Risk management with ISO 31000: a starter framework
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.
EN 9100
AS9100 and EN 9100: the aerospace quality standard
Aviation, space and defence suppliers whose customers require a 9100-series quality management system.
One aerospace quality standard published under three names: AS9100 in the Americas, EN 9100 in Europe, JISQ 9100 in Asia-Pacific. It contains ISO 9001 in full and adds the requirements aviation, space and defence put on top.
What it is
One standard, three names
AS9100, EN 9100 and JISQ 9100 are the same standard. It is written by the International Aerospace Quality Group and then published regionally: AS9100 by SAE International in the Americas, EN 9100 in Europe, JISQ 9100 in Japan and the wider Asia-Pacific. The content is identical, so a supplier certified to one is not holding something weaker or stronger than a supplier certified to another.
This trips people up in tenders more than it should. A European prime asking for EN 9100 and an American one asking for AS9100 are asking for the same management system, and a certificate issued under either name answers both. What differs is the publishing body and the document number on the cover.
It contains ISO 9001, and adds to it
The 9100 standards incorporate the full text of ISO 9001 and then add the requirements that safety-critical work demands on top: configuration management, product safety, counterfeit part prevention, risk-based thinking applied to the product rather than only to the business, and far tighter control over what your own suppliers do.
That structure is why an ISO 9001 system is the right foundation and not the finished job. Most of the clause numbering will look familiar; the additions are where audits actually go.
Which of the series applies to you
There are three, and the certificate has to match the work you actually do:
- 9100 - aviation, space and defence organisations that design or make the product. This is the one most suppliers mean.
- 9110 - aviation maintenance organisations, covering maintenance, repair and overhaul.
- 9120 - distributors and stockists who buy, hold and resell parts without making or repairing them. Traceability and counterfeit-part control carry most of the weight here.
The rule of thumb: if you make or modify the product, 9100. If you only move it, 9120. If you maintain it, 9110. A distributor certified to 9100 has a certificate that does not describe its business, and an auditor will say so.
This one you really can be certified to
Unlike the NATO publications, 9100 has a proper certification scheme, and it is stricter than a normal ISO one. The certificate must come from a certification body accredited under the IAQG's Industry Controlled Other Party scheme, not from any body that happens to offer it. Certified organisations are then listed in OASIS, the IAQG's supplier registry, which is where a prime checks whether your certificate is real and what its scope says.
Two practical consequences. Your certificate is publicly verifiable, so its scope wording matters as much as holding it at all. And a certificate from a body outside the ICOP scheme may not be accepted by the customer who asked for it, however genuine the audit was.
How it relates to the NATO standards
If you supply defence as well as aerospace, the two worlds meet at AQAP 2310: it contains the EN 9100 requirements and adds NATO's on top, the same way AQAP 2110 builds on ISO 9001. So a supplier already running a 9100 system is most of the way to AQAP 2310, and the remaining work is the NATO delta - government quality assurance, contract risk and the customer's right of access. The AQAP overview sets out how that family fits together.
AS9100 is becoming IA9100
The IAQG has a revision under way, expected during 2026, and it comes with a rename: the series moves from the AS, EN and JISQ prefixes to a single IA designation, so AS9100 becomes IA9100. Material published by the IAQG indicates the changes largely clarify the current requirements rather than add new ones. Nothing you build against 9100 today is wasted, but if you renew a certificate in the next cycle, ask your certification body which edition you will be audited against.
Not the standard you were looking for?
ComplyTrain is not limited to the standards written up on this site. The product is built around a requirement tree, and one can be built for any standard, agreement or contractual specification that has requirements in it. The pages here are what we have documented so far, not the boundary of what the system handles. We add standards on request, and the list grows steadily.
