Certification - The Standards Navigator

MDSAP vs ISO 13485: What’s the Difference and Do You Need Both in 2026?

MDSAP and ISO 13485 are often confused, but they answer different questions. This guide breaks down how the MDSAP audit program relates to the ISO 13485:2016 standard, what changed with FDA’s 2026 QMSR, and which manufacturers actually need MDSAP registration.

Whether the MDSAP consolidated audit program adds real value to your QMS — or scope you don’t need yet.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Two Audits, One QMS Standard — and a Decision Most Manufacturers Get Wrong

MDSAP vs ISO 13485 is a distinction worth getting right before you scope an audit program: these are not competing options, and they are not two paths to the same certificate. Treating them as interchangeable is exactly how manufacturers end up either over-auditing themselves or discovering — mid-application — that a market they assumed was covered isn’t.

If you sell into more than one of the five MDSAP countries, this decision affects your audit calendar, your registrar spend, and your regulatory submission timeline for years. If you sell only into the EU or UK, most of what follows doesn’t apply to you at all — and that’s worth knowing before you spend a quarter evaluating a program you don’t need.

This guide breaks down exactly what MDSAP is, how it relates to ISO 13485:2016, and — now that the FDA’s Quality Management System Regulation has replaced the legacy 21 CFR Part 820 — what changed for US-market manufacturers in 2026.

From the Floor: With 25+ years in heavy industrial manufacturing and a certified ISO 9001 Internal Auditor credential, I’ve seen the same regulated-QMS failure pattern show up regardless of which standard is on the cover — 9001 or 13485. It’s not missing documentation. It’s documentation that exists but doesn’t connect: a CAPA log that references a nonconformance report that was never actually closed out in the corrective action file. Stack five regulatory authorities’ expectations on top of each other instead of one, and that gap can become a nonconformity that appears in the MDSAP audit record used by the participating Regulatory Authorities.

Before you evaluate MDSAP, confirm your QMS actually conforms to ISO 13485:2016 first — MDSAP audits against it, it doesn’t substitute for it. Run the free ISO 13485 Gap Assessment Checklist and see exactly where your documentation stands before you add audit scope on top of it.

In This Guide

What MDSAP actually is, and how it relates to ISO 13485:2016
A side-by-side comparison of both frameworks
What changed in 2026 with the FDA’s QMSR and the revised MDSAP Audit Approach
Decision-stage signals for whether MDSAP applies to your business
What MDSAP costs — and what it saves — compared to separate country audits
Documentation issues that can create problems in MDSAP-scope audits
A readiness checklist and answers to the questions manufacturers ask most

👉 Start Here (Top Resources)

Own the standard MDSAP is built on: ISO 13485:2016 — ANSI Webstore — the foundation document every MDSAP audit is measured against. Use code CC2026 for 5% off through December 31, 2026.
Close documentation gaps before you’re audited on them: 9001Simplified — documentation kits built for manufacturers assembling or tightening a QMS without hiring a full-time consultant.
Get your team trained on the underlying requirements: ISO 13485 Training — BSI Group — BSI is one of the Auditing Organizations recognized under MDSAP, and their training builds the ISO 13485 foundation your audit is scored against.

What Is ISO 13485, and What Is MDSAP Built on Top Of It?

ISO 13485:2016 is the quality management system standard for medical device manufacturers. It’s a standalone document you can certify to on its own — covered in detail in our What Is ISO 13485 guide.

MDSAP (Medical Device Single Audit Program) is not a standard. It’s a regulatory audit program. Five participating Regulatory Authorities — Australia’s TGA, Brazil’s ANVISA, Health Canada, Japan’s MHLW/PMDA, and the U.S. FDA — use a single consolidated audit, conducted by an MDSAP-recognized Auditing Organization, to assess the applicable QMS and regulatory requirements across participating markets, rather than requiring separate audits from each regulator. That audit is scored against ISO 13485:2016 as the baseline, with country-specific regulatory requirements layered on top for each market a manufacturer participates in.

Standalone ISO 13485 certification, by contrast, is issued by certification bodies accredited through national accreditation bodies — in the US, that’s typically ANAB. MDSAP Auditing Organizations go through a separate recognition process run directly by the participating Regulatory Authorities, not through the standard accreditation pathway.

In plain terms: ISO 13485 is what you’re audited against. MDSAP is who accepts that audit, and how many regulators it satisfies at once.

Quick Answer

Question	Quick Answer
Is MDSAP the same as ISO 13485?	No. MDSAP is a multi-country regulatory audit program built on top of ISO 13485:2016 — it doesn’t replace the standard, it audits against it plus country-specific requirements.
Do I need ISO 13485 certification before MDSAP?	No. Your QMS must conform to ISO 13485:2016, but you don’t necessarily need a separate ISO 13485 certificate before undergoing an MDSAP audit — the MDSAP audit itself assesses that conformance.
Is MDSAP required?	Only for Class II–IV Canadian market access. In the other participating MDSAP markets, participation is generally voluntary, although it can consolidate applicable regulatory assessments across multiple markets.
Does MDSAP replace FDA inspections entirely?	No. MDSAP audit results can be used by FDA within its regulatory program, but FDA retains its authority to conduct inspections, including for-cause inspections.

MDSAP vs ISO 13485: Side-by-Side

Category	ISO 13485:2016	MDSAP
What it is	A quality management system standard	A multi-jurisdiction regulatory audit program
Basis	Standalone document	Built on ISO 13485:2016 plus country-specific regulatory requirements
Who administers it	Certification bodies accredited by ANAB or an equivalent accreditation body	Auditing Organizations recognized by the five participating Regulatory Authorities
Countries covered	Global — recognized wherever ISO 13485 certification is accepted	Australia, Brazil, Canada, Japan, United States
Can you buy it?	Yes — it’s a purchasable standard document	No — it’s an audit program, not a document
Mandatory?	Often required by customers, notified bodies, or regulators (EU MDR, for example)	Mandatory only for Class II–IV Canadian market access; voluntary elsewhere
Audit frequency	Per your certification body’s surveillance schedule — typically annual	Initial audit followed by annual surveillance audits within the certification cycle
What you get	An ISO 13485 certificate	An MDSAP certification document and audit report each participating Regulatory Authority can use within its own regulatory program

For the broader question of how ISO 13485 stacks up against the standard most manufacturers compare it to first, see ISO 9001 vs ISO 13485.

The 2026 Regulatory Shift: QMSR and the Revised MDSAP Audit Approach

MDSAP vs ISO 13485 infographic showing the 2026 FDA QMSR transition and changes to medical device quality records — MDSAP vs ISO 13485: The 2026 FDA QMSR aligns U.S. medical device quality requirements with ISO 13485:2016 and changes FDA access to management review, internal audit, and supplier audit records.

Two changes landed in 2026 that directly affect this comparison.

On February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) officially took effect, replacing the legacy 21 CFR Part 820 Quality System Regulation and incorporating ISO 13485:2016 by reference. That doesn’t make US manufacturers MDSAP-compliant automatically — it means the US regulatory baseline now speaks the same structural language as ISO 13485, closing a gap that used to require manufacturers to maintain two separate documentation logics. We cover the mechanics of that shift in FDA QSR vs ISO 13485.

The QMSR also removed a long-standing FDA inspection exemption. Under the prior QSR, §820.180(c) shielded management review records, internal quality audit reports, and supplier audit reports from routine FDA inspection. The QMSR eliminates that exemption entirely — FDA’s own QMSR FAQ confirms investigators now have authority to review management review, quality audit, and supplier audit records as part of a standard inspection. For manufacturers who treated those records as internal-only, that’s a meaningful shift in what “audit-ready” documentation needs to look like.

Around the same window, the MDSAP Regulatory Authority Council released a revised Audit Approach document (MDSAP AU P0002.010), updating the audit sequence and process guidance auditors use during MDSAP assessments. If your last MDSAP audit was conducted under the prior version, don’t assume your documentation package is still current against the revised approach — verify against the current edition before your next audit window.

It can be tempting to assume that QMSR compliance automatically covers MDSAP scope. It doesn’t — QMSR alignment closes the gap between the US baseline and ISO 13485, but MDSAP still layers the applicable regulatory requirements of each participating jurisdiction on top of that baseline. Check where your QMS actually stands before you assume you’re covered → Run the ISO 13485 Gap Assessment Checklist.

Do You Need MDSAP? Decision-Stage Signals

If you are selling only into the EU or UK → you still need to meet the applicable medical-device QMS and conformity-assessment requirements for those markets, but MDSAP is not generally required there.
If you are selling into Canada at Class II, III, or IV → MDSAP is mandatory. Health Canada requires an MDSAP certificate, issued by a recognized MDSAP Auditing Organization, as part of the device license application.
If you sell into several of the five MDSAP countries → compare the cost and disruption of MDSAP against the separate regulatory assessments that would otherwise apply. Three or more can be a useful practical threshold for comparison, but the right number depends on your specific audit costs, inspection history, device scope, and market plans.
If you are already ISO 13485 certified and sell only into the US → weigh MDSAP against your actual FDA inspection frequency and any near-term expansion plans before adding audit scope you may not need yet.

MDSAP decision flowchart showing when medical device manufacturers need MDSAP for Canada and when it is generally voluntary in other markets — A practical MDSAP decision guide showing when certification is required for Canadian Class II–IV devices and when manufacturers should evaluate MDSAP based on market scope, audit costs, and regulatory strategy.

What MDSAP Actually Costs You — And What It Saves

The most common objection we hear is straightforward: MDSAP audits cost more than a standard ISO 13485 surveillance audit, so why add the expense?

That’s true in isolation — an MDSAP audit typically runs longer and costs more per audit day than a single-standard ISO 13485 surveillance visit, because the auditor is assessing conformance to multiple regulatory frameworks in one visit. But the comparison that matters isn’t MDSAP audit cost versus ISO 13485 audit cost. It’s MDSAP audit cost versus the combined cost of separate inspections from Health Canada, ANVISA, TGA, and PMDA, run independently, on different schedules, each requiring separate audit prep. For manufacturers selling across several MDSAP markets, the consolidation can make the overall audit program less costly and less disruptive than managing multiple separate regulatory assessments — but the business case depends on device classification, facility count, audit scope, your Auditing Organization, and your existing inspection cadence, so get a scoped quote rather than budgeting off a generic number.

Manufacturers building out documentation to support a broader audit scope shouldn’t be doing it from scratch. If your QMS documentation isn’t structured to hold up under multiple regulatory frameworks at once, that’s the gap to close first → 9001Simplified’s documentation kits are built for exactly this kind of consolidation work.

Documentation Issues That Can Create Problems in MDSAP Readiness

One area worth checking closely is CAPA traceability. CAPA records should connect clearly to the underlying nonconformance, investigation, corrective action, and effectiveness evidence, rather than leaving the auditor to reconcile separate systems manually — see our breakdown of common mistakes in ISO 13485 QMS implementation and the full CAPA requirements under ISO 13485 for what auditors expect to see connected.

Another area to review is how regulatory requirements are mapped into the QMS. MDSAP audits ISO 13485 alongside applicable jurisdiction-specific requirements, so documentation that only reflects one regulator’s language may need additional mapping before an MDSAP audit. Our guide on ISO 13485 documentation requirements covers how to structure it correctly the first time.

MDSAP vs ISO 13485 readiness infographic showing CAPA traceability, document control, regulatory mapping, internal audits, and audit evidence — MDSAP vs ISO 13485: MDSAP readiness depends on connected evidence across CAPA, document control, regulatory mapping, internal audits, and market scope.

MDSAP Readiness Checklist

✅ QMS is currently certified — or verified compliant — to ISO 13485:2016
✅ CAPA records cross-reference nonconformance reports within the QMS itself, not a separate tracking tool
✅ Document control system is organized by ISO 13485 clause structure, not by individual regulator language
✅ You’ve confirmed which of the five MDSAP countries you actually sell into or plan to
✅ You’ve reviewed your documentation against the revised MDSAP Audit Approach (AU P0002.010)
✅ You’ve scoped audit cost and timeline with an MDSAP-recognized Auditing Organization
✅ Internal audit process already traces process interactions, not just individual clause compliance — see how to audit a medical device QMS

Frequently Asked Questions

Is MDSAP the same thing as ISO 13485?

No. ISO 13485:2016 is the quality management system standard. MDSAP is a regulatory audit program that assesses conformance to that standard, plus country-specific requirements from five participating Regulatory Authorities, in a single consolidated audit.

Do I need to be ISO 13485 certified before I can apply for MDSAP?

Your QMS needs to conform to ISO 13485:2016 — MDSAP auditors assess that conformance directly as part of the MDSAP audit itself. In practice, most manufacturers already hold or are pursuing ISO 13485 certification before entering the MDSAP process.

Which countries does MDSAP cover?

Five participating Regulatory Authorities: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW/PMDA), and the United States (FDA). A number of other regulators participate as observers or affiliate members without full recognition of MDSAP audit results.

Is MDSAP required to sell medical devices in the United States?

No. The FDA accepts MDSAP audit results as part of its compliance program, and the 2026 QMSR incorporates ISO 13485:2016 by reference, but MDSAP participation itself remains voluntary for US-only manufacturers.

How did the FDA’s 2026 QMSR change affect MDSAP?

The QMSR, effective February 2, 2026, replaced 21 CFR Part 820 and incorporated ISO 13485:2016 by reference — narrowing the gap between US regulatory expectations and the ISO 13485 baseline that MDSAP already audits against. It doesn’t grant automatic MDSAP compliance; it changes what the US regulatory floor requires your documentation to look like.

How much does an MDSAP audit cost compared to a standard ISO 13485 audit?

MDSAP audits generally run longer and cost more per audit than a single-standard ISO 13485 surveillance audit, since the scope covers multiple regulatory frameworks in one visit. Pricing varies significantly by Auditing Organization, facility count, and audit scope — get a quote scoped to your specific situation rather than relying on a general figure.

Can a small manufacturer participate in MDSAP?

Yes. Any manufacturer with a product that falls under the scope of at least one participating Regulatory Authority may apply. It tends to make the most financial sense for manufacturers selling into several of the five MDSAP countries, where consolidating audits can produce clearer savings — though the exact threshold depends on your specific cost structure.

Does an MDSAP certificate replace my ISO 13485 certificate?

Not automatically, and it depends on the market. In Canada, the MDSAP certificate has replaced the standalone ISO 13485 certificate in the device license application process for Class II–IV devices. In most other participating markets, manufacturers typically maintain both, since ISO 13485 certification is often required independently by customers or notified bodies.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements before pursuing MDSAP or standalone certification.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification.

Not Sure What to Do Next?

🔹 Still researching whether MDSAP applies to you? Start with the ISO 13485 Gap Assessment Checklist — confirm your QMS conforms to ISO 13485:2016 before you evaluate adding MDSAP scope on top of it.

🔹 Ready to close documentation gaps before your next audit? 9001Simplified’s documentation kits are built for manufacturers structuring a QMS to hold up under more than one regulatory framework at once.

🔹 Need to buy the ISO 13485:2016 standard itself? Get it directly from ANSI Webstore — code CC2026 takes 5% off through December 31, 2026.

🔹 Want your team trained on the requirements before your MDSAP audit? BSI Group’s ISO 13485 training builds the foundation MDSAP auditors score against.

MDSAP isn’t a bigger version of ISO 13485 certification — it’s a different question entirely: not “is your QMS compliant,” but “how many regulators can rely on the same answer.” Get that distinction right before you scope an audit program you may not need, or miss one you do. The Standards Navigator will keep tracking how MDSAP and the 2026 QMSR shift continue to interact as more guidance comes out.

Stay Ahead of the Next Regulatory Shift

Manufacturers who treat MDSAP as “extra paperwork” usually find out the hard way — mid-application, with a Canadian import deadline already on the calendar. Manufacturers who map their audit scope to their actual markets first spend less on audits and never scramble for a certificate they didn’t know they’d need.

The Standards Navigator tracks how ISO 13485, MDSAP, and FDA’s QMSR continue to shift against each other so you don’t have to monitor five regulators’ guidance pages yourself.

👉 Get updates on medical device compliance and regulatory changes as they happen
👉 Be first to access new gap assessment tools and documentation resources as we build them

Industrial Compliance. Clearly Explained.

AS9100 Internal Audit Process: A Step-by-Step Guide for 2026

AS9100 Clause 9.2 requires more than an ISO 9001 internal audit program — customer and regulatory requirements have to be built into your audit criteria, and results have to reach management. This guide breaks down the six-part audit workflow, what a real internal audit checklist should cover, how findings feed into management review and AS9101 reporting, and the objectivity gap that trips up small aerospace quality teams.

How aerospace suppliers plan, conduct, and close out a Clause 9.2-compliant internal audit program

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Your Internal Audit Program Is What Helps Keep Your AS9100 Certification Credible

An AS9100 certificate doesn’t prove your QMS is working. Your AS9100 internal audit process helps prove that it is.

Most operations managers treat internal audits as a compliance formality — something to schedule before the registrar shows up, not something that actually finds problems. That approach works right up until a surveillance audit surfaces a nonconformance your own internal audit should have caught six months earlier. At that point, the registrar isn’t just questioning the finding. They’re questioning whether your internal audit program is real.

If you’re already certified and running audits on autopilot, or preparing for your first AS9100 certification and building this process from scratch, the standard is specific about what “real” looks like. Clause 9.2 lays out exactly what your internal audit program has to prove, and AS9100 Rev D adds requirements ISO 9001 doesn’t have.

From the Floor: I’ve sat in gap assessment meetings where the documented internal audit schedule looked airtight on paper — every process, every quarter, neatly assigned. Then you pull the actual audit records and half of them are checklist walk-throughs with no objective evidence attached, no findings, no closure dates. An auditor doesn’t need long to spot the difference between an internal audit program that’s running and one that’s just being logged.

👉 Before you build or rebuild your internal audit program, run the AS9100 Rev D Gap Assessment Checklist — a 74-item, clause-by-clause tool that shows you exactly where your current audit coverage has gaps before an external auditor finds them for you.

In This Guide

What Clause 9.2 actually requires, and where AS9100 goes beyond ISO 9001
The six-step internal audit process defined in Clause 9.2.2
How internal audit findings feed into management review and AS9101 reporting
A ready-to-use internal audit checklist structure
Common mistakes that turn a real audit program into a paperwork exercise
Where to buy the standard and where to get trained on running compliant audits

👉 Start Here (Top Resources)

AS9100D — ANSI Webstore — the current edition of the standard, including the exact Clause 9.2 language your audit program has to satisfy. Use coupon code CC2026 for 5% off through December 31, 2026.
ISO 19011:2018 — ANSI Webstore — the audit guidelines standard referenced directly by AS9100 internal audit resources; worth owning if you’re training internal auditors.
AS9100 Training — BSI Group — for teams that need to formally qualify internal auditors on AS9100-specific requirements, not just general ISO 9001 audit technique.

