Aerospace Precision Machining: AS9100 & ITAR Demands
If you run a contract machine shop and want to break into aerospace work, you will quickly discover that capability alone does not qualify you. Aerospace precision machining operates inside an overlapping web of quality standards, export regulations, documentation requirements, and customer-specific flowdowns that disqualify technically excellent shops before a single quote is evaluated. Understanding what AS9100 Rev D actually requires on the shop floor, what ITAR-adjacent programs demand beyond a simple registration letter, and how your quality infrastructure stacks up against those demands is the first step toward bidding and winning in this market.
Table of Contents
Quick Takeaways
Key Insight
Explanation
AS9100 Rev D adds roughly 105 requirements beyond ISO 9001
These cover counterfeit part prevention, configuration management, operational risk management, and product safety controls that ISO 9001 does not address at all.
ITAR registration is a legal obligation, not a quality certification
Any shop manufacturing, brokering, or providing services on U.S. Munitions List items must register with DDTC, even if nothing is ever physically exported.
First Article Inspection under AS9102 is a contract requirement, not optional
AS9100 Rev D Clause 8.5.1.3 mandates production process verification. For most aerospace programs, this means a full AS9102 FAI package with every drawing characteristic measured and recorded.
ISO 9001 alone disqualifies you from flight-critical programs
A supplier holding only ISO 9001 cannot satisfy AS9100D flowdown requirements on flight-critical or safety-critical programs, regardless of machining capability.
CMMC compliance is increasingly layered on top of ITAR
ITAR-registered shops handling Controlled Unclassified Information must also address CMMC 2.0 requirements, including NIST SP 800-171 cybersecurity controls.
Material traceability must run from raw stock to shipment
Complete traceability requires unbroken documentation from raw stock material test reports through every manufacturing operation to the finished-part certificate of conformance.
Verify AS9100D status through the IAQG OASIS database
Buyers and primes confirm certification status in the OASIS database. A certificate copy alone is not sufficient verification for most aerospace procurement teams.
What AS9100 Rev D Actually Demands from a Contract Shop
AS9100 Rev D is the internationally recognized quality management system standard for the aerospace and defense industry. Developed and maintained by the International Aerospace Quality Group (IAQG), it builds on ISO 9001:2015 and adds sector-specific requirements covering operational risk management, configuration management, product safety, and counterfeit parts prevention. The current revision is AS9100 Rev D, issued in 2016.
For a contract machining shop, the standard governs every aspect of production quality, from how raw materials are sourced and verified, to how finished components are measured, traced, and delivered. The additions beyond ISO 9001 are not administrative nuances. They are enforceable at the purchase order level by aerospace primes who flowdown these requirements to every supplier in their chain.
The specific AS9100D additions that directly affect shop-floor operations include documented counterfeit part prevention and detection processes, full supply-chain traceability from raw material to delivery, configuration management across the product lifecycle, product safety controls, First Article Inspection per AS9102, and formal risk management covering schedule, quality, and safety. Each of these requires written procedures, trained personnel, and objective evidence that the procedures are actually followed.
A shop that stores NC programs on a shared drive without version control and sign-off authority is not operating under configuration management, regardless of what its quality manual says.
Risk management under AS9100D is particularly underestimated by shops transitioning from commercial work. The standard requires a formal process for identifying and mitigating risks throughout the product lifecycle, from contract review and material procurement through machining, inspection, and delivery. This is not a paperwork exercise. It means documented risk assessments at the planning phase that identify potential failure modes before they affect production.
Pro tip: Before pursuing AS9100D certification, conduct a gap assessment against ISO 9001 first, then map the 105 additional requirements against your current procedures. Most shops discover that configuration control and counterfeit-parts handling are the largest gaps, and both require procedural infrastructure that cannot be improvised under audit pressure.
What ITAR-Adjacent Programs Demand Beyond Registration
ITAR (International Traffic in Arms Regulations) functions as a legal requirement, not a quality certification. Any company manufacturing, exporting, brokering, or providing defense services for U.S. Munitions List items must register with the Directorate of Defense Trade Controls (DDTC), including precision machining facilities producing defense components even if they never physically export anything.
