ISO 9001 or EN 9100: which certification should you require from your machining subcontractor?
When a manufacturer draws up its supplier requirements, the question of quality certification inevitably comes up: is ISO 9001 enough, or should EN 9100 be mandatory? These two standards are not interchangeable, and mixing them up in a specification can expose you to real industrial and legal risks. Understanding what each standard actually covers — and, just as importantly, what it does not — is the starting point for any coherent purchasing policy in machined parts subcontracting. ISO 9001 or EN 9100: which certification to require is a decision that shapes your entire supply chain.
What ISO 9001 actually covers in a machining context
ISO 9001 sets out the requirements for a general-purpose quality management system. It applies to any organisation, regardless of size or sector. For a machining shop, it requires in particular:
- documented control of manufacturing processes (routing sheets, work instructions);
- management of measuring equipment and periodic calibration;
- a structured process for handling nonconformities and corrective actions;
- planned internal audits and management reviews;
- control of external suppliers and subcontractors.
In practice, an ISO 9001-certified shop has a documented framework for consistent production. It can identify a nonconformity, address it, and investigate its root cause. For mechanical parts intended for general industry, tooling, or non-critical equipment, this level of control is often adequate.
However, several areas fall outside the scope of ISO 9001. The standard does not prescribe any methodology for qualifying special processes (heat treatment, welding, coatings), makes no mention of First Article Inspection (FAI), and imposes no formal configuration management as parts evolve over time. These gaps are acceptable in some contexts, but become problematic as soon as machined parts are integrated into systems with high safety requirements.
What ISO 9001 leaves to the subcontractor's discretion
The standard sets outcome requirements, not method requirements. A shop can be fully compliant with ISO 9001 without having a formalised control plan per part number, without performing failure mode analysis on its machining processes, and with no obligation to notify its customer of changes to machinery, raw materials, or its own subcontractors. For a demanding customer, these normative silences are risk areas that need to be addressed contractually.
EN 9100: the additional requirements specific to aerospace and defence
EN 9100 (the European equivalent of North American AS9100 and Japanese JISQ 9100) incorporates the entirety of ISO 9001 and adds approximately 150 additional requirements specific to the aerospace, space, and defence sectors. This point is fundamental: a subcontractor certified to EN 9100 is automatically compliant with ISO 9001, but the reverse is not true.
These additional requirements address specific areas that correspond to the characteristics of high-criticality precision machining:
- Configuration management: traceability of part definition revision levels throughout the product lifecycle, with controlled document changes.
- First Article Inspection (FAI): a formal first article inspection is required before any series delivery, in accordance with defined requirements.
- Special process control: specific qualification of processes whose results cannot be fully verified after the fact (surface treatments, non-destructive testing).
- Operational risk management: formal risk analysis related to manufacturing, going beyond simple nonconformity identification.
- Flow-down of requirements: the subcontractor is required to pass applicable requirements down to its own suppliers of materials and services.
- Mandatory change notification: any change to a process, piece of equipment, or sub-supplier must be notified to the customer before implementation.
- Prevention of counterfeit or suspect parts: specific provisions are required to detect and contain components of dubious origin within the supply chain.
The relationship with NADCAP certification
EN 9100 is often mentioned alongside — but should not be confused with — NADCAP certification (National Aerospace and Defense Contractors Accreditation Program). NADCAP specifically covers special processes used in aerospace manufacturing: heat treatment, non-destructive testing, chemical milling, and coatings. A shop can be certified to EN 9100 without NADCAP accreditation, but for certain structural or engine part manufacturing sequences, both requirements apply simultaneously. Customers must distinguish between these two levels in their quality specifications.