What Clause 9.2 Actually Requires

Clause 9.2.1 requires you to conduct internal audits at planned intervals to determine whether your quality management system conforms to three things: your own organization’s requirements, the AS9100 standard itself, and the QMS is effectively implemented and maintained. That’s the ISO 9001 baseline.

AS9100 Rev D builds directly on that clause text. Under the standard’s Annex L structure, the aerospace-specific language is written straight into Clause 9.2.1 itself: your organization’s requirements for internal audit purposes must explicitly include customer requirements and applicable statutory and regulatory requirements — not just your internal procedures. That’s not guidance layered on top of ISO 9001; it’s part of the clause language you’re audited against. Audit results also have to be reported to relevant management, not just filed.

Most common finding: Internal audit programs that check ISO 9001 conformance thoroughly but never verify against a specific customer’s flow-down requirements or purchase order quality clauses. That’s a Clause 9.2 gap I commonly see when aerospace suppliers transition from ISO 9001 to AS9100.

ISO 9001 Baseline (Clause 9.2)	Aerospace-Specific Clause 9.2 Language (Annex L Addition)
Conformance to the organization’s own QMS requirements	Must explicitly include customer, statutory, and regulatory requirements
Conformance to the standard	AS9100 Rev D requirements, including its aerospace-specific additions
Effective implementation and maintenance	Results must be reported to relevant management, feeding directly into management review

If you are preparing for your first AS9100 certification → build your audit criteria around customer and regulatory requirements from day one, not as an afterthought once ISO 9001 conformance is handled.

👉 Need to see the exact Clause 9.2 language for yourself before you build your audit program around it? Get the current AS9100D edition from the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

The AS9100 Internal Audit Process: A Six-Part Workflow Built From Clause 9.2.2

AS9100 audit program showing risk-based planning, audit frequency, previous findings, and an annual internal audit schedule in an aerospace manufacturing facility — A risk-based AS9100 audit program considers process importance, changes, previous findings, and risk when establishing the internal audit schedule.

Clause 9.2.2 lays out the requirements your audit program has to satisfy — the audit program itself, planning and conduct, auditor objectivity, reporting, corrective action, and retained documented information. Read together, that maps cleanly onto six practical steps, and an auditor will ask about all six.

1. Audit Program

Establish, implement, and maintain an audit program that identifies frequency, methods, responsibilities, planning requirements, and reporting. This has to account for the importance of the processes involved, changes affecting your organization, and the results of previous audits — not a static calendar you set once and never revisit.

2. Audit Criteria and Scope

Define what standard, procedure, or requirement each audit is measured against, and how far that audit reaches — which processes, which shifts, which locations if you run more than one facility.

3. Auditor Selection

Select auditors and conduct audits in a way that ensures objectivity and impartiality. Nobody audits their own work. On a small quality team this is often the hardest requirement to satisfy on paper — it usually means cross-training auditors across departments so a floor supervisor never audits the process they run.

4. Reporting Results

Audit results go to relevant management — not just the quality manager’s file. If a finding touches production scheduling, engineering, or purchasing, that function’s management needs visibility into it.

5. Corrective Action

Take appropriate correction and corrective action without undue delay when nonconformities are found. “Without undue delay” is intentionally vague in the standard, but in practice, your corrective action process should establish a documented target closure date appropriate to the severity of the finding — an open-ended promise to “look into it” won’t hold up as objective evidence of an effective process.

6. Retained Documentation

Keep documented information as evidence of the audit program’s implementation and the audit results. These are among the first records an external auditor is likely to examine: not your procedure, but your actual audit records — schedules, checklists, findings, objective evidence, and closure dates.

👉 If your audit records are more calendar than evidence, that’s the gap that surfaces during a surveillance audit — not a certification audit. Run the gap assessment checklist against your current program before your next registrar visit, not after.

AS9100 internal auditor reviewing work instructions, actual work, inspection records, and objective evidence on an aerospace manufacturing floor — An effective AS9100 internal audit follows the evidence from documented procedures to actual work, inspection records, and process effectiveness.

What Should an AS9100 Internal Audit Checklist Include?

A checklist built only around ISO 9001 clause conformance misses the aerospace-specific scope Clause 9.2.1 actually requires. Use this as the framework for what each internal audit needs to cover:

Audit Area	What the Auditor Should Verify
Process requirements	Applicable AS9100 clauses and internal procedure requirements
Customer requirements	Purchase order and contract flow-down requirements
Regulatory requirements	Applicable statutory and regulatory obligations
Objective evidence	Actual records and direct observations, not verbal confirmation
Process effectiveness	Whether the process is achieving its intended result, not just running
Findings	Nonconformities clearly supported by objective evidence
Corrective action	Root cause analysis, corrective action, and verification of effectiveness
Follow-up	Closure evidence and confirmation the fix actually worked

If your operation also carries program-specific deliverables under AS9145 (APQP and PPAP), extend your audit criteria to those documents too — see AS9145 Explained for what’s typically in scope. And if any of your special processes are already covered under NADCAP, coordinate your internal audit scope so you’re not duplicating external oversight — NADCAP vs AS9100 breaks down where the two programs overlap and where they don’t.

AS9100 corrective action workflow showing audit finding, containment, root cause analysis, corrective action, effectiveness verification, and closure — An AS9100 corrective action is not complete until the organization verifies that the action worked and documents the results.

How Internal Audit Results Feed Into Management Review

Internal audit findings aren’t the end of the process — Clause 9.3 requires them as an input into management review. Corrective actions from internal audits, along with trending data like recurring nonconformities, similar issues across multiple processes, and top process concerns, should show up as agenda items top management actually discusses. That requirement comes from your QMS’s management review clause, not from any external audit form.

Separately, when your registrar conducts your certification or surveillance audit, results get documented on AS9101 — the standardized audit report form referenced by SAE International and logged in the IAQG OASIS database. AS9101 doesn’t dictate what your internal management review has to look like. But an external auditor completing that form will ask to see your management review minutes, and if internal audit trends never make it into those minutes, that gap is easy to spot — not because AS9101 requires a specific format, but because the disconnect itself signals the management review process isn’t functioning as intended.

If you are already ISO 9001 certified and adding AS9100 → your internal audit process likely doesn’t need to change structurally. What changes is audit criteria — you now have to audit against customer and regulatory requirements your ISO 9001 program never had to touch, and management review needs a direct line from audit findings to those aerospace-specific requirements.

Objection: “We Don’t Have Staff to Audit Objectively”

This is the most common pushback on small aerospace shops — a 15-person quality team can’t realistically avoid people auditing processes adjacent to their own work.

It’s a real constraint, but it’s manageable without adding headcount. Cross-train two or three people across departments so each can audit outside their own process. A machinist trained as an internal auditor can objectively audit the receiving inspection process; the receiving inspector can objectively audit machining documentation. Registrars don’t require a dedicated audit department — they require evidence that whoever conducted the audit had no stake in the outcome. Document that logic in your audit program procedure, and it holds up.

Quick Internal Audit Readiness Checklist

✅ Audit program covers all applicable processes at a frequency justified by risk and past findings

✅ Audit criteria explicitly reference customer purchase order requirements, not just internal procedures

✅ Auditors are demonstrably independent of the process they’re auditing

✅ Findings include objective evidence — not just a pass/fail checkbox

✅ Corrective actions have documented target closure dates

✅ Audit results appear as a distinct agenda item in management review minutes

⚠️ If any of these are missing, that’s the gap a registrar finds before you do

Frequently Asked Questions

What does Clause 9.2 of AS9100 actually require?

Clause 9.2 requires organizations to run internal audits at planned intervals to confirm the QMS conforms to the organization’s own requirements — which under AS9100 must include customer, statutory, and regulatory requirements — conforms to the AS9100 standard itself, and is effectively implemented. Results must be reported to relevant management.

How often do AS9100 internal audits need to happen?

The standard doesn’t set a fixed interval. Frequency has to be justified by the importance of the process, the results of previous audits, and any changes affecting the organization. Higher-risk processes — special processes, product safety-critical operations — typically warrant more frequent audits than lower-risk administrative processes.

Can one person run the entire internal audit program on a small team?

Generally, yes, as long as objectivity is maintained. The requirement is independence from the process being audited, not a minimum team size. On very small teams this can require creative scheduling or occasionally bringing in an outside auditor for processes where no internal person can honestly claim independence.

Do internal audit findings have to be reported to the registrar?

No. Internal audit results are reported to your own relevant management, not to the certification body. The registrar reviews your internal audit records and evidence of corrective action during surveillance and recertification audits — they don’t need real-time reporting.

What’s the difference between an internal audit and the AS9101 certification audit?

Your internal audit program is something you run yourselves, on your own schedule, against your own and the standard’s requirements. AS9101 is the standardized form your registrar uses to document the results of your external certification and surveillance audits, which then get logged in the IAQG OASIS database. A strong internal audit program is largely what prepares you to pass the AS9101-documented external audit cleanly.

Can internal audits be conducted remotely?

The standard doesn’t prohibit it, and many quality teams do conduct document reviews and some process audits remotely. Physical, in-person audits are still strongly preferred for shop floor processes where objective evidence — traveler stamps, calibration tags, first article records — needs to be directly observed rather than described.

What happens if our internal audit program has gaps when the registrar shows up?

It depends on severity and pattern, and classification is ultimately the auditor’s call based on the evidence in front of them. An isolated missed audit interval on a low-risk process may be treated differently from a persistent systemic failure, depending on the evidence and the auditor’s assessment. A pattern of audits with no objective evidence, no findings ever recorded, or no connection to management review calls into question whether the QMS’s self-monitoring is functioning at all — which is the kind of gap that tends to draw closer scrutiny.

Is a documented procedure enough, or do we need to prove the audits actually happened?

A procedure alone isn’t enough. Registrars expect to see the records: audit schedules, completed checklists with objective evidence, documented findings, and closure evidence for corrective actions. The procedure describes what you’re supposed to do — the records prove you did it.

📥 Free Resources

AS9100 Rev D Gap Assessment Checklist — 74-item, clause-by-clause checklist for aerospace suppliers assessing their QMS, including internal audit coverage, before certification.
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

Not Sure What to Do Next?

🔹 Still researching what AS9100 internal audits require? Start with the What Is AS9100? pillar guide, then read AS9100 vs ISO 9001 to see exactly which requirements are new to you if you’re already ISO 9001 certified.

🔹 Ready to build or fix your internal audit program? Run the AS9100 Rev D Gap Assessment Checklist against your current audit records, then check the AS9100 Implementation Timeline to see where audit program maturity fits into your certification schedule.

🔹 Need to buy the standard or get auditors trained? Get the current edition from the ANSI Webstore with code CC2026 for 5% off, and see AS9100 Certification Bodies: Ranked & Reviewed for AS9100 auditor training through BSI Group.

A weak internal audit program is one of the most common reasons a QMS that looks compliant on paper fails to hold up in front of a registrar. Build the six-step process the standard actually asks for, put real objective evidence behind every audit, and your surveillance audits stop being a surprise. That’s what The Standards Navigator’s AS9100 coverage is built around — the requirements as they’re actually enforced, not just as they’re written.

Before You Go

Most aerospace suppliers don’t lose points on AS9100 audits because they misunderstand Clause 9.2 — they lose points because their internal audit program looks good on paper and falls apart under objective evidence review.

Shops that treat internal audits as a real management tool catch their own nonconformances before a registrar does. Shops that treat them as a scheduling formality find out the hard way, usually during a surveillance audit, that “completed” and “effective” aren’t the same thing.

The Standards Navigator covers the AS9100 requirements aerospace suppliers actually get audited against — not just the clause text, but how registrars interpret it in practice.

👉 Get updates on AS9100 implementation and internal audit best practices

👉 Be first to access new aerospace gap assessment tools and checklists

Industrial Compliance. Clearly Explained.

AS9100 Certification Bodies: Ranked & Reviewed (2026)

Not every AS9100 certification body brings the same aerospace expertise to an audit. This guide breaks down what AS9100 accreditation actually requires, which certification bodies are active in the space, and the questions to ask before signing with a registrar.

Comparing accredited AS9100 registrars — what to look for, what to avoid, and which body fits your operation

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Choosing the Wrong Registrar Costs More Than the Audit

Not all AS9100 certification bodies operate the same way. Some assign a dedicated aerospace lead auditor who understands configuration management and counterfeit parts controls on sight. Others rotate generalist auditors who spend half of Stage 1 relearning your industry — and bill you for the education.

A certificate issued by an appropriately accredited certification body is intended to demonstrate conformity to the same AS9100 requirements, regardless of which body issues it. What can differ significantly is the accreditation scope, auditor expertise, scheduling, audit experience, customer acceptance, and overall certification experience. For a supplier chasing a Tier 1 customer deadline, that difference is real money and real risk.

If you’re comparing registrars for the first time, this guide breaks down what accreditation actually means, which bodies are active in the AS9100 space, and how to evaluate quotes so you’re not choosing on price alone. If you’re already certified and evaluating a switch, the sections on auditor consistency and surveillance cadence will matter most to you.

From the floor: I’ve sat through registrar selection more than once at a heavy industrial manufacturing operation — comparing quotes side by side, all technically accredited, all wildly different in price and turnaround. The number that mattered wasn’t the quote total. It was how the registrar answered questions about auditor aerospace experience, how they’d handle surveillance-audit continuity year over year, and what their process looked like if a Stage 2 audit turned up a major finding. One bidder had clearly never audited anything with configuration management or counterfeit-parts controls in scope, and it showed the moment we started asking specifics. That’s the conversation that should happen before you sign, not the one that happens after your first nonconformance over something your auditor didn’t understand.

Before you request quotes, run a clause-by-clause gap check. Most organizations don’t get burned by picking the wrong registrar — they get burned by walking into Stage 1 not knowing where their gaps are. → AS9100 Rev D Gap Assessment Checklist — 74 items, clause-by-clause, built for aerospace suppliers preparing for certification.

In This Guide

What AS9100 accreditation actually requires
How to verify a registrar is legitimately accredited
What separates a good aerospace auditor from a generalist
How these certification bodies were evaluated, and which fit different supplier profiles
Questions to ask before signing a registrar contract
Cost and timeline expectations by registrar type
What to do after you select a certification body

👉 Start Here (Top Resources)

👉 Get the official AS9100 Rev D standard before you approach any registrar → AS9100 / SAE Standards — ANSI Webstore

👉 Get your team trained on AS9100 requirements ahead of Stage 1 → BSI Group AS9100 Training

👉 Run a clause-by-clause gap check before requesting quotes → AS9100 Rev D Gap Assessment Checklist

What Does AS9100 Accreditation Actually Mean?

AS9100 certification isn’t something any registrar can simply decide to offer. Certification bodies (also called registrars or CBs) must hold appropriate accreditation and scope to issue an accredited AS9100 certificate — meaning an independent accreditation body has verified the CB is competent to audit against the standard.

For AS9100 specifically, that accreditation runs through a recognized national accreditation body — in the U.S., ANAB accredits more AS9100 certification bodies than any other accreditation body, though it isn’t the only IAF-recognized option (IAS is also recognized). Accreditation is evaluated against ISO/IEC 17021-1 plus the aerospace-specific IAQG 9104-series requirements developed by the International Aerospace Quality Group (IAQG). Holding ISO 9001 accreditation does not automatically mean a certification body also holds AS9100 accreditation — the two are evaluated and scoped separately, and a registrar without current AS9100 accreditation scope cannot issue an accredited AS9100 certificate that meets the applicable certification-scheme requirements, regardless of how experienced their auditors sound on a sales call.

This matters because a certificate from a body without properly scoped accreditation isn’t just a paperwork issue — it may not satisfy your customer’s supplier-qualification requirements, potentially costing you both certification time and audit expense.

For background on what the standard itself requires before you get to registrar selection, see What Is AS9100? and AS9100 vs ISO 9001.

How to Verify a Registrar Is Legitimately Accredited

Don’t take a sales rep’s word for current AS9100 scope. Verify it directly:

1. Check the OASIS database. The IAQG OASIS Certified Supplier Directory is the official record of AS9100-certified organizations and the certification bodies that issued their certificates. If a registrar’s certifications aren’t showing up in OASIS, that’s a serious red flag.

2. Confirm current accreditation scope directly with the accreditation body. ANAB accredits more AS9100 certification bodies in the U.S. than any other accreditation body and publishes which certification bodies hold active accreditation and what scopes each one covers — some registrars are accredited for aerospace manufacturing but not for MRO (AS9110) or distribution (AS9120). If a registrar cites a different IAF-recognized accreditation body, confirm that body’s scope listing directly rather than assuming it’s equivalent to ANAB’s.

3. Ask what your accredited scope actually covers. Rather than asking whether a registrar covers a specific code, ask: “What is your current accredited AS9100 scope, and does it cover the activities, products, and industry sector included in my proposed certification scope?” Have the registrar confirm the applicable industry and technical scope classifications directly — don’t assume a single code number settles the question.

4. Ask for the accreditation certificate, not a logo on a website. A registrar’s marketing page listing “AS9100 Accredited” isn’t proof — request the actual accreditation certificate showing current scope and expiration.

⚠️ Most common finding: Suppliers under customer pressure sometimes select a registrar based on price and turnaround time alone, without confirming current AS9100 scope in detail — then discover during Stage 2 that a scope gap means the certificate won’t satisfy their customer’s supplier requirements.

What Separates a Good Aerospace Auditor From a Generalist

AS9100 certification bodies review with an auditor examining a first article inspection report beside a precision aerospace component — Choosing the right AS9100 certification bodies means looking beyond the certificate to auditor experience and aerospace expertise.

AS9100 auditors need aerospace-specific fluency that a generalist ISO 9001 auditor may not have. This is the criteria worth keeping in mind as you read the comparisons below — it’s the difference that actually separates certification bodies in practice once you’ve confirmed that the appropriate accreditation and scope are in place. When evaluating a registrar, ask specifically about auditor experience in:

Configuration management — Clause 8.1.2’s requirements go well beyond typical ISO 9001 document control
Counterfeit parts prevention — Clause 8.1.4 requires audit-ready evidence most non-aerospace auditors have never evaluated
First article inspection (FAI) — auditors unfamiliar with the AS9102 forms published by SAE International will struggle to evaluate your FAI records meaningfully
Special processes and traceability — Clause 8.5.2 traceability requirements are more stringent than general manufacturing

If you are preparing for your first AS9100 certification → confirm the specific auditor assigned to your account has aerospace industry audit hours, not just AS9100 training credentials. Ask the registrar directly; reputable ones will tell you.

