AS9100 Certification: A Step-by-Step Guide for First-Time Aerospace Suppliers

AS9100 certification proves your quality management system meets the aerospace industry's requirements, and for a first-time supplier the path runs through five clear stages: build the system, use it long enough to generate evidence, run internal audits and a management review, pass a two-stage external audit, then close any findings. Most SMEs reach certification in roughly nine to fifteen months from a standing start. Having audited and implemented to this standard for years, I want to walk you through each stage in plain terms in this AS9100 certification guide, and flag the mistakes that cost first-timers the most time.

What AS9100 actually is

AS9100 is the aerospace sector's quality management standard, published by the IAQG (International Aerospace Quality Group) and known in Europe as BS EN 9100. It takes the full text of ISO 9001 and adds requirements specific to aviation, space and defence: tighter control of risk, configuration management, counterfeit-part prevention, product safety, first-article inspection and traceability of parts and processes.

The point is confidence. When a prime contractor sees an AS9100 certificate from an accredited body, they know your business runs to a controlled, auditable system rather than the memory of one experienced person. For many aerospace tenders, certification is not a nice-to-have; it is the entry ticket.

Certification is awarded by an independent certification body, not by a consultant and not by a customer. Recognised certificates are logged on the OASIS database maintained by the IAQG.

Be honest about the size of the jump

Most SMEs I meet already hold ISO 9001, and they assume moving up to BS EN 9100 is a modest step. It is not. We usually say the jump is the equivalent of going from GCSE to Master's level. Same subject, a different order of rigour.

Here is a reality check I find lands well. A typical SME ISO 9001 audit takes about one day. An AS9100 audit for a comparable business is nearer three. That gap in audit duration is a fair proxy for the gap in work behind it: three times the assessment because there is a great deal more system to assess and evidence to examine. First-timers consistently underestimate this, and the underestimation bites hardest when a customer or a prime has prescribed the certificate on a fixed timescale. The commercial pressure is real, but the standard does not bend to it.

The stages to certification

Getting there is a sequence, and skipping steps rarely ends well.

1. Scope and gap analysis. Decide which sites and activities the certificate will cover, then compare what you do today against the standard. The gaps become your project plan.
2. Build and document the system. Write the processes, quality policy, objectives and procedures your business genuinely uses. Right-size them; a fifteen-person machine shop does not need a multinational's manual.
3. Implement and generate evidence. Run the system in earnest. Certification bodies want to see records showing the system has been working for a meaningful period, typically at least three months.
4. Internal audit and management review. Audit your own processes against the standard, log the findings, and hold a formal management review where leadership examines performance and decides on actions.
5. External certification audit. The certification body runs a Stage 1 (readiness and documentation review) followed some weeks later by a Stage 2 (a full on-site audit of the system in action). Clear any non-conformances raised and the certificate is issued.

After that, surveillance audits keep the certificate live, usually annually, with a full recertification around every three years.

A realistic timeline

First-timers consistently underestimate the calendar. As a rough, illustrative shape for a small supplier:

• Months 1–3: scope, gap analysis, project plan, early documentation.
• Months 3–7: build out processes and start operating them.
• Months 7–10: accumulate records, run the first internal audit and management review.
• Months 10–14: Stage 1 and Stage 2 audits, then close findings.

Firms that already run a tidy ISO 9001 system tend to move faster because the foundation is in place. The binding constraint is rarely writing documents; it is running the system long enough to have real evidence.

Common pitfalls for first-timers

• Documenting an aspirational business. Writing procedures for how you wish you worked, then failing the audit because reality differs. Describe what you actually do, then improve it.
• Treating it as a paperwork exercise. AS9100 is about control and risk. Auditors look for evidence that decisions are made and problems are closed out, not just that a folder exists.
• Weak internal audits. A rushed, tick-box internal audit hides the very issues the external auditor will find. Do it properly and fix things before the certification body arrives.
• Underusing management review. Leadership engagement is a genuine requirement, not a formality. A thin review signals a system that runs without ownership.
• Ignoring supply-chain requirements. Counterfeit-part prevention and control of external providers catch out firms that assume their suppliers are someone else's problem.

The suppliers who struggle most are usually the ones who buy a template pack and try to bolt it on. This is exactly where we support first-timers differently: we document what you genuinely do, build the system around your operation, add only the aerospace requirements you must meet, then train and implement alongside your team so the system is yours by the time the auditor arrives.

Frequently asked questions

How long does AS9100 certification take?

For a small supplier starting without an existing quality system, nine to fifteen months is a realistic range. The pace depends on how much time you can commit and how quickly you can accumulate the operating records auditors expect to see.

Do I need ISO 9001 before AS9100?

No. AS9100 already contains the full text of ISO 9001 plus aerospace additions, so you certify to AS9100 directly rather than to both. If you already hold ISO 9001, that foundation makes the transition faster, though do not mistake it for a small step.

Can a consultant guarantee we pass?

No credible adviser guarantees a certification outcome, because the certificate is awarded by an independent body assessing your live system. A good consultant improves your readiness and closes gaps; the result still rests on evidence.

Getting ready with confidence

The best time to find your gaps is before an auditor does. ProgressXL (coming soon) is built to help you assess where your operations stand against standards like AS9100, then work a prioritised improvement plan at your own pace. Explore ProgressXL, or if you would rather talk through your certification path with someone who has done it, email the team.