Comparison table: 8 critical differences between the two standards
| Area | ISO 9001 | EN 9100 |
|---|---|---|
| First Article Inspection (FAI) | Not required | Formally required |
| Configuration management | Not required | Required (revision level traceability) |
| Special process control | Generic (production control) | Specific qualification required |
| Operational risk analysis | General risk-based approach | Formalised methodology required |
| Change notification | Not required | Mandatory before implementation |
| Flow-down of requirements | Supplier control | Explicit pass-down of customer requirements |
| Counterfeit parts prevention | Not required | Specific provisions required |
| Part-number-level control plan | Not required | Expected within the quality plan |
How the end-use sector of your part determines which certification to require
The primary criterion is not the part itself, but its functional and regulatory destination. The same five-axis milling operation may fall under ISO 9001 or EN 9100 depending on whether the part ends up in a standard industrial assembly or in an aircraft subject to airworthiness certification.
When ISO 9001 is sufficient
For parts intended for machine tools, conventional energy equipment, tooling, or unregulated industrial machinery, ISO 9001 is a relevant and proportionate requirement. It ensures a documented system, basic traceability, and structured quality issue handling. Residual risk is managed through other means: contractual inspection plans, incoming inspection, and required manufacturing records.
When EN 9100 becomes essential
As soon as a machined part enters a system subject to airworthiness regulation (Part 21 / EASA), defence requirements, or space programmes, EN 9100 is no longer optional. This is not merely a question of internal rigour: it is a flow-down requirement. Tier-1 customers (aerospace OEMs, prime defence contractors) contractually pass this requirement down through their entire machining supply chain. A shop without EN 9100 certification cannot legally be part of that chain for the parts concerned.
Industrial clusters with a high concentration of precision machining shops — such as those around Clermont-Ferrand, Thiers, Issoire, or Riom in France — clearly illustrate this dual reality: shops focused on general mechanical engineering (ISO 9001) coexist with EN 9100-certified operations supplying aerospace equipment manufacturers directly. A subcontractor's certification reflects its market positioning.
The contractual clauses needed to require and verify supplier certification
Stating "EN 9100 certified" in a tender document is not enough. A robust contractual requirement must specify several complementary elements.
Precise identification of the certification scope
An EN 9100 certificate covers a defined scope. A shop may be certified for machining aluminium parts but not for stainless steels or titanium alloys. The contractual clause must require that the certification scope explicitly covers the part families and materials relevant to the order.
Obligation to verify through the OASIS database
The OASIS database (Online Aerospace Supplier Information System) is the global reference for verifying active EN 9100 certifications. It allows you to confirm that a certificate is currently valid, not suspended, and that its scope matches the declared activities. The contractual clause can usefully require the supplier to maintain active status in OASIS and grant the customer the right to consult it at any time without prior notice.
Flow-down clauses
In line with EN 9100's own requirements, the contract must stipulate that the subcontractor is required to pass applicable requirements down to its own suppliers of materials, semi-finished products, and services (treatments, inspections). This clause is particularly important for controlling special processes that are themselves subcontracted.
Access and audit rights
The access clause must provide the customer — and its own clients where applicable — with the right to conduct supplier audits at the shop, with reasonable notice or, for justified cause, without notice. It may include the right to access quality records, manufacturing files for delivered parts, and internal audit results.
Change notification obligation
Any significant change — a new subcontractor, a modification to the manufacturing routing, a change in production or inspection equipment, or a shop relocation — must be notified before implementation. This clause, directly drawn from EN 9100 requirements, protects the customer against silent drift that would only come to light upon a field nonconformity.
Records and traceability requirements
Specifying the minimum retention period for quality records (manufacturing files, inspection reports, material certificates) is essential, particularly for long-service parts. In aerospace, retention periods of ten to twenty years are common. This requirement must appear explicitly in the contract and not be left to the subcontractor's discretion.
Surveillance audits and renewal: what to monitor as a customer
Holding a valid certificate is a starting point, not a permanent guarantee. The third-party certification system provides for annual surveillance audits and triennial renewal. Between two audits, drift is possible.
Warning signs to watch for
An informed customer monitors several indicators without waiting for the renewal audit:
- an increase, even slight, in the incoming nonconformity rate;
- repeated delays in responding to corrective action requests;
- significant turnover in the shop's quality function;
- outdated quality documents when a records request is made;
- "suspended" or "withdrawn" status in the OASIS database.
