarmonyERP provides that infrastructure.

Conclusion

The difference between ISO 9001 and AS9100 is fundamentally one of scope and rigor: AS9100 adds aerospace- and defense-specific traceability, configuration, risk and safety requirements on top of ISO 9001. For any manufacturer aiming to join the aerospace-defense supply chain, AS9100 is a must — and the right ERP infrastructure makes that compliance sustainable.

Want to secure your AS9100 processes with the HarmonyERP quality module? Request a free demo or request a quote.