For a deeper look at the traceability and counterfeit-parts requirements auditors will actually test against, see AS9100 Traceability Requirements and AS9100 Counterfeit Parts Standards.

How These Certification Bodies Were Evaluated

Before comparing specific bodies, here’s the criteria behind the categories below:

AS9100 accreditation status and scope
Aerospace auditor availability and depth of aerospace-specific experience
Geographic coverage and multi-site capability
Ability to combine AS9100 audits with ISO 9001, ISO 14001, or other management-system audits
Fit for different supplier types — manufacturers, MRO organizations, distributors
Scheduling flexibility and certification-cycle support

These are editorial recommendations based on accreditation scope, aerospace specialization, geographic coverage, multi-standard capability, and fit for different supplier profiles — not customer satisfaction scores, audit outcome data, or any undisclosed commercial relationship. Always verify current accreditation status yourself through OASIS and ANAB before requesting quotes.

AS9100 Certification Bodies Worth Comparing

The six bodies below are established, accredited names in aerospace quality certification worth including in your quote comparison — not a claim that they’re the only six, or objectively the “best” six, available. Dozens of ANAB-accredited bodies issue AS9100 certificates. Always verify current scope through OASIS before signing with any registrar.

If you already have a strong sense of which profile matches your operation → skip to that category below rather than reading all six in order.

AS9100 certification bodies compared by aerospace focus, multi-site operations, manufacturing, and industrial certification needs — AS9100 certification bodies serve different operational needs, from aerospace-focused suppliers and multi-site operations to combined industrial certification.

Best Overall for Multi-Standard Aerospace Suppliers: BSI Group

Why I’d consider them: BSI certifies against a very wide range of standards — AS9100 alongside ISO 9001, AS9110, AS9120, ISO 14001, and most other major management-system standards. If your operation is pursuing more than one certification, or expects to add standards later, that breadth means fewer registrar relationships to manage over time. Ask specifically whether your account would be assigned one lead auditor across all standards or separate auditors per standard — that affects both cost and consistency.

Best for Aerospace-Focused Certification Experience: Perry Johnson Registrars (PJR)

Why I’d consider them: PJR maintains multiple international accreditations (ANAB, UKAS, JAB) and markets a dedicated aerospace audit staff. For a supplier whose top priority is an auditor who won’t need aerospace concepts explained from scratch, this is worth a direct conversation about auditor assignment. Ask for the assigned auditor’s aerospace sector history before you sign, not after.

Best for Manufacturers Entering Aerospace Supply Chains: NSF-ISR

Why I’d consider them: NSF-ISR has a strong general manufacturing and industrial certification presence. For a fabricator or machine shop pursuing AS9100 for the first time as a new aerospace supplier, a registrar with broad industrial-certification familiarity alongside aerospace scope can be a comfortable entry point. Ask how many first-time AS9100 clients they’ve certified in the past year — that experience matters more than tenure alone for a first certification.

Best for Global or Multi-Site Operations: DEKRA Certification

Why I’d consider them: DEKRA’s global reach and integrated auditing across multiple management-system standards make them worth considering for suppliers with international sites. If multi-site consistency is a priority, ask specifically how auditor assignment and certification scope will be coordinated across locations — that coordination is where multi-site certifications most often run into trouble.

Best for Defense and Marine-Adjacent Aerospace: ABS Quality Evaluations

Why I’d consider them: ABS has a long-standing presence in industrial and aerospace certification, with particular relevance for suppliers whose work overlaps defense or marine-adjacent aerospace segments. Ask directly whether their auditor pool has experience with your specific product category — defense-adjacent scope can carry additional documentation expectations worth confirming up front.

Best for Combined Aerospace and Industrial-Process Certification: DNV

Why I’d consider them: DNV brings deep process-industry audit experience alongside aerospace capability — a reasonable fit for suppliers whose certification needs span both aerospace and broader industrial processes. Ask whether a combined audit across your process and aerospace scopes is possible in a single visit, since that’s where DNV’s dual background can actually save audit days.

At a glance:

Best For	Certification Body
Multi-standard aerospace suppliers	BSI Group
Aerospace-focused certification experience	Perry Johnson Registrars (PJR)
Manufacturers entering aerospace supply chains	NSF-ISR
Global or multi-site operations	DEKRA Certification
Defense and marine-adjacent aerospace	ABS Quality Evaluations
Combined aerospace and industrial-process certification	DNV

For training — as distinct from certification itself — BSI also offers AS9100-specific coursework covering requirements, internal auditing, and lead auditor preparation.

→ Auditors move faster through Stage 1 when your internal team already knows the standard cold: BSI Group AS9100 Training

For a broader comparison of certification bodies across ISO standards generally — not aerospace-specific — see Best ISO Certification Bodies.

Questions to Ask Before You Sign

Bring these ten questions into every registrar call:

✅ What is your current accredited scope for AS9100, and does it cover the activities, products, and industry sector included in my proposed certification scope? (For U.S. certification bodies, confirm the applicable scope through ANAB.)
✅ Who will be the lead auditor assigned to my account, and what aerospace sectors have they audited?
✅ Will the same auditor normally return for surveillance audits, or should I expect rotation?
✅ How many aerospace-specific audits has my assigned lead auditor conducted in the past 12 months?
✅ What is your typical Stage 1 to Stage 2 turnaround time, and what is the planned audit duration?
✅ What happens if my assigned auditor becomes unavailable close to the scheduled audit date?
✅ What is included in the quoted price — are travel expenses included or billed separately?
✅ What is your nonconformance grading criteria, and what happens if Stage 2 produces a major finding?
✅ How are audit-day schedule changes typically handled?
✅ Can my certificate scope accommodate future expansion — additional sites, products, or standards?

AS9100 certification bodies comparison as an operations manager reviews registrar questions before signing — Compare AS9100 certification bodies carefully before signing, including accreditation, aerospace experience, audit approach, cost, and NCR handling.

If you are under customer pressure to certify quickly → prioritize registrars with confirmed availability in your timeframe over the lowest quote. A registrar that can’t schedule Stage 1 for four months doesn’t help you meet a customer deadline, regardless of price.

Cost and Timeline: What to Expect

These are planning ranges, not fixed market prices. Actual AS9100 certification fees depend on employee count, number of sites, audit complexity, applicable scope, operational complexity, shift structure, travel, audit days required, and whether other management systems are audited together.

Factor	Typical Planning Range	Notes
Stage 1 + Stage 2 audit fees	$8,000–$18,000	Varies by facility size, employee count, and site complexity
Annual surveillance audits	$3,000–$7,000 per year	Required to maintain certification between three-year recertification cycles
Recertification audit	$6,000–$12,000	Every three years, comparable in scope to initial certification

Ask any registrar directly whether combining AS9100 with an existing ISO 9001 or ISO 14001 audit could reduce total audit days — this varies by registrar and by how your existing certifications are scheduled, so get it confirmed in your specific quote rather than assuming a standard discount applies.

On timeline: the 3–6 month range you’ll often hear for “registrar selection to certificate issuance” assumes your QMS is already substantially implemented and you’re simply at the registrar-selection and audit-scheduling stage. It is not a full AS9100 implementation timeline. If you’re starting without an existing QMS, expect considerably longer — see AS9100 Implementation Timeline for phase-by-phase ranges depending on your starting point.

For a full breakdown of certification costs beyond registrar fees — internal audit prep, documentation, and consulting — see How Much Does AS9100 Certification Cost?.

Common Mistakes When Selecting a Registrar

Choosing on price alone. The cheapest quote often reflects less aerospace-specific auditor experience, not efficiency. A registrar that costs more but assigns a dedicated aerospace lead auditor typically pays for itself in fewer findings and less audit-day confusion.

Not confirming scope in detail before signing. As covered above — AS9100 accreditation doesn’t automatically cover AS9110 (MRO) or AS9120 (distribution). If your business spans more than one, confirm scope for each. See AS9110 vs AS9120 if you’re uncertain which applies to your operation.

Assuming certification body and consultant can be the same entity. Certification bodies must maintain impartiality, and accredited certification activities are subject to strict rules governing consulting and conflicts of interest. A certification body should not be building the QMS it is then responsible for certifying. If a “certification body” is offering to build your documentation and then certify you, ask directly how that’s structured to avoid a conflict.

Ignoring auditor turnover history. Ask how long auditors typically stay assigned to accounts. Frequent auditor rotation means re-explaining your operation’s context every surveillance cycle.

What to Do After You Select a Certification Body

Step 1 — Confirm scope and schedule your Stage 1 readiness review. Most registrars offer an optional pre-assessment to catch major gaps before the audit clock starts.

Step 2 — Run your internal gap assessment first. Don’t walk into a pre-assessment blind. → AS9100 Rev D Gap Assessment Checklist

Step 3 — Address FAI, traceability, and counterfeit parts documentation early. These are the areas generalist QMS documentation most often misses. See First Article Inspection Requirements and FOD Control Standards.

Step 4 — Close the knowledge gap before Stage 1, not during it. An auditor testing your team on requirements they’ve never formally learned is one of the most avoidable sources of Stage 1 findings. → BSI Group AS9100 Training

FAQ

Can any ISO 9001 certification body also certify AS9100?

Not automatically. A registrar must hold separate, specific accreditation for AS9100 through ANAB (or an equivalent IAF-recognized accreditation body), evaluated against ISO/IEC 17021-1 plus the IAQG 9104-series requirements. ISO 9001 accreditation does not automatically extend to AS9100 — the two are scoped and evaluated separately.

How do I verify a certification body is actually accredited for AS9100?

Check the IAQG OASIS Certified Supplier Directory, which lists certified organizations and the registrars that issued their certificates, and confirm current scope directly with ANAB. Don’t rely solely on a registrar’s own marketing claims.

Is the cheapest registrar always the wrong choice?

Not automatically — but a significant price gap usually reflects a difference in auditor aerospace experience, scheduling flexibility, or accreditation scope. Compare quotes on auditor qualifications and turnaround time, not just the number.

Do I need a different registrar for AS9100, AS9110, and AS9120?

Not necessarily the same body, but you do need separate accreditation scope confirmed for each standard you’re certifying against, since they cover different operations — manufacturing, MRO, and distribution respectively. See AS9110 vs AS9120 for the distinction.

Can I switch certification bodies mid-cycle if I’m unhappy with my current one?

Yes, though timing matters — most organizations switch at their three-year recertification point rather than mid-cycle, since transferring an active certificate involves a transfer audit process. Talk to your prospective new registrar about transfer procedures before your current cycle ends.

Does a certification body also provide consulting or documentation help?

Generally, no — accredited certification bodies are subject to impartiality rules that treat consulting on your QMS documentation as a conflict of interest with certifying that same QMS. For documentation support, work with a separate consultant or a documentation kit, then bring an independent registrar in for certification.

How long does AS9100 certification take once I’ve selected a registrar?

If your QMS is already substantially implemented, expect roughly 3–6 months from signing with a registrar to certificate issuance, depending on internal readiness and registrar scheduling availability. This is the certification phase only — it doesn’t include building a QMS from scratch. See AS9100 Implementation Timeline for full phase-by-phase ranges depending on your starting point.

What happens if my registrar’s AS9100 accreditation scope doesn’t cover my activities or products?

Your certificate may not satisfy customer supplier-qualification requirements even if the audit itself goes well. Confirm that the certification body’s accredited scope covers the activities and products included in your proposed certification scope before signing, not after certification.

📥 Free Resources

AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system

Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments

Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

🔹 You’re still researching registrar options → What Is AS9100? → AS9100 vs ISO 9001 → Aerospace Supplier Compliance Standards

🔹 You’re ready to request registrar quotes → Run your gap assessment first → AS9100 Rev D Gap Assessment Checklist

🔹 You need your team trained before Stage 1 → BSI Group AS9100 Training

🔹 You still need to buy the official AS9100 Rev D standard → AS9100 / SAE Standards — ANSI Webstore

🔹 You want to understand certification costs and timeline first → How Much Does AS9100 Certification Cost? → AS9100 Implementation Timeline

The Registrar You Choose Is Part of Your Quality System

Certification is not a one-time transaction — it’s a multi-year relationship with surveillance audits every year and recertification every three. Choosing an accredited body with genuine aerospace auditor experience, transparent scope, and consistent auditor assignment saves far more over that relationship than a lower first-year quote.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Aerospace suppliers don’t fail audits because the requirements are a mystery — they fail because they picked a registrar that didn’t understand their industry, or walked into Stage 1 without a real gap assessment behind them.

Organizations that treat registrar selection as a checkbox end up re-explaining their operation to a new auditor every surveillance cycle. Organizations that vet accreditation scope and auditor experience up front build a certification relationship that gets faster and smoother every year.

At The Standards Navigator, aerospace compliance gets the same clause-level treatment as everything else on this site — no fluff, no generic advice.

👉 Get updates on AS9100 certification, audits, and aerospace supply chain compliance
👉 Be first to access new gap assessment tools and aerospace-specific guides

Industrial Compliance. Clearly Explained.

ISO 45001 vs ISO 50001: Which Safety and Energy Management Standard Does Your Operation Actually Need? (2026 Guide)

This guide compares ISO 45001 and ISO 50001 for manufacturers weighing safety versus energy management certification. It breaks down clause structure, standard pricing, certification triggers, and the most common mistakes teams make pursuing either standard. It also covers when facilities genuinely need both certifications versus when sequencing one after the other makes more sense.

How manufacturers decide between occupational safety and energy management certification

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Two Certifications, Two Very Different Problems

A plant manager doesn’t usually confuse safety and energy management. But when both show up on the same certification roadmap — often because a customer, insurer, or corporate sustainability mandate is pushing for both — the ISO 45001 vs ISO 50001 decision starts to feel more complicated than it actually is.

They don’t overlap much at all.

ISO 45001 exists to keep people from getting hurt. ISO 50001 exists to make sure your facility isn’t wasting energy it’s paying for. Both are voluntary management system standards. Both follow the same high-level structure. Both can be certified by an accredited registrar, resulting in a certificate you can put on a wall or a bid package. Past that, they’re solving two separate problems with two separate data sets, two separate risk registers, and — in most facilities — two separate teams.

From the Floor: I’ve sat in enough capital planning meetings to know that energy costs get treated as a fixed line item until someone forces the conversation — usually a spike in the utility bill or a customer asking about carbon reporting. In a fabrication environment, the big draws are exactly what you’d expect: compressed air systems, welding equipment, and cure ovens for coatings work. None of that gets measured systematically unless something formal requires it. That’s the gap ISO 50001 is built to close — not safety incidents, but the slow bleed of energy nobody’s tracking.

If you’re deciding whether your operation needs one of these standards, both, or neither yet, the fastest way through this decision is a structured gap check — not guesswork.

👉 Get the Manufacturing Compliance Checklist — Before you commit budget to either certification, run your operation against the core ISO, OSHA, and quality requirements that apply to production environments. Most teams find gaps in under 45 minutes.

In This Guide

What ISO 45001 and ISO 50001 actually cover
Quick answer: which standard fits which situation
Certification requirements, clause structure, and cost side by side
Who typically needs both
Common mistakes when pursuing either standard
Where to buy the standards and get training

👉 Start Here: Top Resources

ISO 45001:2018 — ANSI Webstore — the official occupational health and safety management system requirements.
ISO 50001:2018 — ANSI Webstore — the official energy management system requirements.
9001Simplified Documentation Kits — pre-built documentation packages for teams building a management system from scratch. (ISO 9001 scope — confirm current kit availability before positioning this for 45001/50001-specific documentation needs.)
Need training, not just the standard? Compare BSI’s training catalog against ISOQAR’s ISO courses — both cover ISO 45001 and ISO 50001 coursework.

Quick Answer: ISO 45001 vs ISO 50001

Question	ISO 45001	ISO 50001
What it manages	Worker health and safety risk	Energy performance and consumption
Core outcome	Fewer injuries and incidents	Improved energy performance
Who typically drives it	EHS / safety manager	Facilities / energy manager, sometimes operations
Typical trigger	Customer requirement, insurance, incident history	Utility cost pressure, sustainability reporting, energy regulation
Legally mandatory?	No — voluntary, though some contracts require it	No — voluntary, though some supply chains require it

If your driving concern is incidents, near-misses, or a customer asking about your safety program, that’s ISO 45001. If your driving concern is a utility bill that keeps climbing or a customer sustainability questionnaire, that’s ISO 50001. Many facilities don’t need to pursue both in the same certification cycle unless a specific contract or corporate mandate is forcing it.

What ISO 45001 Actually Requires

ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems. It replaced OHSAS 18001 and is built on the same Annex SL high-level structure used across ISO 9001 and ISO 14001, which is one reason facilities already certified to those standards tend to find ISO 45001 implementation faster. ISO maintains the official scope and summary of the standard at iso.org, though that summary doesn’t substitute for the full requirements text you’ll need for actual implementation.

The standard requires organizations to identify hazards, assess OH&S risk, set objectives for reducing that risk, and demonstrate continual improvement — all under the same Plan-Do-Check-Act cycle used across the ISO management system family. It puts specific weight on worker participation and consultation, which is a heavier emphasis than most legacy safety programs are built around. OSHA’s own recordkeeping and general duty clause requirements, published at osha.gov, remain the regulatory floor in the U.S. regardless of whether a facility pursues ISO 45001 certification — the standard sits on top of that floor, not in place of it.

Most common finding: Facilities that already run a documented OSHA program tend to underestimate how much additional documentation ISO 45001 requires around worker consultation and leadership accountability — those clauses go beyond what OSHA compliance alone typically covers.

What ISO 50001 Actually Requires

ISO 45001 vs ISO 50001 article graphic showing an ISO 50001 energy performance dashboard, EnPI tracking, energy baseline, and continual improvement — ISO 45001 vs ISO 50001: ISO 50001 focuses on measuring and improving energy performance through energy baselines, EnPIs, targets, and continual improvement.

ISO 50001:2018 received the 2024 climate-action amendments, which added climate-change considerations to the management system’s context and interested-party requirements. That’s an amendment to the existing 2018 edition, not a new edition of the standard. The core structure hasn’t changed: establish an energy baseline, set energy performance indicators (EnPIs), and demonstrate measurable, continual improvement in energy performance — not just improvement in your management processes, but in your actual energy numbers.

From the Floor: In heavy fabrication, energy conversations rarely start with “let’s implement an energy management system.” They start with a compressor that runs unloaded all weekend, a cure oven that sits at temperature between jobs, or a welding bay where nobody has ever assigned energy consumption to the process. ISO 50001 gives operations a framework for turning those observations into measurable energy performance decisions instead of hallway complaints about the utility bill.

