Aerospace AS9100 Documentation: The Complete Hub

AS9100 is the quality management standard for aerospace, space, and defense suppliers, built on the ISO 9001 high-level structure with added clauses for configuration management, First Article Inspection, risk management, and counterfeit parts prevention. A company's AS91xx certification status is publicly tracked in the OASIS database, which most aerospace primes check before qualifying a new supplier. Getting the documentation right isn't optional — it's the gate between a supplier and the program.

This hub is the starting point for the documentation questions that come up most: what AS9100 actually adds to ISO 9001, what an FAI package needs to contain, how configuration management works in practice, and how counterfeit parts prevention gets documented and audited. Later guides in this series go deeper on supplier documentation, PPAP-style control plans, and customer-specific requirements from OEMs like Boeing, Airbus, and the major defense primes.

AS9100 as an extension of ISO 9001

AS9100 (currently Revision D, published by the International Aerospace Quality Group, IAQG) is not a standalone standard — it incorporates the full text of ISO 9001 and layers on aerospace-specific requirements. Both standards share the Annex SL high-level structure, which is why a company already certified to ISO 9001 recognizes most of the clause numbering and the process-based, risk-focused approach.

The additions are where aerospace work actually differs from general manufacturing:

• Configuration management — controlling product definition (drawings, specs, software versions) across the lifecycle so the part built today matches the part qualified years ago.
• First Article Inspection (FAI) — a documented, complete verification that a new or changed part meets every requirement on the drawing before production quantities ship.
• Counterfeit parts prevention — controls to keep unapproved or fraudulent parts (especially electronic components) out of the supply chain.
• Risk management — formal identification and mitigation of risks tied to product safety, not just process risk.
• Product safety — an explicit organizational responsibility for safety throughout design, production, and use.
• Special requirements, critical items, and key characteristics — flowdown of the customer's specific technical demands into the supplier's own quality system.

None of this is decorative. Auditors and customer quality engineers expect to see these elements as live, working parts of the quality management system — not a binder that gets updated the week before a surveillance audit.

Configuration management: keeping "what we build" and "what we said we'd build" in sync

Configuration management (CM) is the discipline of identifying a product's configuration, controlling changes to it, and recording status throughout its life. In aerospace, a part can stay in production for decades, and a single undocumented substitution — a different fastener, a revised software build, a changed supplier for a subcomponent — can affect airworthiness. A working CM system typically documents:

• Baseline identification: which drawing revision, specification, and bill of materials define the "as-designed" configuration.
• Change control: how engineering changes are proposed, reviewed, approved, and communicated down the supply chain before implementation.
• Configuration status accounting: a record of what's been built against which configuration, so any unit can be traced back to its exact build standard.
• Configuration audits: periodic checks that the "as-built" product actually matches the "as-designed" and "as-planned" records.

The practical failure mode is not usually a missing procedure — it's a procedure that exists on paper but isn't followed when a shop-floor change gets made under schedule pressure without updating the record.

First Article Inspection: what the package needs to contain

FAI is a complete, documented inspection of a first-production part (or a part after a design change, tooling change, or manufacturing process change) to verify that every characteristic on the engineering drawing has been met. The industry standard reference is SAE AS9102, and most aerospace primes require FAI reports in that format or a customer-specific equivalent.

A typical FAI package includes:

• Form 1 — Part Number Accountability: identifies the part, revision, and organizations involved.
• Form 2 — Product Accountability: raw material, specifications, and special process certifications (heat treat, plating, NDT).
• Form 3 — Characteristic Accountability, Verification, and Compatibility: every dimension, tolerance, and note on the drawing, mapped to an actual measured result.
• Supporting objective evidence: inspection records, material certs, process certifications, and, where required, a ballooned drawing showing each characteristic's location.

An FAI is re-triggered whenever a design changes, a manufacturing process or location changes, a tool is replaced, or production is broken for a defined period — not just on the very first unit ever built. Suppliers who treat FAI as a one-time event, rather than a recurring trigger, are one of the more common findings in customer audits.

Counterfeit parts prevention

Counterfeit and unapproved parts are a documented risk in aerospace supply chains, particularly for electronic, electrical, and electromechanical (EEE) components where legitimate supply can be scarce or where distributors outside the authorized channel offer parts at a discount. AS9100 requires suppliers to have a documented counterfeit parts prevention process, and for many programs this maps to SAE AS6174 or AS5553 as the underlying technical standard.

The core documentation elements are:

• A defined process for sourcing from OEMs, authorized distributors, or other approved sources, with a documented risk assessment for any exception.
• Incoming inspection and testing criteria appropriate to the part's risk category.
• Traceability records tying each lot back to its source.
• A reporting mechanism for suspect or confirmed counterfeit parts, including flowdown obligations to notify customers and, where applicable, industry reporting databases.