ITAR registration is the baseline. What aerospace and defense programs actually require on top of that baseline is where most shops underestimate the scope. A written Technology Control Plan (TCP) is a core operational document, not just a registration formality. The TCP defines who has access to controlled technical data, how that data is stored and transmitted, what training employees receive, how subcontractors are screened, and how violations are reported.
Access Controls and Personnel Requirements
ITAR restricts access to controlled technical data to U.S. persons as defined under the regulations. For a machine shop, this means that foreign nationals employed on the shop floor or in engineering may require a license before they can access controlled drawings, CAD files, or process specifications. This is a frequently overlooked point for shops that have not previously operated in the defense supply chain.
Recordkeeping under ITAR requires a minimum five-year retention period for all transaction records related to controlled items. This intersects directly with the traceability requirements under AS9100D, and shops that build a single integrated quality and export-control record system avoid duplicated effort.
CMMC and the Cybersecurity Layer
ITAR-controlled technical data is frequently treated as Controlled Unclassified Information (CUI) for cybersecurity purposes, which means ITAR registration alone does not satisfy Cybersecurity Maturity Model Certification (CMMC) requirements. A defense machine shop that handles CUI in digital form needs both frameworks addressed simultaneously. ITAR governs the export-control side; CMMC and NIST SP 800-171 address the 110 cybersecurity controls for digital handling of that same data.
A shop can be fully ITAR-registered and still fail CMMC requirements because the two regimes address different risks. In practice, a fully qualified aerospace supplier must satisfy AS9100D for quality management, ITAR for export controls, and CMMC for cybersecurity as a layered system, not as three separate compliance checkboxes.
Pro tip: When a prime contractor flows ITAR requirements down in a purchase order, request a copy of their specific Supplier Quality Requirements document before accepting the contract. SQRs often contain obligations that go beyond the base ITAR registration, including visit authorization procedures, data handling protocols, and approved subcontractor lists that can affect your production planning significantly.
First Article Inspection and Why It Separates Qualified Shops
AS9100 Rev D Clause 8.5.1.3 mandates verification of first production run capability. For aerospace programs, this requirement translates into a formal First Article Inspection conducted to AS9102 standards that covers every characteristic on the drawing. A shop that cannot produce a complete AS9102 FAI package introduces immediate program risk, and most aerospace procurement teams know this before the first conversation about tolerance capability.
The AS9102 FAI package includes dimensional data on every drawing characteristic, material and process certifications, tool records, operator qualification records, and sign-off by a delegated quality authority. It is organized into three forms under the AS9102 standard, and incomplete or inaccurate submission results in rejection. The program does not move forward until the FAI is accepted.
Delta FAIs and Design Changes
AS9102 Rev C also defines when full, partial, or delta FAIs are required after design or process changes. This matters for contract shops that receive engineering change orders mid-program. A dimensional change to a single feature may require a delta FAI on that feature only, or a full re-FAI depending on the nature of the change and the customer's SQR. Knowing the difference and having a procedure for it prevents unauthorized shipments of parts built to a superseded revision.
Coordinate measuring machines provide the dimensional accuracy and documentation density required for AS9102 FAI submissions on tight-tolerance aerospace parts. Shops with calibrated metrology equipment that is matched to the tolerances being verified produce FAI packages that survive prime contractor review. Shops relying on hand-gauging for critical characteristics typically produce FAI packages that come back for correction, which adds time and cost to an already compressed program schedule.
Material Traceability and the Documentation Package
Material traceability in aerospace machining is not a general statement about knowing where your stock came from. It is an unbroken documentation chain from the raw stock material test report, through every manufacturing operation, to the finished-part certificate of conformance. Every link in that chain must be present, legible, and archived.
The documentation package that accompanies an aerospace shipment typically includes a signed and dated Certificate of Conformance referencing the applicable drawing revision and specification, material certifications such as mill certs or material test reports traceable to the originating heat or lot, lot and serial traceability records linking raw material to in-process operations and final inspection, and CMM inspection reports with actual measured values traceable to a specific machine, operator, measurement date, and drawing revision.