That’s the detail that trips people up. ISO 45001 doesn’t require you to hit a specific injury rate — it requires you to manage the system that reduces risk. ISO 50001 is more demanding on demonstrated energy performance: the standard requires organizations to establish, implement, maintain, and continually improve the EnMS while demonstrating improvement in energy performance. You can’t satisfy the standard with paperwork alone if your energy use isn’t actually trending in the right direction. The U.S. Department of Energy publishes separate technical guidance at energy.gov for organizations building out energy baselines and performance indicators, which can be a useful supplement alongside the standard itself.

An energy performance indicator (EnPI) is simply the metric you use to prove the trend is real — something like kWh per production unit, kWh per ton of material processed, energy consumption per operating hour, or energy consumption per batch. Pick a metric tied to actual output rather than relying solely on total facility consumption, because seasonal swings and production-volume changes can distort the picture.

👉 Setting up your first EnPI baseline without guidance is where most ISO 50001 implementations stall out. ISO 50001 Training from BSI and ISO 50001 Training from ISOQAR both cover EnPI methodology from the ground up, not just the paperwork.

If you are already tracking utility costs by building or by process line → you have the foundation ISO 50001 auditors expect to see; if you’re not, that’s the first gap to close before pursuing certification.

Clause Structure and Certification Cost Comparison

Category	ISO 45001:2018	ISO 50001:2018
Structure	10 clauses, Annex SL high-level structure	10 clauses, Annex SL high-level structure
Core requirement	Manage OH&S risk, reduce injury/illness	Establish EnPIs, demonstrate energy performance improvement
Standard PDF price	$321.00 list / $256.80 ANSI member	$293.00 list / $234.40 ANSI member
Typical driver	Customer/insurance requirement, incident history	Utility cost, sustainability reporting, energy regulation
Owning department	EHS / Safety	Facilities / Energy / sometimes Operations

ANSI Webstore prices checked August 2026; prices may change — confirm current pricing before budgeting.

Standard purchase price is one line item — implementation and audit costs are the larger investment for either standard. For a full breakdown of ISO 45001 certification, audit, and implementation costs, see our ISO 45001 cost guide. Before selecting a registrar for either standard, verify their scope of accreditation through ANAB (anab.ansi.org) or IAF (iaf.nu) — not every accredited certification body carries scope for both OH&S and energy management audits.

If you’re evaluating both standards for your facility, check whether the ANSI bundle option covers both — compare the bundle price against purchasing each standard separately before you check out.

Do You Need Both?

Manufacturers typically don’t pursue ISO 45001 and ISO 50001 in the same cycle unless one of three things is happening:

A major customer’s supplier scorecard requires both safety and energy management certification.
Corporate ESG or sustainability reporting is pulling energy data into the same governance structure as safety data.
The facility already holds ISO 9001 and/or ISO 14001 and is expanding its integrated management system to cover the full Annex SL family.

⚠️ If none of those apply to you right now, chasing both standards in the same year usually means neither implementation gets the attention it needs. Sequence them.

If you are already ISO 14001 certified → energy data collection is likely partially in place already, since environmental management systems frequently track energy as an aspect. That overlap is worth exploring before you start ISO 50001 from zero. We cover that specific comparison in ISO 14001 vs ISO 50001.

ISO 45001 vs ISO 50001 decision matrix comparing occupational health and safety management with energy management — ISO 45001 vs ISO 50001: Compare safety management, energy performance, key data, and implementation priorities for manufacturing operations.

Common Mistakes When Pursuing Either Standard

Treating ISO 50001 like a documentation exercise. Auditors want to see actual energy performance data trending in the right direction, not just a policy binder.
Underestimating worker participation requirements in ISO 45001. Facilities transitioning from legacy safety programs can discover gaps here during certification audits, particularly when participation is documented weakly.
Assuming one certification body handles both equally well. Confirm registrar experience with the specific standard before signing a contract — not every registrar has deep bench strength in energy management audits.
Skipping a baseline before setting objectives. For ISO 50001 specifically, you cannot demonstrate “improvement” without a documented starting point.

For a deeper look at where operations typically go wrong on the safety side specifically, see Common Mistakes in ISO 45001 Implementation.

Most operations managers don’t fail these audits because they misunderstand the standard. They fail because they assumed existing programs already covered the gap. Run a structured check before you commit to either certification path →

👉 Download the Manufacturing Compliance Checklist — see where your current safety and operational documentation actually stands against ISO requirements before you scope a project.

Readiness Checklist

✅ You track incidents, near-misses, or OH&S metrics in a documented format ✅ You know your facility’s baseline energy consumption by process or building ✅ Leadership has assigned clear ownership for whichever standard you’re pursuing
✅ You’ve confirmed whether a customer or contract actually requires certification, or just alignment
✅ You’ve budgeted for both the standard purchase and the registrar audit — not just one

Objection: “We Don’t Have the Budget or Headcount for Both”

This is the most common objection, and it’s usually a sequencing problem, not a resourcing problem. Most operations don’t need ISO 45001 and ISO 50001 running in parallel. Pick the one tied to your most immediate business driver — a customer requirement, an insurance conversation, or a utility cost that’s become impossible to ignore — and sequence the other for a later cycle. Trying to run both from zero at once is where budgets and internal bandwidth actually break down.

ISO 45001 vs ISO 50001 Stage 2 audit comparison showing occupational safety and energy management audit evidence — ISO 45001 vs ISO 50001: A Stage 2 audit examines different evidence for occupational health and safety management and energy management systems.

FAQ

Is ISO 45001 or ISO 50001 required by law?

Neither is legally mandatory in the U.S. Some customer contracts, insurance requirements, or international supply chain agreements may require one or both as a condition of doing business, but neither is a government regulation on its own.

Can one person manage both certifications?

In smaller operations, yes — but the skill sets are different. OH&S risk assessment and energy performance indicator tracking draw on different technical backgrounds, so expect a learning curve if one person is covering both.

How long does ISO 50001 certification take compared to ISO 45001?

Timelines are similar in structure — gap assessment, implementation, internal audit, Stage 1, Stage 2 — but ISO 50001 timelines depend heavily on how much energy metering infrastructure already exists. Facilities without submetering in place typically need additional time to establish a reliable baseline.

Does ISO 14001 certification make ISO 50001 easier?

Often, yes. Environmental management systems frequently already track energy as a significant aspect, which can shorten the baseline-gathering phase for ISO 50001. It’s not automatic, but the data collection habits usually transfer.

Is ISO 50001 only relevant for large facilities?

No. ISO 50001 applies regardless of facility size. Smaller operations sometimes see a faster payback because energy waste is easier to identify and correct when the operation is less complex.

What’s the single biggest difference between the two standards in a Stage 2 audit?

ISO 45001 audits focus heavily on documented risk assessments, worker consultation records, and incident investigation processes. ISO 50001 audits focus on your energy data — EnPIs, baseline documentation, and measurable performance trends. Auditors for the two standards are looking at fundamentally different evidence.

Do we need new equipment to pursue ISO 50001?

Not necessarily. Some facilities need submetering to establish a credible baseline, but many can start with existing utility billing data and building-level metering before investing in more granular monitoring.

Which standard should a fabrication shop pursue first?

For most fabrication and welding operations, safety risk (ISO 45001) is the more immediate driver — customer scorecards and insurance conversations tend to prioritize it. Energy management (ISO 50001) becomes the priority once utility costs or sustainability reporting requirements start showing up in bid packages.

📥 Free Resources

Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

Not Sure What to Do Next?

🔹 Still researching which standard fits your operation? Start with the ISO 45001 Certification Guide or explore ISO Training for AS9100, ISO 13485 & ISO 50001 to understand what implementation actually looks like before committing.

🔹 Ready to start implementation? Get the Manufacturing Compliance Checklist and run a structured gap assessment before you scope a project with a consultant or registrar.

🔹 Need to buy the standard? If you’ve already decided which management system fits your operation, purchase ISO 45001:2018 or ISO 50001:2018 directly from ANSI Webstore — use code CC2026 for 5% off through December 31, 2026. If you’re implementing both, check the available bundle option before purchasing separately.

🔹 Getting your team certified to audit or lead either system? BSI and ISOQAR both run internal auditor and implementation courses for ISO 45001 and ISO 50001 — worth comparing before you pick one.

Whichever standard fits your situation, the fastest path forward isn’t guessing — it’s a structured comparison against your actual operation. The Standards Navigator covers both sides of this decision in plain, practitioner-level terms, without the sales pitch a registrar or consultant will give you.

Stop Guessing Which Standard Your Operation Needs

Facilities that wait for an audit finding or a customer scorecard to force the decision end up scrambling — picking whichever standard is most urgent instead of the one that actually fits their risk profile. Facilities that get ahead of it treat the decision as a planning exercise, not a fire drill.

The Standards Navigator breaks down ISO 45001, ISO 50001, and every standard in between in terms manufacturers can actually use on the shop floor — not the abstract language most registrars lead with.

👉 Get updates on ISO 45001, ISO 50001, and the full safety and energy management cluster
👉 Be first to access new gap assessment checklists and implementation resources as they publish

Industrial Compliance. Clearly Explained.

ISO 45001 vs OSHA: What’s the Difference and Do You Need Both in 2026?

OSHA and ISO 45001 aren’t competing programs — one is a legal requirement, the other a voluntary management system standard. This guide breaks down the key differences, explains why ISO 45001 certification doesn’t replace OSHA compliance, and covers why manufacturers pursue both.

Understanding how the voluntary safety standard relates to your legal safety obligations

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Confusion That Costs Manufacturers Time

“We’re OSHA compliant — why would we need ISO 45001?”

I hear a version of that question every time this topic comes up, and it’s the wrong question. ISO 45001 vs OSHA isn’t a matchup between two competing programs. One is a legal floor you cannot opt out of. The other is a management system you choose to build on top of it. Confusing the two leads to two bad outcomes: companies that think a clean OSHA record means their safety program is sufficient, and companies that think ISO 45001 certification means they can stop worrying about 29 CFR.

Neither assumption holds up under an audit — or an inspection.

If you’re still deciding whether ISO 45001 is worth pursuing on top of your existing OSHA program, this is your evaluation-stage answer: what each one actually requires, where they overlap, and where they don’t.

I’ve sat through both an OSHA inspection and an ISO 45001 surveillance audit at the same facility within the same 12-month stretch. The OSHA compliance officer walked the floor checking us against specific 1910 line items — machine guarding, lockout/tagout, PPE. The ISO 45001 auditor wanted to see how we identified hazards and controlled risk before an incident happened, not just whether we were in violation on the day they showed up. Passing the OSHA inspection told us we weren’t currently non-compliant. Passing the ISO 45001 audit gave us evidence that our hazard-identification and risk-control process was actually being followed — not just that we’d avoided a violation that day. Those are two different questions, and manufacturers who only answer one of them are exposed. That perspective comes from 25+ years in heavy industrial operations and my work as a certified ISO 9001 Internal Auditor, where I’ve seen firsthand how a paper-compliant program and a working one aren’t always the same thing.

ISO 45001 vs OSHA comparison showing an OSHA inspection and ISO 45001 audit at the same manufacturing facility — ISO 45001 vs OSHA: an OSHA inspection evaluates compliance with workplace safety requirements, while an ISO 45001 audit evaluates the effectiveness of the occupational health and safety management system.

👉 Before your next inspection or audit — whichever comes first — run the Manufacturing Compliance Checklist against your current OSHA and ISO 45001 gaps in under 45 minutes.

In This Guide:

What OSHA actually requires (and enforces)
What ISO 45001 actually requires (and certifies)
A direct side-by-side comparison
Whether ISO 45001 certification satisfies OSHA obligations
Why manufacturers pursue both
Certification costs and where to start

👉 Start Here (Top Resources)

ISO 45001:2018 — ANSI Webstore — official current edition of the standard, needed before you scope a gap assessment
ISO 45001 Training — BSI Group and ISO 45001 Training — ISOQAR — two recommended providers for internal auditor and implementation training
Manufacturing Compliance Checklist — free reference covering ISO, OSHA, and quality requirements together

What Is OSHA?

The Occupational Safety and Health Administration is a US federal agency, and its standards are law, not guidance. OSHA enforces two primary sets of regulations: 29 CFR 1910 for general industry and 29 CFR 1926 for construction. Where no specific standard applies, OSHA may address certain recognized serious hazards under the General Duty Clause of the OSH Act, when the statutory requirements for a citation are met.

Compliance isn’t optional and it isn’t certified. It’s inspected, cited, and fined. OSHA also uses injury and illness data in its Site-Specific Targeting program to help identify establishments for inspection — for establishments covered by OSHA’s recordkeeping requirements, that means accurate 300 log data is more than a paperwork exercise, since it can factor into the agency’s targeting process.

What Is ISO 45001?

ISO 45001 is the international standard for occupational health and safety management systems, published by the International Organization for Standardization. Unlike OSHA, it’s voluntary — no government requires it — and it’s built around a management system framework rather than a fixed list of technical requirements.

Where OSHA establishes specific requirements for things such as machine guarding, fall protection, or lockout/tagout, ISO 45001 tells you how to build a system that identifies hazards, sets objectives, assigns responsibility, and drives continual improvement — regardless of what those specific hazards turn out to be. It shares the same high-level structure as ISO 9001 and ISO 14001, which is why many manufacturers pursuing quality or environmental certification eventually add ISO 45001 to build an integrated management system.

Certification is third-party: an accredited certification body audits your system against the standard and issues (or withholds) certification. OSHA doesn’t do this — there’s no “OSHA-certified” facility, only inspected and cited or not.

ISO 45001 vs OSHA: Key Differences

Category	OSHA	ISO 45001
Legal status	Mandatory US federal law	Voluntary, internationally recognized
Geographic scope	United States only	Global — any country, any operation
Structure	Fixed technical requirements (29 CFR 1910/1926)	Management system framework (Plan-Do-Check-Act)
Enforcement	Inspections, citations, fines	Third-party audits, certification/decertification
Focus	Compliance with specific hazard rules	Continual improvement of the safety management system
Documentation	Required records (300 logs, training records)	Documented information tied to risk methodology and objectives
Proof of compliance	Regulatory compliance and enforcement record	Third-party certification status
Who requires it	Federal government, for covered employers	Customers, contracts, insurers, corporate policy

Most common finding: manufacturers who treat OSHA compliance as their ceiling instead of their floor tend to have reactive safety programs — reacting to the last incident instead of preventing the next one. ISO 45001’s risk-based clauses (6.1, 8.1) push you toward the second approach.

Does ISO 45001 Certification Satisfy OSHA Requirements?

No — and this is the objection worth addressing directly, because it’s the most common misunderstanding I run into. ISO 45001 certification is not a substitute for OSHA compliance, and no certification body, registrar, or consultant can tell you otherwise.

In fact, ISO 45001 requires the opposite relationship. Clause 9.1.2 (Evaluation of Compliance) obligates a certified organization to actually identify and evaluate compliance with its applicable legal requirements — which, for a US manufacturer, means OSHA. A properly built legal register under ISO 45001 should identify the OSHA requirements applicable to your operations, along with a method for evaluating ongoing compliance with them — the standard doesn’t prescribe a fixed format or require every applicable CFR citation listed by name, just a process that actually works. So instead of replacing OSHA, ISO 45001 formalizes your ongoing evaluation of it.

ISO 45001 vs OSHA process diagram showing how OSHA requirements connect to ISO 45001 risk assessment, operational controls, compliance evaluation, and continual improvement — ISO 45001 vs OSHA: OSHA establishes workplace safety requirements, while ISO 45001 provides a management system for identifying risks, implementing controls, evaluating compliance, and driving continual improvement.

If you are already OSHA compliant and considering ISO 45001 → think of it as building the management system layer that keeps you compliant consistently, not a separate safety program running in parallel.

👉 Already OSHA compliant? See what it takes to add ISO 45001 on top of your existing safety program in our ISO 45001 Certification Guide.

Why Manufacturers Pursue ISO 45001 on Top of OSHA Compliance

If OSHA is mandatory, why add a voluntary standard? A few recurring reasons show up across the shops and plants I’ve worked in and consulted with:

Customer and contract requirements. Tier 1 and Tier 2 suppliers increasingly see ISO 45001 certification listed as a bid requirement. OSHA compliance alone doesn’t satisfy that contract language — certification does.

Insurance and risk-management considerations. A documented, auditable safety management system can give insurers and other stakeholders additional evidence of how you manage OH&S risk, beyond incident-rate data alone.

Integrated management systems. If you’re already certified to ISO 9001 or ISO 14001, adding ISO 45001 is typically less work than starting from zero — the harmonized clause structure means document control, internal audits, and management review can largely be reused. See our guide on integrating ISO 9001, ISO 14001, and ISO 45001.

ISO 45001 vs OSHA comparison showing how both systems respond to an unguarded machine hazard in a manufacturing facility — ISO 45001 vs OSHA: OSHA focuses on compliance with applicable requirements, while ISO 45001 provides a systematic approach to identifying hazards, controlling risk, auditing performance, and driving continual improvement.

Reducing incident recurrence. OSHA’s enforcement model centers on evaluating conditions against existing standards — inspections, complaints, targeted programs. ISO 45001’s risk assessment clauses (6.1.2) add a layer on top of that: identifying and controlling hazards upstream, before they reach the point of a citation or an injury.

If you are under customer pressure to certify quickly → prioritize training and select your certification body before you start building documentation from scratch. Don’t reverse that order — it’s the single most common mistake we cover in our article on common mistakes in ISO 45001 implementation.

If you are not sure how long certification will realistically take alongside your existing OSHA program → our ISO 45001 implementation timeline breaks out the phases and typical duration.

OSHA Recordkeeping and ISO 45001: Where the Data Overlaps

⚠️ Verify current OSHA.gov requirements before treating this as final — OSHA’s electronic recordkeeping requirements have expanded over time, with certain covered establishments required to submit specified injury and illness records electronically. Because those requirements depend on factors like establishment size and industry classification, confirm which forms and deadlines apply to your operation directly with OSHA.gov. Whatever your submission requirement, that 300 log data is also a primary input for ISO 45001’s incident investigation (clause 10.2) and continual improvement (clause 10.3) processes — clean, accurate logs generally make nonconformity trend analysis far less painful, since the underlying data already exists in usable form.

Quick Audit-Readiness Checklist

✅ Legal register identifies your specific applicable OSHA standards (not a generic reference to “OSHA”)
✅ OSHA 300, 300A, and 301 logs are current, accurate, and reconciled against your incident investigation records
✅ Risk assessment methodology (6.1.2) references actual hazards observed on your floor — not a generic template
✅ Internal audit program covers both ISO 45001 clauses and applicable OSHA standards in scope
✅ Management review minutes show OSHA compliance status as a standing agenda item

⚠️ If your legal and other requirements register hasn’t been reviewed since your last major regulatory or operational change, update it before your surveillance audit

When You Need Both

You probably need both when:

OSHA applies to your US operation — which covers nearly every manufacturer reading this.
A customer, contract, corporate policy, or market requirement calls for ISO 45001 certification specifically.
You want a formal OH&S management system that integrates with an existing ISO 9001 or ISO 14001 certification.

