AS9100 for Israeli Aerospace Suppliers: How It Differs from ISO 9001

The Prime Contractor Ultimatum

Most companies that come to us for AS9100 certification did not decide to pursue it — they received a directive. The language varies slightly, but the pattern recurs: "Supplier is required to hold AS9100 Rev D certification by date X as a condition of continued supply agreement." The sending party changes — IAI, Elbit, Rafael, smaller Israeli tier-two manufacturers supplying into the prime — but the logic is the same.

That ultimatum creates pressure that drives a predictable and problematic decision: "We have ISO 9001, we're most of the way there." The assumption is dangerous not because it is entirely wrong — ISO 9001 does provide a foundation — but because it causes companies to underestimate the actual gap. By the time the real gap becomes clear, the timeline pressure is already making proper preparation harder.

The 40% Nobody Talks About

A company with a mature ISO 9001 system has typically covered the fundamentals of a quality management system: quality policy, measurable objectives, basic risk management, some level of supplier management, internal audit, management review. In terms of raw clause count, that maps to roughly 60% of AS9100's requirements.

The problem is that the missing 40% is not "more paperwork" — it is the highest-risk territory in aerospace manufacturing, which is exactly why it is also where audits fail. A supplier that arrives at an AS9100 audit with a strong ISO 9001 system but no coverage of the aerospace-specific requirements will not pass.

What ISO 9001 Does Not Cover: The Gap List

Configuration Management

ISO 9001 addresses "externally provided processes, products, and services" and "documented information" at a level sufficient for standard commercial manufacturing. AS9100 requires full configuration management discipline: configuration identification, change control, configuration accounting, and configuration verification. When a component undergoes a change — even a "minor" one — a complete audit trail is required showing who approved it, when, and at which configuration baseline.

In practice, interfacing with a prime contractor means that certain changes may require re-approval from the prime before implementation. Companies accustomed to the manufacturing flexibility of commercial markets discover that their instincts conflict with these requirements at the first change event.

FOD — Foreign Object Damage and Debris

FOD is one of the requirements that surprises ISO 9001 companies most. This is not about housekeeping — it is about a documented FOD prevention program that includes: definition of FOD-critical zones, specific FOD awareness training for all personnel working in those zones, pre-close inspection processes before assemblies are sealed, and documented reporting of FOD events.

Why does aerospace treat this with such specificity? Because a foreign object inside an aircraft engine or structural assembly is not a quality finding — it is an accident waiting to happen. The requirements are not bureaucracy; they are a direct reflection of what failure costs in this industry.

Counterfeit and Suspect Parts

AS9100 requires a specific policy for preventing the use of counterfeit and unapproved/suspect parts. This includes: approved supplier-only sourcing for critical components, source verification processes, quarantine and segregation protocols when counterfeiting is suspected, and mandatory reporting to relevant authorities. The topic has become more urgent in recent years given global supply chain disruptions. Israeli prime contractors have increased scrutiny on this point, and suppliers who cannot demonstrate clear processes are treated as supply chain risk.

Special Process Control

Special processes — heat treatment, welding, non-destructive testing (NDT), chemical coatings, structural bonding — are processes whose outputs cannot be fully verified through end-of-production inspection alone. AS9100 requires significantly deeper control of these processes: documented operator qualification and currency, equipment calibration and validation, complete per-unit process records showing actual parameters achieved, not just target ranges.

Often, the prime's own flow-down requirements — not just the standard — define additional requirements for specific processes. Suppliers who assume their general certifications cover every special process they perform discover that there is a separate approved process list that governs each one.

Second-Party Audits from Prime Contractors

ISO 9001 does not prepare you for a supplier audit from a prime contractor. Prime contractors like IAI, Elbit, and Rafael conduct second-party supplier audits on their own schedules — sometimes unannounced. The outcome of such an audit is not simply pass/fail; it is recorded in the OASIS database and affects your supplier standing across the industry, not just with that specific prime.

