What the standards actually require

The commercial reality

Certification is a gate, not a trophy

Primes and higher-tier suppliers generally will not issue a purchase order to a shop without AS9100 certification. It is pursued because it is a condition of doing business, under an external and dated deadline — an audit booked, a contract awarded, a customer requirement.

A shop is certified by an accredited certification body, not by a customer and not by the publisher of the standard. Certification runs on a cycle, with periodic surveillance in between and a full reassessment at the end.

The practical consequence: an audit examines records that already exist. A quality system has to be operating and generating evidence before it can be assessed, which is why shops seeking certification need their record-keeping working earlier than they expect.

Cycle lengths, surveillance frequency, and any minimum operating period before assessment are set by the standard and your certification body. Confirm them with your CB rather than here.

Nonconformance

When something does not meet the requirement

A nonconformance is product or process that does not meet its requirement. It may be found at receiving, in process, at final inspection, during an audit, or by the customer after delivery.

The record captures what was nonconforming — part, revision, lot, quantity — what the requirement was against what was actually found, who detected it and when, and the containment: what was done immediately to stop the problem spreading. Quarantine the parts, check remaining stock, and notify the customer if product has already shipped.

Then a disposition: use as is, rework, repair, scrap, or return to supplier. One nonconformance can carry several — rework eight, scrap two. Accepting or repairing product that does not meet the original requirement typically involves the customer, and the authorization for that belongs on the record rather than in an inbox.

Which dispositions need customer approval, and in what form, is set by the standard and by your contracts. It varies by customer. Verify it against both.

Corrective action

The step most often done badly

Corrective action asks a different question from a nonconformance: not what to do with these parts, but what changes so it does not happen again. It covers the problem statement, the root cause and the method used to find it, the action taken, and who owned it.

The last step is the one that gets skipped. An effectiveness check is a dated verification, performed some time after the action was implemented, that the action actually worked. It is a future obligation, which is exactly why it slips — the action feels finished when the change is made.

Corrective actions closed with no evidence that anyone went back and checked is a classic audit finding. A system that surfaces the check when it comes due, and refuses to treat the record as closed without it, prevents a whole category of finding.

First article inspection

Proving the process, not the part

A first article inspection is a complete, documented verification that a production process produces a part meeting every drawing and specification requirement. The part inspected must come from the real process, with real tooling and real operators — not a prototype and not a sample from engineering.

It is generally required for a new part or a part new to a supplier, and again after changes that could affect the result: a design change, a process change, a change of source or location, a change in tooling, or a long enough break in production. Customers may also simply ask for one.

An inspection may be full or partial. A partial covers only the characteristics affected by the change — and has to reference the earlier inspection it builds on, or it does not stand on its own. AS9102 organizes the output as a set of forms covering part identification, the materials and special processes that went into the part, and the measured result for every characteristic on the drawing.

The trigger conditions, the production lapse period, and the exact form contents are defined by AS9102 and by your customer. Work from the current revision of the standard.

Traceability

Both directions, quickly

Backward: from a delivered part to the material it was made from, the processes applied, and the inspections performed. Most shops can do this, given time and a filing cabinet.

Forward is the one that matters under pressure. A material certification turns out to be falsified, or a heat number is suspect — what did we make from it, and which customers received it. That question arrives with a deadline attached, and your customer will judge you on how fast you can answer.

Answering it requires the links to have been recorded as the work happened: material lot to manufactured lot, lot to part revision, lot to shipment. Reconstructed afterwards from memory and paperwork, the answer is slow and only as good as the filing.

Whether lot-level traceability is sufficient, or parts must be individually serialized, depends on the part and the customer. Flight-critical and life-limited parts carry stricter requirements.

Counterfeit prevention

Where the material came from

Aerospace has a real counterfeit problem, concentrated in electronic components and in material sold with falsified certifications. The controls are about provenance: buying from original manufacturers or authorized distributors where possible, applying additional verification when buying from independent distributors, and maintaining traceability back to the original manufacturer.

Scrap control belongs in the same conversation, which surprises people. Controlling and disposing of scrapped parts so they cannot re-enter the supply chain is a counterfeit-prevention measure, not just housekeeping — which makes the scrap disposition on a nonconformance record carry more weight than it first appears.

Records

Retention is longer than you think

Retention obligations come from several directions at once: the standard requires an organization to define and control retention, customer contracts frequently impose longer periods than a shop would otherwise choose, and aviation regulators impose their own. Some programs require records for the life of the aircraft type, which can run for decades.

The practical implication is that retention should default long and be set deliberately per organization, and that deleting a record is never a casual operation. Destroying a record a customer was obliged to keep can become an audit finding against them, caused by you.

Your retention obligations are set by your customers, your regulator, and the standard. Establish them deliberately and write them down.