You probably don’t need ISO 45001 solely because OSHA exists. OSHA compliance is the baseline every covered US employer already carries — ISO 45001 is worth the investment when one of the three drivers above actually applies to your operation.

Certification Cost and Where to Start

If you’re purchasing the standard itself, the current edition is available through the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026 via the ANSI coupon link. If you’re planning to pursue ISO 9001 or ISO 14001 alongside ISO 45001, buying the standards bundled together costs meaningfully less than purchasing each one separately.

For a full breakdown of certification, audit, and implementation costs, see How Much Does ISO 45001 Cost? OSHA compliance itself carries no certification fee — your cost there is entirely internal: training, engineering controls, PPE, and recordkeeping systems.

FAQ

Is ISO 45001 required by law?

No. ISO 45001 is a voluntary international standard. OSHA compliance, by contrast, is legally mandatory for covered US employers regardless of certification status.

If I’m ISO 45001 certified, can OSHA still cite me?

Yes. Certification has no bearing on OSHA’s authority to inspect and cite. The two operate independently — one enforced by a federal agency, one verified by a private accredited registrar.

Does ISO 45001 replace the need for an OSHA-compliant safety program?

No. ISO 45001 clause 9.1.2 specifically requires you to evaluate compliance with applicable legal requirements, including OSHA — so certification depends on maintaining OSHA compliance, not replacing it.

Can ISO 45001 certification be completed in 6 months?

Rarely, for a facility starting from an informal safety program. Manufacturers with an OSHA-compliant baseline and dedicated resources may be able to reach certification in roughly 8–12 months. See our implementation timeline for the phase-by-phase breakdown.

Which OSHA standard aligns most closely with ISO 45001?

There isn’t a direct regulatory counterpart — OSHA’s 1910 and 1926 are technical, hazard-specific regulations, while ISO 45001 is a management-system framework. The two aren’t equivalents. Instead, ISO 45001’s risk-based framework gives you a systematic way to manage the same hazards OSHA regulates piecemeal through dozens of individual standards.

Is ISO 45001 worth it if we already have a strong OSHA safety record?

A clean OSHA record shows you haven’t been cited — it doesn’t verify that your hazard identification process would catch the next risk before it becomes an incident. For manufacturers under contract pressure to certify, ISO 45001 adds a layer OSHA compliance alone doesn’t provide.

Do OSHA regulations apply outside the United States?

No. OSHA requirements generally apply within the United States and its territories, while ISO 45001 can be applied by organizations worldwide, which is one reason multinational manufacturers often standardize on it.

What happens during an ISO 45001 audit versus an OSHA inspection?

An OSHA inspection checks current conditions against specific regulatory line items and can result in citations. An ISO 45001 audit evaluates whether your management system is functioning as designed and can result in nonconformities that must be closed to keep certification.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

🔹 Still researching whether ISO 45001 fits your operation? Start with our ISO 45001 Certification Guide for the full picture before committing resources.

🔹 Ready to start building your system? Run the Manufacturing Compliance Checklist against your current OSHA and ISO 45001 gaps, and review our ISO 45001 Documentation Requirements guide before you start drafting.

🔹 Need to purchase the standard or line up training? Get the current edition from the ANSI Webstore (code CC2026 for 5% off), then compare BSI and ISOQAR training options.

OSHA compliance keeps you legal. ISO 45001 keeps your safety program honest about whether it actually works. The Standards Navigator covers both sides of that equation so you’re not caught treating one as a substitute for the other.

Before You Go

Most manufacturers don’t get into trouble because they misunderstand OSHA — they get into trouble because they assume their OSHA compliance history means their broader safety system has no gaps. Facilities that struggle tend to treat their 300 log as a filing obligation. Facilities that succeed treat it as an input into a system that’s actively looking for the next problem.

The Standards Navigator covers both the regulatory floor and the certification layer manufacturers build on top of it — OSHA, ISO 45001, and everywhere they intersect.

👉 Get updates on ISO 45001 implementation, audits, and OSHA alignment
👉 Be first to access new safety and compliance checklists as we publish them

Industrial Compliance. Clearly Explained.

ISO 45001 Documentation Requirements: What Manufacturers Need for 2026

ISO 45001 requires documented information throughout the standard, organized here into practical maintain-and-retain categories. This guide breaks down what auditors most commonly request, clause by clause, and covers the documentation gaps that create findings before manufacturers know to look for them.

The Mandatory Records, Policies, and Procedures Your OH&S Management System Must Have

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

You Don’t Fail an ISO 45001 Audit Because of Your Safety Program. You Fail It Because You Can’t Prove It.

Most manufacturers with a real safety culture assume that’s enough. It isn’t. Auditors evaluate your ISO 45001 documentation requirements just as closely as your actual safety performance, and a strong program with weak documentation behind it still produces findings.

An auditor doesn’t walk your floor and take your word for it. They ask for documented information — the specific policies, records, and evidence ISO 45001 requires you to maintain and retain. If the required documented information isn’t available, controlled, or retrievable when the auditor needs objective evidence, you’re creating a potential nonconformity. It doesn’t matter how few incidents you’ve had.

This is where documentation-ready operations separate from everyone else. Not because their safety performance is better on paper, but because their paper actually matches what happens on the floor. The goal isn’t a five-minute retrieval requirement from ISO — that’s not written anywhere in the standard. It’s an operational test: if someone asks for evidence, can your team find the right record quickly, without reconstructing history on the spot?

From the Floor: I’ve sat across the table from an auditor who asked for evidence that a hazard identification process had actually been followed on a specific line — not the procedure, the record that it happened. We had the procedure. We didn’t have three months of the records behind it, because the paperwork existed as a form nobody was consistently filling out. That gap turned a strong safety program into a documented nonconformity, and it took us most of a quarter to close the loop on retraining and evidence.

If you’re not sure your OH&S management system would survive that same request, run the Manufacturing Compliance Checklist against your current files before your next audit — it takes less than an hour and tells you exactly where the gaps are. If you haven’t mapped out your certification timeline yet, our ISO 45001 Implementation Timeline breaks down when documentation work should start relative to your target audit date.

In This Guide

What “documented information” means under ISO 45001 and why the term matters
The specific documents you’re required to maintain (policies, procedures, plans)
The specific records you’re required to retain (evidence of what actually happened)
A quick-reference maintain vs. retain matrix you can hand to your team
Where manufacturers commonly fall short — and the finding it produces
Whether you need a full OH&S manual (you don’t)
What to do about the ISO 45001 revision while you finalize documentation

Quick Answer: ISO 45001 Documentation at a Glance

Category	What ISO 45001 Requires	Clause
Scope statement	Documented boundaries and applicability of the OH&S system	4.3
OH&S Policy	Documented, communicated, and available policy statement	5.2
Roles & responsibilities	Documented assignment of OH&S roles, responsibilities, authorities	5.3
Risks, opportunities & related actions	Documented information on OH&S risks, opportunities, and the processes/actions needed to address them	6.1.1
OH&S risk assessment methodology & criteria	Methodology and criteria for assessing OH&S risks, maintained and retained	6.1.2.2
Objectives & plans	OH&S objectives and plans to achieve them — maintained and retained	6.2.1–6.2.2
Worker consultation & participation	Documented, maintained process for consultation and participation (records recommended as evidence)	5.4
Competence evidence	Records proving workers are competent for their OH&S-related duties	7.2
Operational controls	Documented information maintained and retained to the extent needed to show processes were carried out as planned	8.1.1
Emergency preparedness	Documented process for preparing for and responding to potential emergencies	8.2
Emergency response testing	Evidence that emergency response processes are periodically tested and evaluated	8.2
Legal & other requirements	Applicable OH&S legal and other requirements identified and kept current	6.1.3
Compliance evaluation	Results showing applicable requirements were periodically evaluated	9.1.2
Internal audit & management review	Audit program, audit results, and management review records	9.2, 9.3
Incidents & corrective action	Records of nonconformities, incidents, and actions taken	10.2

(This is the practical short list. The detailed breakdown of the core requirements follows below.)

👉 Start Here (Top Resources)

ISO 45001:2018 — Official Standard, ANSI Webstore — the source document that defines every documentation requirement below. Use code CC2026 for 5% off through December 31, 2026.
ISO 45001 Training — BSI Group — for teams building documentation for the first time and wanting structured guidance on what “conforming” actually looks like.
ISO 45001 Training — ISOQAR — a second training and certification body option worth comparing against BSI on cost and course format.

What “Documented Information” Actually Means

ISO 45001 doesn’t use the words “documents” and “records” the way most operations managers use them. It uses one term — documented information — and requires it throughout nearly every clause in the standard, from the scope statement in Clause 4.3 through corrective action in Clause 10.2. The standard groups that documented information into two functions rather than two separate document types.

Maintained documented information generally supports keeping information current as part of the management system. Your OH&S policy, your scope statement, your risk assessment methodology — these are maintained, meaning they’re kept up to date as your operation changes.

Retained documented information provides evidence that an activity, process, or result actually occurred. Your training records, your incident reports, your internal audit results — these are retained as proof something happened, not as a living reference document.

The distinction matters because auditors ask for both, and they’re looking for different things. A maintained document shows your system is designed correctly. A retained record shows your system is actually being followed. A gap between the two — a well-designed procedure with no consistent evidence behind it — is exactly what happened in the anecdote above.

The tables below organize the core ISO 45001 documentation requirements into practical categories for implementation. ISO 45001 doesn’t present these as a fixed numbered checklist — the requirement is distributed across the clauses — but the items below represent the core documentation auditors most commonly request during certification audits.

One of the more common documentation gaps: a documented procedure exists, but there’s no retained evidence that it’s been executed consistently over time. The procedure isn’t the problem. The missing paper trail behind it is.

Not sure your current documentation would hold up? Before you invest in a documentation overhaul, run the Manufacturing Compliance Checklist — most operations managers find the gap is narrower, and more fixable, than they expected.

The Documents You’re Required to Maintain

These are the “maintained” items — the documents ISO 45001 requires you to keep current and available, mapped to the clause that requires them.

Document	Clause	What It Must Cover
Scope of the OH&S management system	4.3	Boundaries, applicability, sites and activities covered
OH&S Policy	5.2	Commitment to safe conditions, hazard elimination, legal compliance, worker consultation
Roles, responsibilities, and authorities	5.3	Who owns which OH&S function, documented and communicated
Risks, opportunities, and related actions	6.1.1	OH&S risks, opportunities, and the processes/actions needed to address them
OH&S risk assessment methodology and criteria	6.1.2.2	The methodology and criteria used to assess OH&S risk — maintained and retained as documented information
OH&S objectives and plans to achieve them	6.2.1, 6.2.2	Measurable objectives tied to the policy, with a plan, resources, and timeline — maintained and retained as documented information
Operational planning and control criteria	8.1.1	The criteria established for processes needed to meet OH&S requirements — also both maintained and retained
Emergency preparedness and response process	8.2	How the organization identifies and prepares to respond to potential emergency situations

If you are building this system from scratch, this table is your starting checklist. Each category corresponds to documented-information requirements in ISO 45001:2018, though the exact number and format of documents you create will depend on your organization’s size, complexity, risks, and processes.

If you plan to certify through a specific registrar, ANAB and IAF both maintain public accreditation records you can check before selecting a certification body — it’s a quick way to confirm a registrar’s accreditation is current before you invest documentation time around their specific audit expectations.

If you are already ISO 9001 or ISO 14001 certified → most of this structure already exists in your management system. ISO 45001 shares the same high-level structure, so your scope statement, policy format, and objectives-planning process can largely be adapted rather than built new. Our Integrated Management Systems guide walks through exactly how to combine them.

ISO 45001 documentation requirements showing how procedures, workplace activities, and retained records become audit evidence — ISO 45001 documentation requirements connect written procedures, actual workplace activities, and retained records to create objective audit evidence.

The Records You’re Required to Retain

These are the “retained” items — the evidence that proves your system actually operated the way the maintained documents say it should.

Record	Clause	What It Proves
Legal and other requirements register	6.1.3	Applicable OH&S legal and other requirements have been identified and kept current
Compliance evaluation results	9.1.2	The organization periodically evaluated whether those requirements are actually being met
Risk assessment methodology and criteria	6.1.2.2	The methodology and criteria used to assess OH&S risk are maintained and retained as documented information
OH&S objectives and plans to achieve them	6.2.2	The organization’s OH&S objectives and plans are maintained and retained as documented information
Worker consultation and participation records (recommended)	5.4, 7.4.1	Clause 5.4 requires a maintained process for consultation and participation; it doesn’t itself mandate a specific retained record. Retaining evidence — meeting notes, consultation logs — is standard practice and often overlaps with the communication records already required under 7.4.1
Evidence of competence	7.2	Workers performing OH&S-related tasks are qualified for them
Communication records	7.4.1	Internal and external OH&S communications actually occurred
Operational control evidence	8.1.1	Documented and retained to the extent necessary to have confidence that processes were carried out as planned
Emergency response testing	8.2	Evidence that the planned emergency response capability was periodically tested and evaluated
Monitoring, measurement, and calibration	9.1.1	Performance data is accurate and equipment is verified
Internal audit program and results	9.2.2	The management system is being checked against itself, on a planned interval
Management review records	9.3	Leadership is actually reviewing OH&S performance, not delegating it entirely
Nonconformity and corrective action records	10.2	Evidence that nonconformities and incidents were addressed, corrective actions were taken, and their effectiveness was evaluated
Continual improvement evidence	10.3	Evidence that the OH&S management system is continually improved

If you’re three to six months from your planned Stage 1 audit → this is a useful table to work backward from. An auditor sampling your system will ask for evidence across these categories, and gaps here tend to be more damaging than gaps in the maintained documents above, because a missing record can’t be written retroactively without it looking exactly like what it is.

Quick-Reference: Maintain vs. Retain by Requirement Area

Requirement Area	Maintain	Retain
Scope	✓
OH&S Policy	✓
Risk & Opportunity Methodology	✓	✓
Objectives	✓	✓
Legal & Other Requirements	✓	✓
Worker Consultation & Participation	✓
Competence		✓
Emergency Preparedness	✓	✓
Operational Controls	✓	✓
Internal Audit		✓
Management Review		✓
Corrective Action		✓

Note: This matrix is a practical implementation guide, not a substitute for reviewing the specific documented-information requirements in each clause. Whether you maintain or retain information, and in what form, depends on the applicable requirement and your organization’s processes. One nuance worth flagging: Worker Consultation & Participation is checked under Maintain because Clause 5.4 requires a maintained process — the clause itself doesn’t mandate a specific retained record, though retaining evidence of consultation is standard practice and strongly recommended.

According to ISO.org, ISO 45001 was developed to give organizations a framework for managing occupational health and safety risk in a way that’s auditable and comparable across industries, not just a policy statement of intent — which is why the standard leans so heavily on retained evidence rather than stated commitment.

ISO 45001 documentation requirements explained through maintained documents and retained records for an audit-ready OH&S management system — ISO 45001 documentation requirements distinguish between information organizations maintain to guide their OH&S system and records they retain as evidence that it operates as intended.

Do You Need a Formal OH&S Manual?

No. This is a common misconception carried over from older safety standards. ISO 45001 does not require a standalone OH&S manual as a mandatory document. The standard cares about whether the required documented information exists and is controlled — not whether it’s bound into a single manual.

That said, many organizations still choose to build one, because it’s a practical way to organize the required documents and make them easy to locate during an audit. If your team already thinks in terms of a manual from ISO 9001 or ISO 14001 work, keeping the format is often faster than fighting it. The manual itself just isn’t the requirement — the underlying documented information is.

Common Documentation Mistakes That Trigger Findings

Writing procedures nobody follows. A documented process that doesn’t match actual floor practice is worse than no document at all — it hands the auditor a direct comparison between what you say you do and what you actually do.

Treating documentation as a one-time project. Documented information under Clause 7.5.3 has to be controlled — reviewed, updated, and version-controlled over time. A policy written for certification and never touched again is a stale document waiting to be flagged.

No traceable link between the risk assessment and the objectives. Auditors increasingly check whether your OH&S objectives actually connect back to the hazards your risk assessment identified. If your objectives read like generic safety goals with no tie to your specific risk profile, that disconnect gets noticed.

Missing evidence of worker consultation. Clause 5.4 requires a maintained process for consulting and involving workers — it doesn’t itself spell out a specific retained record. In practice, though, auditors expect to see evidence that consultation actually happened: meeting notes, sign-off sheets, toolbox-talk logs. This is frequently missed in fast-moving fabrication and production environments, where consultation happens informally on the floor and never makes it into any retained record at all.

⚠️ If any of these sound familiar, address them before your audit window closes, not after a finding forces the issue. Most of them are a documentation fix, not an operational overhaul — but only if you catch them early enough to build the evidence trail.

If you’re running ISO 45001 alongside ISO 9001 or ISO 14001, our ISO 14001 Documentation Requirements guide covers the same maintain-versus-retain distinction from the environmental side, and the two documentation sets typically share more structure than teams expect.

Should You Wait for the ISO 45001 Revision Before Finalizing Your Documentation?

No. The revision of ISO 45001, expected to become the 2027 edition, is now at the Draft International Standard (DIS) stage, with the DIS ballot underway as of mid-2026. ISO 45001:2018 remains the current published, certifiable standard while that ballot runs. No final publication date is confirmed, and no transition timeline for existing 2018 certificate holders has been formally published.

Organizations pursuing certification today should continue building documentation to ISO 45001:2018. Even if the eventual revision introduces new requirements, a well-documented OH&S management system gets updated when a standard revises — it doesn’t get rebuilt from zero. Waiting on documentation you need for certification now, based on a revision that hasn’t reached final publication, puts your current certification timeline at risk for no protective benefit.

A team can understand ISO 45001 perfectly and still stumble at audit time because it assumed a document existed somewhere that nobody had actually built. Run the readiness checklist below before that assumption costs you an audit cycle →

ISO 45001 documentation requirements audit-readiness dashboard showing key evidence areas, records, and compliance status — ISO 45001 documentation requirements help organizations verify that key OH&S evidence is current, complete, retained, and ready for an audit.