NADCAP: The Horizon You Don't See at the Start

Companies focused on AS9100 certification often do not initially realize that the prime may also require NADCAP accreditation for specific processes — separately from and in addition to AS9100. NADCAP (National Aerospace and Defense Contractors Accreditation Program) is a process-specific accreditation program covering special processes: heat treatment, chemical processing, NDT, welding, and others.

Unlike AS9100, which certifies a quality management system, NADCAP certifies a specific process at a specific facility. If you perform heat treating and NDT, you may need two separate NADCAP accreditations — in addition to AS9100. Preparing for a NADCAP audit requires working through a detailed checklist from the Performance Review Institute (PRI) that can contain hundreds of individual audit points, many of them highly process-specific.

The right planning timeline: if your prime requires both AS9100 and NADCAP, plan for two parallel processes, not sequential ones. NADCAP alone can take twelve to eighteen months for certain process categories.

OASIS: Why the Database Matters More Than the Certificate

OASIS (Online Aerospace Supplier Information System) is the IAQG database where prime contractors look up supplier certification status — not the printed certificate on your wall. When a procurement manager at IAI evaluates a potential supplier, they log into OASIS and see: Is the certification current? What were the findings from the last audit? Are there any open NCRs (Non-Conformance Reports)?

An open NCR in OASIS can block a deal — even if you hold a valid certificate. Maintaining a clean OASIS record is not an administrative matter; it is part of your commercial reputation in the aerospace supply chain.

Common Audit Findings Against Israeli Aerospace SMEs

Based on our experience supporting audits, the findings that recur most often against Israeli SMEs:

• Business risk management disconnected from aviation safety risk — a risk policy exists, but it does not trace how a specific manufacturing failure affects aircraft safety
• Supplier management at ISO 9001 depth, not AS9100 depth — supplier evaluations exist, but do not include approved supplier list verification for critical components
• Incomplete special process records — work orders that do not preserve all actual process parameters for each individual unit
• Employee training that does not cover FOD — safety and quality training exists; FOD as a specific documented program does not
• Change management that does not originate from engineering — a "minor" process change was implemented without triggering a full change control process

The Transition Path: What Actually Works

1. Detailed gap analysis — not a read-through of the standard, but a clause-by-clause mapping of every AS9100 requirement against every existing process, with prioritized findings. This is three to four weeks of focused work for an SME.
2. Risk-prioritized closure — not all gaps are equal. FOD, configuration management, and counterfeit parts control are where audits concentrate; these get closed first.
3. Build the process, then document it — the common mistake is writing procedures for processes that do not yet exist. The audit will discover that the procedure is not implemented. Build the operational process first, then document what it actually is.
4. AS9100-specific internal audit — an existing ISO internal audit does not cover the aerospace-specific requirements. Build an internal audit checklist that maps explicitly to AS9100 clauses, not just ISO 9001 clauses.
5. Mock audit before submission — at minimum one internal audit that simulates the certification audit experience. Findings there are far preferable to findings at the certification audit itself.

The Realistic Timeline

A company with a reasonably mature ISO 9001 system and no NADCAP requirement: eight to fourteen months to an AS9100 certification audit. A company without any ISO 9001 foundation: fourteen to twenty months. If NADCAP is also required for one process: add six to twelve months for that parallel track, which needs to run concurrently, not after.

Companies that are presented with four to six month timelines to AS9100 from scratch should ask detailed questions. A system built too fast is a system that will not hold up at the certification audit — and will not hold up under a prime contractor second-party audit either, which is often the audit that actually matters commercially.

The Bottom Line

AS9100 is not "ISO 9001 plus a little extra." It is a standard built around the specific risk profile of the aerospace industry — one where the cost of failure is not a dissatisfied customer but an aircraft accident. The 40% that separates ISO 9001 from AS9100 compliance is precisely the territory that reflects that difference.

We are not a large consulting firm, and in aerospace supplier work that matters: the people who know your quality system are the people in the audit room, not a junior staff member holding a clipboard. If you have received a prime contractor ultimatum with a specific date — building a realistic timeline before you start is more useful than discovering the timeline is impossible after three months of work.