Handwritten records do not meet aerospace program expectations for most prime contractors. The expectation is a digital, auditable trail. Shops that maintain paper travelers without controlled revision numbering or electronic archiving create traceability gaps that surface during customer audits, not during initial qualification reviews.
Outside Processor Certifications
A machining supplier may hold AS9100D but still need to use NADCAP-accredited outside processors for heat treating, chemical processing, or coatings to satisfy customer flowdowns. When that happens, the outside processor's certifications must be traceable to each specific job in the documentation package. The contract shop is responsible for verifying that their outside processors hold current NADCAP accreditation for the specific processes being performed, which can be confirmed at the PRI NADCAP database. Failure to verify outside processor status before shipping is a common corrective action finding in aerospace supplier audits.
Comparison: Aerospace Supply Chain Qualification Tiers
Aerospace supply chain qualification is not a single threshold. Primes and integrators organize their supplier base into tiers, and each tier carries a different compliance profile. Understanding which tier you are realistically pursuing determines which certifications and capabilities you need to have in place before the first conversation with a sourcing engineer.
Supply Chain Tier
Minimum Compliance Requirements
Additional Expectations
Tier 1 (Engine OEM Direct Supply)
Full AS9100 Rev D certification with explicit engine component scope, NADCAP accreditation for all applicable special processes
Established APQP/PPAP capability, customer-witnessed FAI, Cpk data on Key Characteristics available within defined timelines, often a resident quality representative during first production builds
Tier 2 (System Integrator Supply)
AS9100 Rev D certification plus customer-specific Supplier Quality Requirements flowing down from the Tier 1 contract
Mandatory FAI, NADCAP may be required for specific processes depending on the SQR, Cpk data on Key Characteristics available on request within 48 hours
Tier 3 (Subcontract Machining)
AS9100D at minimum, ITAR registration if defense work is involved
Full traceability documentation, conforming FAI package, calibrated inspection equipment, corrective action system with recent records available for review
CMM Calibration and Metrology as Compliance Infrastructure
Aerospace programs do not accept inspection data from uncalibrated or inadequately maintained equipment. AS9100D requires that all inspection equipment be calibrated and traceable to national standards, and the calibration records must be available as part of any audit or customer review. This is not a background administrative task. Calibration records for CMM equipment, gauge blocks, and any measurement system used to produce FAI or production inspection data are primary evidence of quality system compliance.
For contract shops operating in Fort Wayne and across the Midwest industrial corridor, accredited metrology capabilities represent a meaningful differentiator. A2LA accreditation under ISO/IEC 17025, the international standard for testing and calibration laboratory competence, provides third-party confirmation that measurement processes are controlled, equipment is properly maintained, and results are technically valid. This matters directly to aerospace buyers who must verify supplier inspection capability before approving a source. Shops that can point to accredited in-house metrology reduce the buyer's qualification burden and remove a common objection from the conversation.
Measurement System Analysis data for critical dimensions is increasingly expected at Tier 2 and above. This means gauge R&R studies documented and available for review, not just calibration stickers on tools. The difference is significant: calibration confirms that a gauge reads correctly under standard conditions, while MSA confirms that the measurement system produces consistent results across different operators and setups in actual production conditions.
Pro tip: If your shop provides calibration services or operates an accredited metrology laboratory, align that capability directly with your AS9100D quality system documentation. Aerospace buyers who find that inspection and calibration are handled under the same accredited quality system framework view this as a sign of organizational maturity that competitors without that integration cannot match.
Common Disqualifiers When Aerospace Buyers Audit Contract Shops
Aerospace supplier qualification audits follow a predictable pattern, and the disqualifying findings tend to cluster around the same areas regardless of shop size or geography. Knowing these in advance allows a shop to address them before an auditor arrives, rather than after a corrective action request delays program start.
The most common disqualifier is an incomplete or undocumented corrective action system. AS9100D requires nonconformance and corrective action logs with root cause analysis, implemented corrections, and verification of effectiveness. Buyers request the prior 12 months of records. A shop that cannot produce this history, or that has open corrective actions without implemented responses, fails this review regardless of its machining capability.