ISO 45001 Documentation Readiness Checklist

✅ Scope statement is documented, dated, and matches your actual sites and activities
✅ OH&S policy is signed, communicated, and available to workers — not just filed
✅ Risk assessment methodology is documented and consistently applied, not ad hoc
✅ OH&S objectives trace back to specific identified risks
✅ Evidence of worker consultation and participation exists and is retained
✅ Legal and other requirements register is current, not built once and forgotten
✅ Internal audit program has actually run — not just been scheduled
✅ Management review meetings are documented, with dated minutes and action items
✅ Corrective action records show root cause analysis, not just “issue resolved”
Emergency response process has been tested, and the test is documented

If you checked fewer than eight of these, download the Manufacturing Compliance Checklist and work through the gaps before you schedule a certification audit — closing them after a finding costs far more time than closing them before one.

Frequently Asked Questions

Does ISO 45001 require a documented OH&S manual?

No. ISO 45001 requires specific documented information listed throughout the standard, but it does not mandate a single bound manual. Many organizations build one anyway for organizational convenience, but it is not a certification requirement.

Can I use my existing ISO 9001 or ISO 14001 documentation system for ISO 45001?

Largely, yes. ISO 45001 shares the same high-level structure as ISO 9001 and ISO 14001, which means your document control process, management review format, and internal audit program can typically be extended to cover OH&S rather than rebuilt separately. The content — your risk assessment methodology, your OH&S-specific objectives — still has to be built specifically for occupational health and safety.

How many documented procedures does ISO 45001 actually require by name?

ISO 45001 doesn’t specify a fixed number of documents by name. It requires documented information throughout multiple clauses — the tables above organize those requirements into the categories auditors most commonly request during certification. The exact number of individual procedures you write depends on your operation’s size and complexity — a 30-person fabrication shop and a 500-employee facility will document the same clauses very differently in scope and detail.

Is 3 months enough time to build ISO 45001 documentation from scratch?

For a small operation with an existing safety program to formalize, it’s tight but possible if documentation work starts immediately and runs in parallel with any remaining implementation gaps. For an organization building both the OH&S program and its documentation from zero, 3 months is an aggressive timeline that typically compresses the record-retention evidence auditors look for most closely.

What happens if I’m missing a required record during my audit?

If a requirement calls for retained documented information and the organization can’t provide the required evidence, the auditor may raise a nonconformity. The significance depends on the nature and extent of the gap and the certification body’s audit determination — missing evidence of an ongoing process, like consistent hazard identification records, tends to raise more concern than a single administrative gap, because it questions whether the process is actually operating.

Do digital record-keeping systems satisfy ISO 45001 documentation requirements?

Yes. ISO 45001 is explicit that documented information can exist in any format or medium, including electronic systems, as long as it’s controlled — meaning it’s identifiable, retrievable, protected from unauthorized changes, and available where it’s needed.

How long do I need to retain OH&S records?

ISO 45001 does not specify one universal retention period for every OH&S record. Retention periods can depend on applicable legal and other requirements, the organization’s own needs, and the type of documented information involved. Check applicable requirements directly through OSHA.gov and other relevant authorities rather than assuming a single retention period applies across all record types.

Does documentation quality affect certification cost?

Indirectly, yes. Weak documentation extends audit time, increases the likelihood of findings that require a follow-up audit, and can push out your certification timeline. Our ISO 45001 cost breakdown covers how audit findings translate into real cost.

📥 Free Resources

ISO 9001 Roadmap — a step-by-step implementation guide for manufacturers building or improving a quality management system, useful if you’re documenting an integrated system alongside ISO 45001.
Manufacturing Compliance Checklist — a practical compliance reference covering key ISO, OSHA, and quality documentation requirements for production environments.
Supplier Quality Checklist — an evaluation tool for assessing supplier quality controls and flow-down compliance, useful when your OH&S documentation extends to contractor and supplier requirements.

Not Sure What to Do Next?

🔹 Still researching what ISO 45001 actually requires? Start with our ISO 45001 Certification Guide for the full picture before you commit to a documentation project.

🔹 Ready to start building your documentation? Download the Manufacturing Compliance Checklist and map your current files against it before you write a single new procedure.

🔹 Need to buy the standard itself? Get ISO 45001:2018 from ANSI Webstore — code CC2026 takes 5% off through December 31, 2026, and ANSI Webstore serves international buyers in multiple languages if you’re documenting across sites outside the US.

🔹 Want structured help closing documentation gaps? Compare ISO 45001 training through BSI Group against ISOQAR’s ISO 45001 course to see which fits your team’s timeline and budget.

Documentation is where most ISO 45001 certification timelines quietly slip. The Standards Navigator exists to make sure yours doesn’t — clear breakdowns of exactly what the standard requires, without the guesswork.

Struggling to Keep Your OH&S Records Audit-Ready?

Some operations build a safety program first and scramble to document it later. Others build the documentation structure alongside the program from day one — and walk into their Stage 1 audit without a single scramble.

The Standards Navigator covers ISO 45001 documentation, implementation timelines, and certification costs specifically for manufacturers who need the practical answer, not the theoretical one.

👉 Get updates on ISO 45001 documentation and audit-readiness content
👉 Be first to access new OH&S checklists and gap-assessment tools

Industrial Compliance. Clearly Explained.

ISO 45001 Implementation Timeline: How Long Certification Actually Takes in 2026

This guide breaks down the ISO 45001 implementation timeline by starting point — no existing safety system, existing ISO 9001/14001 certification, or adding to an integrated system. It covers each certification phase in detail, from gap assessment through Stage 2, and flags where projects most commonly slip.

A Phase-by-Phase Roadmap for Manufacturers Building or Upgrading a Certified Occupational Health and Safety Management System

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

A Customer, an Insurer, or a Citation Just Gave You a Deadline. Does Your Timeline Actually Support It?

A prime customer requires it. An insurance carrier offers a premium reduction for it. Or an OSHA citation makes it clear the current safety program isn’t holding up. Whatever the trigger, someone hands you a date, and you’re expected to have a certified ISO 45001 occupational health and safety management system by then.

That date usually comes with a generic number attached to it — “certification takes 6 to 12 months” — pulled from a webpage, a broker’s pitch, or a competitor who mentioned it once in a meeting. It becomes the plan. Nobody stress-tests it against where the organization’s safety program actually stands today.

That’s the gap that causes missed certification windows. Not the audit itself — the assumption that a generic timeline applies to your specific starting point, hazard profile, and current level of safety management maturity.

This guide is your ISO 45001 implementation timeline — and certification roadmap — broken into its actual phases, with realistic durations by starting point and the points where projects most commonly slip.

From the Floor: I’ve watched a safety program get rebuilt from the ground up after a citation forced the issue — not a binder of procedures, but an actual working program with training records, incident investigation, and hazard identification that could hold up to scrutiny. The plan called for six months. It took over a year, because you can’t manufacture eight months of safety committee minutes and near-miss reports after the fact. The ISO 45001 timelines that blow up are almost never about the audit dates. They’re about assuming the safety culture is further along than the records actually show.

Before you commit to a certification date with a customer or insurer, find out where your OH&S management system actually stands today →

Download the Manufacturing Compliance Checklist

In This Guide

How your starting point changes the ISO 45001 timeline
A phase-by-phase breakdown with realistic durations
What each phase actually requires, including worker participation and hazard identification
The most common reasons ISO 45001 timelines slip
Whether the upcoming ISO 45001:2027 revision should change your start date
A readiness checklist before you commit to a deadline

👉 Start Here (Top Resources)

ISO 45001:2018 — ANSI Webstore — the official current edition, required before you can gap-assess against anything real. Use code CC2026 for 5% off through December 31, 2026.
ISO 45001 Training — BSI Group — foundation and internal auditor training built around ISO 45001’s clause structure and hazard-management requirements.
ISO 45001 Certification — ISOQAR — a second training and certification body option worth comparing against BSI before you commit.
Save on ANSI Standards Bundles — if you’re pairing ISO 45001 with ISO 9001 or ISO 14001, bundling is worth checking before buying each document separately.

How Long Does ISO 45001 Certification Take?

The short answer depends entirely on your organization’s starting point. Here’s the quick-answer version before the detailed phase-by-phase certification schedule below.

Starting Point	Typical Certification Timeline
No formal OH&S management system	12–24 months
Already certified to ISO 9001 or ISO 14001	6–12 months
Adding ISO 45001 to an integrated ISO 9001/14001 system	4–8 months
High-hazard operations (any starting point)	Add 3–6 months

Organizations with no formal safety management system today: realistically 12–24 months from kickoff to certificate
Organizations already certified to ISO 9001 or ISO 14001: realistically 6–12 months, since the Harmonized Structure means the core management-system architecture already exists
Multi-site or high-hazard operations (confined space, hot work, heavy equipment, chemical exposure): add 3–6 months to either baseline
The gap assessment phase determines almost everything downstream — most timeline overruns trace back to an optimistic or incomplete one
Worker participation and consultation — a distinct emphasis in ISO 45001 that many first-time implementers underestimate — takes real time to build, not just document
Certificate issuance follows Stage 2 audit closure, not the audit itself — corrective action closure adds real time on top of the audit dates

For the standard’s full scope and structure, ISO’s own overview of ISO 45001 is worth reviewing before you scope a gap assessment against it.

The Three Starting Points That Determine Your Timeline

ISO 45001 implementation timeline roadmap comparing certification phases for organizations with and without existing ISO 9001 or ISO 14001 systems. — The ISO 45001 implementation timeline varies significantly depending on whether an organization is building its OH&S management system from scratch or extending an existing ISO management system.

A single “ISO 45001 takes X months” answer doesn’t hold up, because the honest project duration depends entirely on what you’re building from.

Building a Safety Management System From Scratch

If you are starting with no formal OH&S management system today → plan for 12–24 months. Much of this duration comes from operating the system long enough to generate audit evidence — incident reports, near-miss investigations, safety committee minutes, training records — not from writing procedures. Every element has to be built: hazard identification and risk assessment, legal and other requirements tracking, emergency preparedness, incident investigation, and worker participation and consultation.

Extending an Existing ISO 9001 or ISO 14001 System

If you are already certified to ISO 9001 or ISO 14001 → plan for 6–12 months. Because all three standards share the same Harmonized Structure, your document control, management review, internal audit program, and corrective action processes carry forward largely intact. What’s new is the OH&S-specific layer: hazard identification and risk assessment, worker participation and consultation, incident investigation, and emergency preparedness. For the full breakdown of what’s genuinely new versus what your existing system already covers, see ISO 9001 vs ISO 45001 and ISO 14001 vs ISO 45001.

Adding ISO 45001 to an Existing Integrated Management System

If you already run an integrated ISO 9001/ISO 14001 system and are adding ISO 45001 as the third pillar → this is typically the fastest path, often 4–8 months, since your corporate-level management review, document control, and internal audit structure already exist. The work concentrates on hazard identification, worker participation processes, and generating enough OH&S-specific records for the certification body to evaluate.

Phase-by-Phase Timeline

Phase	No Existing OH&S System	Existing ISO 9001/14001
Gap assessment and project planning	4–8 weeks	3–5 weeks
Documentation development (OH&S core)	8–14 weeks	3–6 weeks
Hazard identification, risk assessment, and controls	6–12 weeks	4–8 weeks
Worker participation and consultation build-out	4–8 weeks (overlapping)	3–5 weeks (overlapping)
Team training	3–6 weeks (overlapping)	2–4 weeks (overlapping)
System operation and record generation	12–20 weeks minimum	8–12 weeks minimum
Internal audit and management review	3–4 weeks	2–3 weeks
Stage 1 audit and gap closure	3–6 weeks	2–4 weeks
Stage 2 audit	2–5 days on-site	2–5 days on-site
Corrective action closure and certificate issuance	4–12 weeks	4–8 weeks

These ranges assume a single-site, moderate-hazard operation. High-hazard processes — confined space entry, hot work, powered industrial trucks, chemical handling — extend the hazard identification phase because each requires its own documented controls and, in many cases, permit systems and competency records.

Ready to begin scoping your own project timeline? Get the current edition before you start your gap assessment →

ISO 45001:2018 — ANSI Webstore

What Each Phase Actually Involves

Understanding the ISO 45001 implementation timeline phase by phase — the actual implementation schedule, not a generic estimate — is what turns a rough number into a plan you can actually hold a customer, insurer, or leadership team to.

Gap Assessment

This phase sets the accuracy of everything that follows it. A gap assessment against ISO 45001 needs to evaluate hazard identification, worker participation, and legal and other requirements tracking with the same rigor as document control and management review — these are the clauses generic gap assessments consistently under-scope.

Most common finding: Gap assessments performed by someone unfamiliar with ISO 45001’s worker participation and consultation requirements, who scores the clause as “in progress” based on a safety committee that meets but was never actually consulted on the hazard identification process itself.

Not sure how far you are from certification? Download the Manufacturing Compliance Checklist and identify timeline risks before they affect your deadline →

Get the Manufacturing Compliance Checklist

Building Hazard Identification, Risk Assessment, and Controls

This is the phase most first-time ISO 45001 implementers underestimate, because it isn’t a documentation exercise — it’s an operational one. It covers building out:

Hazard identification across all routine and non-routine work, including contractor and visitor activity
Risk assessment methodology, applied consistently across every work area
The hierarchy of controls, applied in practice, not just referenced in a procedure
Legal and other requirements tracking, including OSHA and industry-specific regulations
Emergency preparedness and response planning
Incident investigation procedures that trace root cause, not just document the event

ISO 45001 implementation infographic showing hazard identification, risk assessment, worker participation, emergency preparedness, and evidence. — The ISO 45001 implementation timeline depends on more than documentation, with real evidence built through hazard controls, worker participation, training, investigations, drills, and system operation.

The legal and other requirements register should be built directly from primary sources like OSHA rather than secondhand summaries — a gap assessment built on an outdated or misquoted citation creates false confidence that shows up as a Stage 2 finding.

Each of these gets its own dedicated treatment elsewhere on this site as we continue building out the ISO 45001 cluster — this section is about scoping the time commitment, not the clause-by-clause detail.

Worker Participation and Consultation

If you are treating worker participation as a documentation line item → stop. ISO 45001 places a distinct emphasis on consulting workers in hazard identification, risk assessment, and incident investigation — not just informing them of decisions already made. Auditors specifically interview workers to confirm this consultation actually happens, not just that a committee exists on paper.

Training Your Team

Internal auditors need training specific to ISO 45001’s OH&S-focused clauses, not just general management-system fundamentals — an internal auditor who only understands ISO 9001 or ISO 14001 will miss the findings an external ISO 45001 auditor is specifically trained to catch. See BSI vs ISOQAR for how to choose between the two most common training and certification body options.

Operating the System and Generating Records

If you are tempted to compress this phase → don’t. Certification bodies expect to see the system operating long enough to generate a meaningful record set — hazard identification updates, incident and near-miss investigations with closed corrective actions, safety committee minutes showing actual worker consultation, and at least one emergency drill. A system that’s only existed on paper for three weeks doesn’t have enough history for an auditor to evaluate.

From the Floor: One operation I worked with planned to schedule Stage 1 audit six weeks after finishing their documentation. The procedures looked complete, but the safety committee had met exactly once, no near-miss reports had been logged, and nobody could produce a completed incident investigation. The paperwork was ready. The system wasn’t. They pushed Stage 1 back nearly two months and avoided what would have become a rough Stage 2.

Internal Audit and Management Review

Your internal audit program has to specifically cover hazard identification, worker participation, and legal compliance evaluation, not just document control and corrective action — auditors need to verify these OH&S-specific elements with the same scrutiny as the management-system core.

Stage 1 and Stage 2 Audits

Stage 1 verifies your documentation is complete and ready for Stage 2 — expect the auditor to specifically confirm your legal and other requirements register and worker consultation records exist before scheduling Stage 2. Stage 2 is the full on-site system audit, including shop floor walkthroughs, worker interviews, and incident record review.

Signs You’re Ready for Stage 1:

✅ Hazard register complete

✅ Legal register complete

✅ Internal audit complete

✅ Management review completed

✅ Worker consultation documented

✅ Emergency drill completed

✅ Corrective actions closed

If you can’t check every box above, Stage 1 is premature — schedule it once the list is genuinely complete, not once the calendar says it’s time.

ISO 45001 Stage 1 readiness checklist showing audit preparation, worker consultation, internal audits, management review, and corrective actions. — This ISO 45001 implementation timeline milestone focuses on Stage 1 readiness, showing the evidence organizations should have in place before beginning the certification audit process.

Closing Corrective Actions and Certificate Issuance

If your Stage 2 audit identifies nonconformances → certification bodies typically require corrective action responses within a defined window, often in the 30–90 day range depending on the finding and the certification body’s specific procedures; major findings can require a return audit, which resets a meaningful chunk of the timeline. Certificate issuance follows corrective action closure, not the audit date itself.

Before you commit to a certification body, verify its accreditation status directly through ANAB — a certificate issued by an unaccredited body may not satisfy a customer or insurer requirement even if the audit itself was thorough.

What Slows Down an ISO 45001 Timeline

Treating the gap assessment as a formality instead of the project’s foundation. A rushed or generic gap assessment produces an optimistic timeline that collapses the first time an auditor finds a hazard that was never formally identified.

Underestimating worker participation and consultation. Organizations routinely assume an existing safety committee satisfies this requirement without checking whether workers are actually consulted on hazard identification and risk assessment, not just briefed after the fact.

Not budgeting time for the system to actually run. Documentation can be written quickly. Evidence that the system is operating — incident investigations, near-miss trending, closed corrective actions, a completed emergency drill — cannot be generated overnight, no matter how much internal pressure exists to compress the calendar.

Underestimating high-hazard process requirements. Confined space, hot work, powered industrial trucks, and chemical handling each carry their own permit systems, competency records, and control documentation that extend the timeline beyond a low-hazard office or light-assembly scope.

Committing to a customer or insurer deadline before the gap assessment is complete. This is the single most common planning mistake. The deadline gets set first, based on a generic timeline; the actual gap assessment — which should inform the deadline — happens after the commitment is already made.

If you haven’t run a structured gap assessment yet, that’s the step to complete before setting any date with a customer or insurer →

Get the Manufacturing Compliance Checklist

Should You Wait for ISO 45001:2027 Before Starting?

No. ISO 45001:2018 remains the current, actively audited standard, and certification bodies continue issuing certificates against it. The next revision, ISO 45001:2027, reached the Draft International Standard (DIS) stage in mid-2026 and is expected to publish sometime in 2027, with a transition period widely expected to follow the same three-year pattern set by ISO 9001:2026 and ISO 14001:2026 — though that transition timeline has not yet been formally confirmed by IAF. Proposed changes lean toward expanded emphasis on psychosocial risk, worker well-being, and evolving ways of working rather than a structural overhaul.

If a customer requirement, insurance deadline, or citation is driving your timeline today → there is no reason to delay pursuing ISO 45001:2018 certification while waiting for a standard that hasn’t published yet. Track the ISO 45001 Certification Guide for updates as the 2027 revision develops.