Structuring your own supplier audit
A customer-led supplier audit should not replicate a third-party certification audit. Its purpose is different: to verify that the system in place actually delivers the results required for your specific parts. Priority areas to cover include a review of manufacturing routings for your part numbers, control and calibration of dimensional inspection equipment, raw material management (certificates, heat traceability), and operator qualification on critical workstations.
An effective audit always includes a walk-through of the production floor, not just a meeting with the quality manager. Direct observation of the workstation, in-process part handling, and production records often reveals gaps that documents alone do not show.
Practical cases: when ISO 9001 is enough and when EN 9100 becomes essential
Case 1: machining subcontracting for the food processing industry or tooling
A customer sourcing machined parts for packaging lines or injection moulds has no regulatory basis for requiring EN 9100. ISO 9001 covers the relevant requirements: production consistency, basic traceability, and structured nonconformity handling. Requiring EN 9100 in this context would artificially narrow the supplier panel without delivering any real added value in terms of risk control.
Case 2: structural parts for a Tier-2 aerospace equipment manufacturer
An equipment manufacturer producing structural sub-assemblies for an airframe OEM contractually flows down its Tier-1 customer's requirements. EN 9100 certification of its machining suppliers is a non-negotiable flow-down requirement in this context. A shop certified only to ISO 9001 cannot be part of that supply panel — regardless of its actual performance — because it does not have the formal framework required for configuration management, FAI, and change notification.
Case 3: parts for the medical device sector
The medical device sector has its own standard (ISO 13485) which, like EN 9100, builds on ISO 9001 and adds sector-specific requirements. For machined parts entering medical devices, ISO 13485 takes precedence over EN 9100. This case illustrates the logic common to all these standards: ISO 9001 is the universal foundation, and each regulated sector grafts its own specific requirements onto it.
Case 4: a multi-sector shop supplying several industries
A precision machining shop working for both aerospace and general industry may choose to certify its entire quality system to EN 9100, which automatically covers ISO 9001. This approach simplifies internal document management and strengthens credibility across its entire customer base. It does, however, carry a higher maintenance cost, which is only justified if aerospace or defence business represents a significant share of turnover.
Frequently asked questions
Is a subcontractor certified to EN 9100 automatically compliant with ISO 9001?
Yes. EN 9100 incorporates the full requirements of ISO 9001 and adds further requirements specific to the aerospace, space, and defence sectors. A valid EN 9100 certificate therefore covers ISO 9001 requirements without the need for a separate certificate. The reverse is not true: an ISO 9001 certification alone does not cover the requirements specific to EN 9100.
How can you verify that a subcontractor is genuinely certified to EN 9100 and that the certificate is active?
The OASIS database (Online Aerospace Supplier Information System) is the global reference for this verification. It lists active, suspended, and withdrawn EN 9100 certifications, together with the exact scope covered. Any customer can access it to check a supplier's status before placing an order, and can incorporate this check into their supplier qualification procedures.
Can contractual requirements go beyond ISO 9001 without imposing EN 9100?
Yes. A contractual quality specification can supplement ISO 9001 certification requirements by explicitly imposing practices such as First Article Inspection, a part-number-level control plan, or a change notification obligation. This approach works well for sectors that have no reason to require EN 9100 but want a higher level of control than the general standard prescribes. It does, however, require the customer to have the resources to verify these additional requirements during supplier audits.
Does EN 9100 certification cover special processes such as heat treatment?
EN 9100 requires that special processes be qualified and controlled, but the standard does not itself define the technical criteria for that qualification. For special processes in aerospace, NADCAP certification is the complementary reference. A shop can be certified to EN 9100 without NADCAP accreditation, but for parts whose manufacturing sequence includes critical special processes, customers typically require both levels simultaneously.
What quality records retention period should be required in an aerospace machining subcontracting contract?
There is no universal duration set by EN 9100 itself: the standard requires that a retention period be defined, documented, and respected. In practice, aerospace customer requirements typically range from ten to twenty years, depending on the criticality of the parts and their expected service life. This duration must be stated explicitly in the subcontracting contract, because in the absence of a contractual stipulation, the shop will apply its own rules, which may fall short of the customer's actual needs.