OASIS: how the industry tracks who's actually certified

The Online Aerospace Supplier Information System (OASIS) is the database maintained on behalf of the IAQG that records AS91xx (AS9100, AS9110, AS9120) certification status for suppliers worldwide. When a certification body completes an audit and issues or renews a certificate, that status is uploaded to OASIS, giving customers, auditors, and prospective partners a way to verify a supplier's standing without relying solely on a paper certificate. For a supplier, this means certification status is effectively public and continuously checked — a lapsed certificate, a suspended status, or a certification body that isn't recognized shows up quickly to anyone qualifying a new source. Keeping the underlying audit and corrective action records current isn't just about passing the next surveillance audit; it's about what a customer sees when they look the company up before placing an order.

Practical impact: where documentation gaps actually bite

Documentation problems in aerospace rarely show up as a single dramatic failure. They show up as delays: a customer audit finding that stalls a purchase order, an FAI rejected because a characteristic wasn't ballooned correctly, a configuration discrepancy discovered during a customer source inspection, or an OASIS status question that pauses a supplier qualification review. Each of these is recoverable, but each also costs program time that's hard to get back on aerospace schedules. The suppliers who avoid this pattern tend to share one habit: their documentation is retrievable in minutes, not hours. When an auditor or customer engineer asks for a specific FAI report, a CM change record, or a certificate of conformance from eighteen months ago, the answer comes from a system, not a search through shared drives and email threads.

Common mistakes

• Treating AS9100 as "ISO 9001 plus a binder." The aerospace-specific clauses need to be built into daily process ownership, not bolted on as a parallel set of forms.
• Re-using an old FAI instead of re-triggering one. A tooling change, a new manufacturing location, or a supplier change for a raw material all warrant a fresh First Article Inspection.
• Letting configuration records drift from the shop floor. Engineering change control that isn't communicated to production creates a gap between "as-designed" and "as-built" that surfaces during audits or, worse, during a failure investigation.
• Under-documenting supplier sourcing decisions. A verbal justification for buying from a non-authorized distributor isn't a substitute for a written risk assessment.
• Assuming certification status is set-and-forget. OASIS reflects current standing — a missed surveillance audit or unresolved nonconformance can change what customers see almost immediately.

How Igera fits in

Igera's AI answers questions directly from a company's own documentation — quality manuals, FAI records, CM procedures, customer-specific requirements — and cites the exact source it pulled the answer from. For a quality team fielding the same questions from auditors, customer engineers, and new hires (Where's the current FAI for this part number? What does our CM procedure say about tooling changes? What's the latest revision of this customer's specific requirements document?), that means answers come with a traceable citation instead of someone's best recollection.

Frequently asked questions

Is AS9100 the same certification as ISO 9001?

No. AS9100 incorporates the full ISO 9001 text and adds aerospace-specific clauses (configuration management, FAI, counterfeit parts prevention, risk and product safety requirements, among others). A company can hold ISO 9001 without AS9100, but AS9100 certification implies ISO 9001 conformance plus these additions.

What triggers a First Article Inspection?

A new part number, a design change affecting form, fit, or function, a change in manufacturing process, method, location, or tooling, or a production break of a duration defined in the applicable quality system typically triggers a new or partial FAI. The specific triggers should be defined in the supplier's own FAI procedure and any customer-specific requirements.

What is the OASIS database used for?

OASIS records the certification status of suppliers audited to the AS91xx family of standards (AS9100, AS9110, AS9120). Customers and certification bodies use it to verify that a supplier's certificate is current, issued by a recognized certification body, and not suspended or withdrawn.

Do all aerospace suppliers need AS9100 certification?

Not automatically — it depends on customer and program requirements. Many aerospace primes and Tier 1 suppliers require AS9100 (or the distribution-focused AS9120, or the MRO-focused AS9110) as a condition of doing business, but requirements vary by contract and by the criticality of the parts being supplied.

How does configuration management differ from document control?

Document control manages the lifecycle of documents themselves (approval, revision, distribution). Configuration management is broader — it manages the definition of the product across hardware, software, and documentation, and ensures that what's built matches what's documented at every stage, including after changes.

What counts as a counterfeit part under AS9100 requirements?

Generally, any part that is misrepresented in its identity, source, or history — including used parts sold as new, parts that don't meet specification but are represented as conforming, or parts obtained outside approved supply channels without proper traceability. Specific definitions and controls are typically drawn from standards such as AS5553 or AS6174.

How often is OASIS status updated?

Certification bodies upload results after each audit cycle (initial certification, surveillance, and recertification), so status reflects the most recent audit outcome. Exact timing depends on the certification body's reporting process.

Disclaimer

This article is informational and does not constitute legal, regulatory, or quality-engineering advice. AS9100 requirements, FAI procedures, and customer-specific requirements vary by program and by certification body interpretation. Confirm current requirements with a qualified quality professional, your certification body, or the applicable customer's quality organization before making compliance decisions.