Quick Timeline-Readiness Checklist

✅ Gap assessment completed against the current ISO 45001:2018 edition, not a generic OSHA compliance checklist

✅ Hazard identification, risk assessment, and worker participation scoped individually, not bundled as “documentation”

✅ Internal auditors trained specifically on ISO 45001’s OH&S-focused clauses

✅ High-hazard process controls (confined space, hot work, powered industrial trucks, chemical handling) identified and budgeted for separately

✅ Realistic operating period built into the schedule before Stage 1 — not compressed to meet an external deadline

⚠️ If your certification deadline was set before your gap assessment was complete, revisit it now rather than after Stage 1 uncovers the gap

FAQ

How long does ISO 45001 certification typically take?

Organizations building a safety management system from scratch typically need 12–24 months. Organizations already certified to ISO 9001 or ISO 14001 typically need 6–12 months, since document control, internal audit, and management review carry forward through the Harmonized Structure. Multi-site or high-hazard operations should add 3–6 months to either estimate.

What’s the fastest realistic timeline for ISO 45001 certification?

For an organization already running an integrated ISO 9001/ISO 14001 system, with a focused scope and dedicated project resources, 4–6 months is achievable — but only if the gap assessment is thorough and hazard identification work starts immediately rather than after documentation is finished.

Can ISO 45001 be implemented in six months?

Only under specific conditions: an existing ISO 9001 or ISO 14001 system already in place, a single-site low-to-moderate hazard scope, and dedicated project resources rather than a part-time effort. Outside those conditions, six months is not a realistic implementation schedule — the system-operation phase alone typically needs 8–12 weeks minimum to generate enough evidence for Stage 1.

Can we get ISO 45001 certified without ISO 9001 or ISO 14001?

Yes. ISO 45001 is a standalone standard and doesn’t require certification to any other standard first. Building it from scratch simply means the full management-system architecture and the OH&S-specific requirements get built together rather than layered onto an existing system, which is reflected in the longer 12–24 month timeline for organizations with no existing system.

What’s the single biggest risk to an ISO 45001 implementation timeline?

Underestimating worker participation and consultation. Organizations frequently assume an existing safety committee satisfies this requirement without verifying that workers are genuinely consulted on hazard identification and risk assessment — auditors interview workers directly to check this, and a gap here is a common Stage 2 finding.

Does the Stage 2 audit date mark the end of the timeline?

No. Certificate issuance follows the closure of any corrective actions identified during Stage 2 — typically 4–12 weeks beyond the audit date itself, depending on finding severity. Major nonconformances can require a return audit, which extends the timeline further.

How much do high-hazard processes add to the timeline?

Confined space entry, hot work, powered industrial trucks, and chemical handling each require their own permit systems, competency records, and documented controls on top of the base ISO 45001 requirements. Depending on how many high-hazard processes are in scope, this can add 3–8 weeks to the hazard identification and controls phase.

Should we hire a consultant to compress the timeline?

A consultant can help you scope hazard identification and worker participation requirements accurately, which reduces the risk of timeline slippage — but no consultant can compress the system-operation phase, since certification bodies need to see evidence the system has actually been running, not just documented.

What happens if our certification deadline arrives before we’re ready?

Pursuing certification before the system has genuinely operated long enough typically results in Stage 2 findings that extend the timeline further than waiting would have. A missed customer or insurer deadline is a difficult conversation; a failed Stage 2 audit against a rushed system is usually a worse one.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

🔹 You’re still scoping whether ISO 45001 is the right standard for your operation → Start with the ISO 45001 Certification Guide for the full requirements picture before you commit to a timeline.

🔹 You’re ready to find out where your safety program actually stands → Download the Manufacturing Compliance Checklist before you set any certification date with a customer or insurer.

🔹 You need to understand the full cost picture alongside the timeline → How Much Does ISO 45001 Cost?

🔹 You need the official standard before you can gap-assess anything → ISO 45001:2018 — ANSI Webstore, or save on a bundle if you’re pairing it with ISO 9001 or ISO 14001.

🔹 You need training or a certification body recommendation → BSI vs ISOQAR for a ranked comparison, or see the Best ISO Certification Bodies guide.

The Timeline Is Real. The Deadline Should Follow It, Not the Other Way Around.

A customer, insurer, or citation-driven deadline is real pressure, but it isn’t a substitute for an honest gap assessment. The organizations that hit their certification date are almost always the ones that scoped their actual starting point before committing to one — not the ones that worked backward from a generic number and hoped the gap assessment would agree with it.

At The Standards Navigator, we cover the full ISO 45001 certification path — from the standard itself to implementation sequencing, worker participation requirements, and certification body selection — so your ISO 45001 implementation timeline is built on your actual starting point, not someone else’s.

Organizations that wait for a citation or a lost contract to start their ISO 45001 timeline are always working from behind. Organizations that scope their real starting point today are the ones that hit the date someone else set for them.

👉 Get updates on ISO 45001 implementation guidance and safety management insights

👉 Be first to access new ISO 45001 cluster guides and tools as they publish

Industrial Compliance. Clearly Explained.

AS9145 Explained: Aerospace APQP and PPAP Requirements for 2026

AS9145 governs Advanced Product Quality Planning (APQP) and Production Part Approval Process (PPAP) for aerospace suppliers. This guide breaks down the PPAP elements, explains how primes like Boeing and Lockheed Martin flow the requirement down through purchase orders and supplier quality clauses, and covers the triggers that require a new submission.

What Advanced Product Quality Planning and Production Part Approval Really Require From Suppliers

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

When “It Passed First Article” Isn’t the Same as PPAP Approval

A new part clears first article inspection. The customer signs off. Then, three weeks later, a supplier quality engineer emails asking for the DFMEA, the control plan, and the measurement system analysis — none of which were part of the FAI package.

That gap catches a lot of suppliers off guard. First article inspection is one deliverable. AS9145 is commonly structured around eleven.

If you’re new to advanced product quality planning (APQP) in aerospace, this article explains what the standard actually requires. If you’ve already built a PPAP process and want to check it against the full element list, jump to the requirements breakdown below. Either way, this is the standard most aerospace suppliers don’t fully understand until a customer flow-down requirement forces the issue.

From the Floor: I’ve sat across the table from a supplier quality engineer who rejected a PPAP submission because the process capability study only covered one of three key characteristics on the drawing. The part had already passed first article. It didn’t matter — PPAP looks at the whole production process, not just the finished part. That’s the distinction that trips up shops moving from AS9100 compliance into full APQP/PPAP flow-down.

Most operations managers don’t find out their APQP process has gaps until a customer rejects a submission mid-program. Run your QMS against the AS9100 Rev D Gap Assessment Checklist before that happens → Download the free 74-item checklist

In This Guide

What AS9145 is and why IAQG created it
APQP vs. PPAP — how the two processes fit together
The 11 PPAP elements aerospace suppliers typically assemble
How AS9145 connects to AS9100, AS9102, and NADCAP
Whether AS9145 certification exists (it doesn’t — here’s what that means for you)
How customers actually flow down AS9145 requirements — and how to tell if it applies to you
Common triggers that require a new or updated PPAP submission
Common mistakes suppliers make when implementing AS9145
FAQs on scope, cost, and flow-down requirements

👉 Start Here (Top Resources)

AS9145 — ANSI Webstore — Purchase the current edition of the standard directly from the official distributor.
BSI AS9100 Training Courses — Because AS9145 flow-down is typically checked through AS9100 audits, BSI’s AS9100 training covers the QMS context APQP/PPAP sits inside.
AS9100 Rev D Gap Assessment Checklist — Confirm your QMS foundation is solid before layering APQP/PPAP requirements on top of it.

What Is AS9145?

AS9145 is the aerospace industry’s standard for Advanced Product Quality Planning (APQP) and Production Part Approval Process (PPAP). The International Aerospace Quality Group (IAQG) released it in November 2016, adapting the automotive industry’s long-established APQP/PPAP framework (built by AIAG) to aerospace and defense manufacturing.

The standard exists because aerospace primes and OEMs — Lockheed Martin, Boeing, Rockwell Collins, and others — needed a structured, auditable way to confirm that a new part, or a part built from a new or changed process, would consistently meet requirements before full-rate production started. AS9100 certification tells a customer your quality management system is sound. AS9145 tells them a specific part and process combination is production-ready.

As of this writing, the current published edition remains the November 2016 release. IAQG has discussed a revision to clarify mandatory versus optional deliverables and streamline change management, but no new edition has been formally published — treat any “AS9145 Revision A” references you encounter online as forward-looking, not current. Verify the current revision status through SAE International or IAQG before purchasing or implementing requirements.

APQP vs. PPAP: Two Processes, One Standard

Infographic comparing AS9145 APQP and PPAP processes, illustrating how Advanced Product Quality Planning activities generate the documentation required for Production Part Approval Process submissions. — This infographic shows how AS9145 connects APQP planning activities to the PPAP documentation package required for aerospace customer approval.

APQP and PPAP are often used interchangeably, which causes confusion. They’re related but distinct.

Element	APQP	PPAP
What it is	The planning process across the product development lifecycle	The documentation package submitted for customer approval
When it happens	Continuously, from design through production launch	At defined milestones — typically before full-rate production
Purpose	Detect risk early, coordinate design and process feedback	Prove the process can repeatably produce a conforming part
Output	Design reviews, risk assessments, control plans	The 11-element submission package plus the PPAP approval form
Owner	Cross-functional team (design, quality, manufacturing)	Quality function, submitted to the customer for disposition

Think of APQP as the process and PPAP as the proof. It’s difficult to submit a credible PPAP package without having run APQP first — the PPAP elements are largely artifacts APQP is meant to generate along the way.

The 11 PPAP Elements Aerospace Suppliers Typically Assemble

Infographic illustrating the 11 AS9145 PPAP elements required for aerospace production approval, including design records, DFMEA, PFMEA, MSA, FAIR, and PPAP documentation. — This infographic breaks down the 11 AS9145 PPAP elements that aerospace suppliers assemble to demonstrate production readiness and obtain customer approval.

Automotive PPAP under AIAG runs 18 elements. Aerospace requirements are commonly grouped into 11 aerospace PPAP deliverables under AS9145 — a deliberate scope difference, since IAQG built the standard to fit aerospace’s lower production volumes and higher part complexity rather than copy automotive wholesale. Some customers and auditors group or document these elements slightly differently in practice, so always confirm the exact submission format against your specific customer’s requirements before you finalize a package.

#	Element	What It Confirms
1	Design record	The part matches the current released drawing/model
2	Design risk analysis (DFMEA)	Design failure modes were identified and mitigated
3	Process flow diagram	Every manufacturing and inspection step is mapped
4	Process risk analysis (PFMEA)	Process failure modes were identified and mitigated
5	Control plan	Key characteristics are monitored at the right points in the process
6	Measurement system analysis (MSA)	Gauges and inspection methods are capable of measuring what they claim to measure
7	Initial process capability studies	The process can hold tolerance on key characteristics
8	Packaging, preservation, and labeling approvals	The part survives handling and shipment without degradation
9	First article inspection report (FAIR)	The part conforms to drawing requirements — see AS9100’s First Article Inspection Requirements for the full clause breakdown
10	Customer-specific PPAP requirements	Any additional documentation the customer’s flow-down demands
11	PPAP approval form	The customer’s formal disposition — approved, conditional, or rejected

Example: A supplier manufacturing machined aluminum brackets for a military aircraft receives a purchase order that flows down AS9145. The resulting PPAP package would typically include the released engineering drawing, a PFMEA covering the machining operations, a control plan identifying the inspection method and frequency for the critical hole diameters, a gage R&R study validating the CMM program used to measure those diameters, an initial process capability study, the FAIR, and any customer-specific forms called out on the purchase order.

Most aerospace customers expect capability evidence on designated key characteristics, not just a passing measurement. Capability is typically demonstrated using Cp/Cpk studies, ongoing SPC data, or a customer-approved alternative method — which one applies depends on production volume and the risk classification of the characteristic.

If you are already producing FAIRs under AS9100 clause requirements → you likely already have much of element 9 in place. For many suppliers, the remaining gap tends to fall in elements 2 through 7 — the risk analysis and capability studies some shops treat as optional until a customer’s purchase order makes them mandatory.

One of the most common findings: Suppliers often submit a PPAP package with a completed FAIR and design record, but no PFMEA or control plan tied to the same key characteristics. Customers frequently reject these submissions because the package doesn’t clearly show how the process will keep producing conforming parts — only that one sample did.

How AS9145 Connects to AS9100, AS9102, and NADCAP

AS9145 doesn’t operate on its own. It’s woven into the broader aerospace quality framework:

AS9100 — your certified QMS is the foundation APQP/PPAP sits on top of. See AS9100 vs ISO 9001 if you’re still building that foundation.
AS9102 — governs first article inspection reporting specifically, which becomes PPAP element 9.
NADCAP — a separate special-process accreditation system. AS9145 and NADCAP address different risk areas and neither substitutes for the other; see NADCAP vs AS9100 for how the two fit together.

When a customer flows down AS9145 requirements, it typically shows up as a purchase order note or a supplier quality manual reference — not as a separate certification audit. Your registrar’s AS9100 surveillance audit is often where an auditor checks whether your APQP/PPAP process, if you’ve committed to one contractually, is actually being followed.

Infographic showing how AS9145 connects with AS9100, AS9102, NADCAP, and customer flow-down requirements within the aerospace quality management system. — This infographic illustrates how AS9145 integrates with AS9100, AS9102, NADCAP, and customer flow-down requirements to support aerospace quality planning and production approval.

Is AS9145 Certifiable?

No — and this is the objection worth addressing directly. AS9145 is a guidance and requirements standard, not a certifiable one. There’s no accredited registrar issuing “AS9145 certificates” the way there is for AS9100. That leads some operations managers to deprioritize it, assuming it’s optional.

It isn’t, in practice. Contractually, AS9145 becomes a binding requirement once a customer flows it down in a purchase order or supplier quality manual — something primes and Tier 1s do with increasing frequency. At that point, your compliance gets evaluated two ways: through the PPAP submission itself, and through how well your documented process matches what an AS9100 auditor observes on the floor. Skipping APQP/PPAP discipline doesn’t remove the requirement — it just means you’ll be building the documentation reactively, under deadline pressure, instead of as part of normal program planning.

If you are under customer pressure to submit a first PPAP package quickly → don’t skip straight to the paperwork. Build the process flow diagram and control plan first; the rest of the elements depend on those being accurate.

How Customers Flow Down AS9145 Requirements

This is the question most suppliers actually have: does AS9145 apply to me? The answer is almost always sitting in the contract, not the standard itself. The common flow-down mechanisms:

PO notes. Many primes attach AS9145 requirements as a numbered note directly on the purchase order rather than as a standalone contract clause — easy to miss if you’re only reading the drawing and spec callouts.
Supplier quality clauses. Most primes and Tier 1s maintain a dedicated supplier quality requirements document with a specific APQP/PPAP clause referencing AS9145 by name. If your customer’s supplier quality manual or PO cites AS9145, AS9102, or “APQP/PPAP” directly, it applies to that part.
Boeing. Boeing’s Supplemental Quality Requirements for Suppliers document and its PO Notes system govern when APQP applies. As of this writing, the framework ties the requirement to the specific part number identified in the procurement agreement rather than a blanket program-wide mandate, and Boeing reserves the right to review and approve APQP/PPAP submissions directly — but these documents are revised periodically, so confirm against the current revision your contract references.
Lockheed Martin. Lockheed Martin Aeronautics maintains a supplier quality clause covering APQP/PPAP that’s modeled on AS9145 and, as of this writing, applies to the purchase order and to lower-tier detail parts, plus a related first article inspection clause tying FAI performance into the broader APQP/PPAP system. Like Boeing’s documents, these clauses are revised periodically — verify against the revision cited in your contract.
Tier 1 suppliers. A Tier 1 that receives AS9145 flow-down from a prime is typically obligated under its own contract to pass that requirement to its sub-tier suppliers. A shop with no direct relationship to Boeing or Lockheed can still end up on the hook for a full PPAP submission through a Tier 1 customer’s flow-down.

If you are unsure whether AS9145 applies to a specific part → check the purchase order notes and your customer’s supplier quality manual before you start production. The requirement is almost always explicit once you know where to look — it shouldn’t arrive as a surprise mid-program.

Common Triggers for an AS9145 PPAP

PPAP isn’t a one-time event reserved for brand-new parts. Customers typically expect a new or updated PPAP submission when one of these occurs:

New product introduction
New customer
New manufacturing location
Major process change
Tooling replacement
Significant engineering change
Customer-requested revalidation

Any one of these can trigger a full or partial PPAP resubmission, even on a part that’s been in stable production for years.

If you are moving production to a new facility or replacing tooling on an established part → confirm with your customer whether a PPAP resubmission is required before you make the change, not after. Retroactive PPAP submissions are far harder to defend than ones planned into the change itself.

Common Mistakes in AS9145 Implementation

Treating FAIR as the whole submission. First article inspection is one of eleven elements, not a substitute for the rest.
Running PFMEA and control plan development as separate, disconnected exercises. They should reference the same key characteristics — when they don’t, customers catch the mismatch immediately.
Skipping MSA on new inspection equipment. A capable process measured with an incapable gauge produces PPAP data that’s difficult to trust.
Waiting for the customer to specify element 10 requirements before starting the rest. Customer-specific requirements layer on top of the standard 11 elements — they don’t replace the need to start APQP early.
No cross-functional ownership. APQP tends to break down when it’s treated as a quality department task instead of a design-manufacturing-quality collaboration from the start.

Quick AS9145 Readiness Checklist

✅ Design record matches the current released drawing revision
✅ DFMEA and PFMEA completed and cross-referenced to the same key characteristics
✅ Process flow diagram covers every manufacturing and inspection step
✅ Control plan identifies monitoring method and frequency for each key characteristic
✅ MSA completed on gauges used to measure key characteristics
✅ Initial process capability study demonstrates the process can hold tolerance
✅ Packaging and preservation method validated for the part’s handling requirements
✅ FAIR completed per AS9102 and matches the design record
✅ Customer-specific PPAP requirements identified before submission, not after
✅ PPAP approval form included and routed for customer disposition

What Does It Cost to Implement AS9145?

There’s no certification fee, since AS9145 isn’t a certifiable standard — the cost is internal: engineering time for DFMEA/PFMEA, capability studies, and control plan development, plus the price of the standard itself. If your team is also purchasing related AS9100-series documents, buying the standards as a bundle typically costs less than purchasing each one individually, and code CC2026 takes an additional 5% off through December 31, 2026.

FAQ

Is AS9145 the same as AS9100?

No. AS9100 is a certifiable quality management system standard. AS9145 is a non-certifiable process standard covering APQP and PPAP for specific parts and production processes — it operates within an AS9100-certified QMS, not in place of one.