How we help
How ComplyTrain helps you run a 9100 system
A 9100 audit is an evidence exercise. The requirements are known in advance and public; what an auditor is testing is whether you can show, on the day, that each one is met and has been met continuously:
- The ISO 9001-structured quality system the standard contains in full - Quality Management
- The 9100 additions held as a tracked requirement set, each traced to the evidence that satisfies it, so a gap is visible before an auditor finds it - Requirements Management
- Configuration control and documented information with full revision history and sign-off - Document Control
- Product safety and counterfeit-part risk on a consistent, calibrated scale rather than in a spreadsheet nobody owns - Risk Management
- Supplier assessment on a schedule the system tracks, which is where 9100 is far more demanding than ISO 9001 alone - Stakeholder and Vendor Management
ComplyTrain holds no 9100 certification of its own and does not claim one. It is the system you build and run your own quality management system in, and where the evidence for your certificate lives. The certificate is yours to earn, from an ICOP-accredited body.
Request access to this standard
Tell us how you need to work with EN 9100 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Questions
What is the difference between AS9100 and EN 9100?
The publisher and the region, not the content. The International Aerospace Quality Group writes one standard, and it is published as AS9100 by SAE International in the Americas, as EN 9100 in Europe and as JISQ 9100 in Asia-Pacific. A certificate issued under one name answers a customer asking for another.
Do we need AS9100, AS9110 or AS9120?
It follows the work you do. 9100 if you design or manufacture, 9110 if you carry out maintenance, repair and overhaul, 9120 if you distribute parts without making or repairing them. The certificate scope has to match the business - a distributor holding 9100 has a certificate that does not describe what it does.
Is AS9100 just ISO 9001 for aerospace?
It contains ISO 9001 in full, then adds to it. The additions are where the audits concentrate: configuration management, product safety, counterfeit part prevention, risk applied to the product itself, and much tighter control of your own supply chain. An ISO 9001 system is the foundation, not the finished job.
Who can issue an AS9100 certificate?
Only a certification body accredited under the IAQG's Industry Controlled Other Party scheme. Certified organisations are then listed in OASIS, the IAQG registry, where a prime can verify the certificate and read its scope. A certificate from a body outside that scheme may not be accepted by the customer who asked for it.
How does AS9100 relate to AQAP 2310?
AQAP 2310 contains the EN 9100 requirements and adds NATO's on top, the same way AQAP 2110 builds on ISO 9001. A supplier already running a 9100 system has most of the foundation for AQAP 2310; what remains is the NATO delta - government quality assurance, risk to contract performance and the customer's right of access.
Is AS9100 being renamed IA9100?
Yes. The IAQG has a revision under way, expected during 2026, which renames the series to a single IA designation - AS9100 becomes IA9100. The published indications are that the changes mostly clarify existing requirements rather than add new ones. Ask your certification body which edition your next audit will use.
Implementation
Getting to a 9100 certificate
The requirements are public and known in advance. What an audit tests is whether you can evidence them on the day.
Pick the right standard in the series
9100 to design or make, 9110 to maintain, 9120 to distribute. Getting this wrong produces a certificate whose scope does not match the business.
Build on the ISO 9001 base
The 9100 standard contains ISO 9001 in full. If that system is already sound, the work ahead is the aerospace delta rather than a rebuild.
Work the additions deliberately
Configuration management, product safety, counterfeit part prevention and supplier control. These are where audits concentrate and where ISO 9001 alone leaves you short.
Use an ICOP-accredited body
Only they can issue a certificate the industry recognises, and the result is listed in OASIS where your customers can read its scope.
If you need to get there and have no quality function
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
Gap assessment
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversGuided implementation
Our consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksFull-service quality function
We run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service means
Official sources
The primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
What ComplyTrain does
One system for the whole compliance programme. Start with the module you need most.
Forms & Follow-up
Collect information the same way every time, and decide in advance what happens next.
Controls & Assurance
Know whether your controls are operating, not just whether a policy says they exist.
Project Planner
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Product Compliance
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Reporting & Analytics
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
Media Monitoring
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
Grants & Tenders
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
Stakeholder/Vendor Management
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
Requirements Management
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Risk Management
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Training Management
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Document Control
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Quality Management
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Latest from ComplyTrain
ISO 9001:2026: what changed from 2015, and what to do now
ISO 9001:2026 was published in September 2026. What changed from the 2015 edition, the transition deadlines, and a practical checklist for your next audit.
Compliance for two-person defence suppliers: where to start
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Other standards in ISO management systems
- ISO 9001ISO 9001 quality management