The second most common disqualifier is inadequate counterfeit parts procedures. AS9100D has a specific requirement for suspect and counterfeit parts prevention and detection, including quarantine protocols and customer notification procedures. Shops that have a general incoming inspection procedure but no specific counterfeit-parts procedure in writing are non-compliant with this clause.
The third area is configuration management for NC programs and work instructions. A shop that cannot demonstrate version-controlled access to machining programs, with documented sign-off authority for changes, is not operating under configuration management. This is a gap that appears routinely in shops transitioning from commercial contract work and can delay aerospace qualification by months while the procedural infrastructure is built.
For contract shops positioned to serve aerospace customers, the PPAP documentation capability that many industrial manufacturers already maintain for automotive customers translates directly to the AS9102 FAI requirements aerospace primes expect. The underlying discipline is similar. The aerospace version is more demanding in traceability depth and characteristic coverage, but shops already producing PPAP packages are much closer to AS9102 compliance than they typically realize.
Frequently Asked Questions
What is the difference between AS9100D and ISO 9001 for a machine shop?
ISO 9001:2015 establishes a general quality management framework that applies across industries. AS9100D builds on that foundation and adds approximately 105 aerospace-specific requirements that ISO 9001 does not address, including documented counterfeit part prevention, full supply-chain traceability, configuration management, product safety controls, First Article Inspection per AS9102, and formal risk management. A supplier holding only ISO 9001 certification cannot satisfy AS9100D flowdown requirements on flight-critical or safety-critical aerospace programs, regardless of machining capability.
Is ITAR registration required for a contract shop that only machines parts domestically?
Yes. Any company manufacturing, exporting, brokering, or providing defense services for U.S. Munitions List items must register with DDTC, even if no physical export ever occurs. The machining of defense components, access to controlled technical drawings, and handling of controlled data all trigger registration requirements. ITAR registration is the baseline entry requirement for any machine shop operating in the defense supply chain.
What documents should an aerospace buyer request from a contract machining shop during qualification?
The minimum documentation set includes the current AS9100D certificate with scope statement and registrar name, verifiable through the IAQG OASIS database; a sample FAI package per AS9102 with a fully ballooned drawing and measurement records for every design characteristic; the counterfeit and suspect parts procedure with quarantine and notification protocols; a risk register with mitigations; recent nonconformance and corrective action records from the prior 12 months; material traceability examples linking finished parts to raw material heat numbers; and calibration records for inspection equipment including CMM calibration certificates.
What is a Technology Control Plan and why does it matter for an ITAR-registered shop?
A Technology Control Plan is a written operational document that defines how a shop controls access to ITAR-controlled technical data and hardware. It covers who may access controlled information, how that information is stored and transmitted, what training employees receive, how foreign national access is managed, how subcontractors are screened, and how potential violations are identified and reported. Without a written TCP, an ITAR registration is essentially a filing receipt without the operational controls that defense customers expect to see in place.
Does holding AS9100D certification automatically mean a shop is qualified to machine aerospace engine components?
No. AS9100D for aerospace CNC engine component machining is not the same requirement as AS9100D for airframe brackets or structural hardware. Engine component supply at the Tier 1 level typically requires AS9100D with an explicit engine component scope, NADCAP accreditation for all applicable special processes, established APQP/PPAP capability, and customer-witnessed FAI. Very few job shops qualify at Tier 1 without years of existing OEM relationships and recurring audit clearance. Most contract shops entering aerospace realistically target Tier 2 and Tier 3 positions first.
How does A2LA accreditation support aerospace machining qualification?
A2LA accreditation under ISO/IEC 17025 provides third-party confirmation that a shop's metrology and inspection processes meet recognized international standards for calibration laboratory competence. For aerospace buyers who must verify supplier inspection capability, an accredited in-house metrology capability reduces the qualification burden and provides independent confirmation that measurement data is technically valid, not just the output of internally calibrated equipment. It is particularly relevant for shops providing first article inspection, PPAP, and dimensional certification services alongside production machining.
Have you navigated AS9100D certification or ITAR qualification as a contract machining shop? Share what surprised you most about the process.
Comments