Does every aerospace supplier need to comply with AS9145?

Only when a customer flows down the requirement — through a purchase order, supplier quality manual, or contract clause. It’s not a blanket regulatory requirement, but flow-down has become common enough among primes and Tier 1s that most active aerospace suppliers are likely to encounter it at some point.

How many PPAP elements does AS9145 require?

Aerospace requirements are commonly grouped into eleven PPAP deliverables, compared to the 18 elements used in automotive PPAP under AIAG. Aerospace’s version was scoped down to fit lower production volumes and higher part complexity, though some customers document or group elements slightly differently.

What’s the difference between APQP and PPAP?

APQP is the ongoing planning process across product development. PPAP is the documentation package — built from APQP activities — submitted to the customer for approval before production.

Can a first article inspection report substitute for a full PPAP submission?

No. FAIR is one of the eleven commonly documented PPAP elements (element 9), not a replacement for the rest. A part can pass first article inspection and still have an incomplete PPAP package if the risk analyses, control plan, or capability studies are missing.

Is there a registrar audit specifically for AS9145?

No. There’s no accredited certification body issuing AS9145 certificates. Compliance is verified through the customer’s review of your PPAP submission and, indirectly, through your AS9100 surveillance audits if APQP/PPAP has become a contractual requirement your registrar is checking against.

Where do I buy the AS9145 standard?

Through the ANSI Webstore, the authorized distributor for SAE aerospace standards. Avoid free PDF copies circulating outside official channels — they’re frequently outdated or incomplete, and using one puts your PPAP submission at risk of referencing superseded requirements.

How does AS9145 relate to NADCAP?

They’re independent systems addressing different risk areas. AS9145 governs new product and process introduction through APQP/PPAP. NADCAP accredits special processes like heat treating, welding, and NDT. A supplier can need both, either, or neither depending on what they produce and what their customers require — see our full comparison for the details.

How do I know if AS9145 applies to my company?

Check your purchase order notes and your customer’s supplier quality manual. AS9145 flow-down is almost always explicit — cited by name in a PO note or a dedicated APQP/PPAP clause — rather than implied. If you supply a Tier 1 that itself received AS9145 flow-down from a prime, the requirement passes down to you contractually even without a direct relationship to the prime.

What triggers a new PPAP submission on a part already in production?

New product introduction, a new customer, a new manufacturing location, a major process change, tooling replacement, a significant engineering change, or a customer-requested revalidation. Any of these can require a full or partial PPAP resubmission even on parts that have been in stable production for years.

📥 Free Resources

AS9100 Rev D Gap Assessment Checklist — 74-item, clause-by-clause checklist for aerospace suppliers assessing their QMS before certification or a flow-down audit.
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements.

Not Sure What to Do Next?

🔹 Still researching? Read What Is AS9100? to understand the QMS foundation AS9145 sits on top of.

🔹 Ready to build your APQP/PPAP process? Download the AS9100 Rev D Gap Assessment Checklist and confirm your QMS can support the documentation elements before you start.

🔹 Need to buy the standard? AS9145 — ANSI Webstore for the individual standard, or use the ANSI Bundle Link with code CC2026 if you’re purchasing multiple AS9100-series documents together.

🔹 Need training on the QMS context AS9145 operates in? BSI’s AS9100 training courses cover the audit environment your APQP/PPAP process will be evaluated against.

AS9145 rewards suppliers who treat it as a planning discipline instead of a paperwork exercise. Build the risk analyses and control plans as part of your normal development process, and the PPAP submission comes together far more easily. We’ll update this guide if IAQG publishes a revised edition.

Stay Ahead of Aerospace Flow-Down Requirements

Many PPAP rejections trace back less to a misunderstanding of the standard and more to APQP being treated as a last-minute paperwork sprint instead of a planning process run alongside design and manufacturing engineering.

Shops that build DFMEA, PFMEA, and control plans into their normal product development workflow tend to submit cleaner PPAP packages on the first pass. Shops that wait until the customer asks often end up reverse-engineering documentation under deadline pressure — and that’s when submissions are more likely to get rejected.

The Standards Navigator covers AS9145, AS9100, and the rest of the aerospace quality framework suppliers need to stay contract-ready.

👉 Get updates on aerospace quality planning and flow-down requirements
👉 Be first to access new AS9100 and AS9145 resources as we publish them

Industrial Compliance. Clearly Explained.

AS9110 vs AS9120: Which Aerospace Standard Does Your Business Actually Need? (2026)

AS9110 and AS9120 are both aerospace quality standards built on ISO 9001 — but they serve completely different operations. This guide compares MRO certification (AS9110) against stockist distributor certification (AS9120), covering scope, clause differences, cost, and how to confirm which standard actually matches your business.

MRO certification vs. stockist distributor certification — how to tell which AS91XX standard applies to your operation

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Confusing These Two Standards Can Cost You a Contract

A prime contractor asks if you’re “AS certified.” You say yes — but you say it without knowing which AS certification they mean. That gap shows up fast in a supplier qualification review, and understanding AS9110 vs AS9120 before that conversation happens is what keeps you from losing a bid before you ever quote a price.

AS9110 and AS9120 are both aerospace quality management system standards built on the same ISO 9001 foundation as AS9100. But they exist for two completely different kinds of operations. AS9110 governs maintenance, repair, and overhaul (MRO) organizations. AS9120 governs stockist distributors — companies that buy, store, and resell aerospace parts without altering them. Certify to the wrong one, or assume one covers what the other requires, and you’ll fail a customer audit or lose a contract before the certificate is even printed.

If you’re evaluating which standard applies to your operation — or a supplier is asking which one you hold — this guide breaks down the real differences: scope, clause focus, cost, and how to know which one is actually right for you.

From the Floor: I’ve sat at the table with a smaller machine shop during an onboarding audit with a much larger aerospace manufacturer who assumed AS9100 covered their distribution operation — it didn’t, and it cost them weeks in corrective action before we could approve them as a source. The standard has to match what you actually do on the floor, not what sounds closest to what your customer asked for.

Before you go further, know exactly where your QMS stands. Run your operation against the AS9100 Rev D Gap Assessment Checklist — a 74-item, clause-by-clause tool that also flags where MRO- and distribution-specific requirements diverge from base AS9100. Most gap findings are found six weeks too late. Don’t be one of them.

In This Guide

What AS9110 covers and who needs it
What AS9120 covers and who needs it
Side-by-side clause and scope comparison
Certification cost and timeline differences
How to know which standard — or standards — your operation needs
What’s changing in the 2026 IAQG standards revision
FAQs on dual certification, transition, and audit prep

👉 Start Here (Top Resources)

Building your documentation from scratch or closing gaps fast? 9001Simplified’s documentation kits give you a QMS framework built around ISO 9001 that you can adapt to AS9110 or AS9120’s additional clauses — without hiring a consultant.
Need the actual standard text? AS9110 — ANSI Webstore and AS9120 — ANSI Webstore — both standards are available for direct purchase.
Shopping for training or a certification body? BSI’s aerospace training catalog covers AS9100-family courses, including MRO and distributor-specific tracks.

What Is AS9110?

Quick Answer: AS9110 is the aerospace quality management system standard for organizations that perform maintenance, repair, and overhaul (MRO) work on aircraft, engines, components, or related equipment. The current edition, AS9110 Rev C (2016), is titled “Quality Management Systems — Requirements for Aviation Maintenance Organizations” and is built on the ISO 9001:2015 clause structure.

AS9110 applies to organizations that touch a product’s airworthiness after it’s already in service — not organizations designing or manufacturing it new. That includes:

FAA Part 145 certified repair stations
Engine and component overhaul shops
Organizations performing continuing airworthiness management
MRO providers serving commercial, private, or military aircraft

The clause set adds requirements around configuration control of repaired items, release-to-service documentation, component traceability through the repair cycle, and management of customer-supplied product — all specific to the risk profile of returning a used part to service rather than shipping a new one.

If you’re comparing AS9110’s foundation to base ISO 9001, our AS9100 vs ISO 9001 breakdown covers the shared clause structure that AS9110 inherits.

What Is AS9120?

Quick Answer: AS9120 is the aerospace quality management system standard for stockist distributors — companies that procure aerospace parts, materials, or assemblies and resell them without physically modifying the product. The current edition, AS9120 Rev B, is titled “Quality Management Systems — Requirements for Aviation, Space and Defense Distributors.”

AS9120 is intentionally narrow in scope. It’s built for organizations that buy from an approved source, store product under controlled conditions, and ship it back out — sometimes splitting larger lots into smaller quantities, or performing a customer- or regulatory-required inspection before delivery. It is explicitly not intended for organizations that repair, maintain, or perform any process that changes the product’s characteristics or conformity.

That distinction matters because it drives the clause focus. AS9120 emphasizes:

Purchasing controls and approved source verification
Prevention of counterfeit and suspect unapproved parts
Storage, handling, and shelf-life control
Traceability of parts back to the original manufacturer

If counterfeit parts prevention is a gap area for your operation, our Counterfeit Parts Standards guide covers the AS9100-family clause requirements — including how AS9120 handles it for distributors specifically.

Infographic comparing AS9110, AS9120, and AS9100 to help aerospace organizations determine the correct quality management standard based on maintenance, distribution, or manufacturing activities. — This decision guide helps aerospace organizations determine whether AS9110, AS9120, or AS9100 best aligns with their operational scope and certification requirements.

AS9110 vs AS9120: Side-by-Side Comparison

Category AS9110 (MRO) AS9120 (Distributors) Who it applies to Maintenance, repair, and overhaul organizations Stockist distributors, no physical modification of product Current edition Rev C (2016) Rev B Base standard ISO 9001:2015 ISO 9001:2015 Primary risk addressed Airworthiness of returned-to-service parts Traceability and authenticity of resold parts Key added clauses Release-to-service documentation, configuration control, maintenance data control Approved source verification, counterfeit parts prevention, lot control Typical certified organizations FAA Part 145 repair stations, engine overhaul shops Parts distributors, stockist suppliers, kitting operations Physical modification of product Yes — repair, overhaul, alteration No — resale only, with limited exceptions (splitting lots, inspection) Can be held alongside AS9100 Yes, for operations doing both design/production and MRO Yes, though less common — usually a standalone certification

⚠️ Most common finding: Auditors regularly flag distributors who hold AS9120 but perform light processing — such as re-marking, relabeling, repackaging, or other activities that affect traceability documentation — without realizing that activity may push them out of AS9120’s defined scope and into AS9110 or AS9100 territory. Know exactly what your operation does to the product before you pick a standard.

If you are unsure which standard matches your actual operation → map every process step against the AS9110 and AS9120 scope statements before you approach a certification body, not after you’ve already scheduled an audit.

Side-by-side AS9110 vs AS9120 comparison infographic showing differences in maintenance, repair, overhaul, distribution, traceability, documentation, and quality management requirements. — This AS9110 vs AS9120 comparison highlights where the two aerospace quality management standards share common requirements and where their operational focus differs.

Certification Cost and Timeline

Neither AS9110 nor AS9120 certification is dramatically more expensive than base AS9100 — the cost driver is usually organization size and audit complexity, not which standard you’re certifying to. Expect the same general cost structure: registrar audit fees, any documentation or consulting spend, and internal resource time for gap closure and internal audits.

For a full breakdown of what drives AS9100-family certification cost, see How Much Does AS9100 Certification Cost? — the same cost categories apply to AS9110 and AS9120 audits, with adjustments for scope.

If you are budgeting for certification this year → don’t assume AS9120 is cheaper because the standard is “smaller.” Distributor audits still require full documentation review, internal audit evidence, and a two-stage certification audit through an accredited registrar.

How Long Does Implementation Take?

Timeline follows the same general phases as AS9100: gap assessment, documentation build-out, implementation and internal audit, then the two-stage certification audit. Organizations with an existing ISO 9001 QMS typically move faster because the foundational clause structure is already in place — AS9110 and AS9120 add to that structure rather than replacing it.

For a phase-by-phase breakdown you can apply to either standard, our AS9100 Implementation Timeline walks through the realistic timeline most organizations should plan for.

Most teams miss this step — run a gap check against the specific standard you’re pursuing before you start building documentation. A generic AS9100 gap assessment won’t fully capture AS9110’s release-to-service requirements or AS9120’s distributor-specific traceability and counterfeit-part controls. Check yours before you invest in a documentation build-out you’ll have to redo →

Do You Need Both?

Some organizations legitimately need more than one AS91XX certification — a Tier 1 supplier that manufactures parts and also runs an internal repair operation might hold both AS9100 and AS9110. A distributor that occasionally performs approved rework might need to evaluate whether AS9120 alone still covers their scope, or whether they’ve drifted into AS9110 or AS9100 territory.

If you are already AS9100 certified and expanding into MRO or distribution work → don’t assume your existing certificate covers the new activity. Confirm scope with your registrar before you take on contracts that depend on AS9110 or AS9120 coverage you don’t actually have.

Traceability requirements run through all three standards, just with different emphasis. If you’re building out traceability documentation, our AS9100 Traceability Requirements article covers the clause 8.5.2 requirements that AS9110 and AS9120 both extend from.

Decision flowchart comparing AS9110 vs AS9120 and AS9100, helping aerospace organizations determine the correct quality management standard based on maintenance, distribution, or manufacturing activities. — This AS9110 vs AS9120 decision flowchart guides aerospace organizations to the quality management standard that best matches their operational scope and certification needs.

Objection: “We’re Small — Do We Really Need to Certify to the Exact Right Standard?”

Yes, and here’s why it’s not just paperwork. Prime contractors and OEMs use your certification scope to determine what work they can flow down to you without additional oversight. If your certificate doesn’t match your actual scope of work, you risk being disqualified from a bid, or worse, passing an audit on paper while operating outside your certified scope — which becomes a much bigger problem the first time there’s a quality escape traced back to your facility.

Small organizations especially benefit from getting this right the first time, because a second certification audit to fix a scope mismatch costs real money and real time you don’t get back.

What’s Changing: The 2026 IAQG Standards Revision

The International Aerospace Quality Group is currently working through a comprehensive revision of the AS9100 series. Current IAQG working materials indicate the standards are expected to transition to the IA9100-series naming convention, although final publication details and transition requirements have not yet been formally released. Planned changes include stronger supplier management requirements, formal cybersecurity risk integration, and expanded counterfeit parts prevention measures for distributors specifically.

⚠️ This revision has not been published as final text as of this writing, and no confirmed transition deadline has been set. Treat any specific 2026 publication date as preliminary until IAQG and SAE International confirm final release. We’ll update this article once the revised editions are formally published.

Quick Audit Checklist: Which Standard Applies to You?

✅ Does your organization physically repair, overhaul, or alter aerospace products after they’ve entered service? → AS9110

✅ Does your organization buy, store, and resell aerospace parts without modification? → AS9120

✅ Does your organization design, develop, or manufacture new aerospace products? → AS9100 — see our What Is AS9100? pillar guide

✅ Does your organization do more than one of the above? → You may need certification to more than one standard — confirm scope with your registrar before proceeding

✅ Have you mapped your actual process steps against the standard’s defined scope statement, not just its title? → Do this before scheduling any certification audit

FAQ

Is AS9110 harder to get certified to than AS9120?

Not inherently. Difficulty depends on how mature your existing quality processes are, not which standard you’re pursuing. AS9110 has more clauses focused on maintenance-specific documentation and release-to-service control, while AS9120 focuses heavily on purchasing and traceability controls. Neither is universally “easier.”

Can a distributor hold AS9100 instead of AS9120?

Technically a distributor could pursue AS9100, but it would include requirements around design and production control that don’t apply to a pure distribution operation. AS9120 is scoped specifically for distributors and avoids that mismatch — which is usually what customers and registrars expect to see.

Does AS9110 or AS9120 replace the need for ISO 9001 certification?

No. Both standards incorporate the full text of ISO 9001:2015 and add aerospace-specific requirements on top of it. You don’t need a separate ISO 9001 certificate in addition to AS9110 or AS9120 — the aerospace standard already contains it — but the underlying quality management principles are the same ones ISO 9001 establishes.

How do I verify a supplier’s AS9110 or AS9120 certification is real?

Check the IAQG’s OASIS database, which lists verified AS9100-family certifications, including AS9110 and AS9120, issued by accredited certification bodies.

What happens if my scope of work doesn’t match my certificate?

You risk failing a customer supplier audit, losing approved-source status with a prime contractor, or facing corrective action findings during your next registrar surveillance audit. If your operation has changed since your last certification cycle, confirm your certificate scope still matches before it becomes a customer’s finding instead of yours.

Is there a bundled cost savings if I need the text of both AS9110 and AS9120?

Is there a bundled cost savings if I need the text of both AS9110 and AS9120?
If you’re evaluating whether your operation needs both standards, buying multiple standards together through ANSI’s bundle packages saves meaningfully compared to purchasing each document separately.

Do AS9110 and AS9120 require the same registrar accreditation as AS9100?

Yes. Certification bodies auditing to any AS91XX standard must be accredited specifically for aerospace scope, not just general ISO 9001 accreditation. Verify your registrar’s aerospace accreditation through ANAB or your relevant national accreditation body before signing a contract.

Will the 2026 IAQG revision require re-certification?

Organizations already certified will go through a transition period once the revised standards (referred to in early IAQG materials as IA9100, IA9110, and IA9120) are formally published. No transition deadline has been confirmed yet — don’t plan around a specific date until IAQG publishes final transition guidance.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching which standard applies to your operation? Run the AS9100 Rev D Gap Assessment Checklist — it flags MRO- and distributor-specific gaps alongside base AS9100 clauses, so you’ll know where you actually stand before talking to a registrar.

🔹 Ready to start building your QMS documentation? 9001Simplified’s documentation kits give you a structured starting point you can adapt to AS9110 or AS9120’s added requirements — no consultant required.

🔹 Need to purchase the standard itself? AS9110 — ANSI Webstore or AS9120 — ANSI Webstore. Use code CC2026 for 5% off through December 31, 2026.

🔹 Shopping for training or picking a certification body? BSI’s aerospace training catalog covers AS9100-family courses relevant to both MRO and distribution operations.

Picking the wrong AS91XX standard doesn’t just slow down your certification timeline — it can cost you a supplier qualification you were counting on. The Standards Navigator covers the full AS9100 family so you can certify to the standard that actually matches what your operation does, not just what sounds closest.

Stay Ahead of Aerospace Compliance Changes

Most operations don’t lose a bid because they can’t meet a requirement — they lose it because they certified to the wrong standard for what they actually do. Organizations that map their real scope of work against AS9110 and AS9120 before choosing a path move through certification once. The ones that guess end up doing it twice.

The Standards Navigator tracks the AS9100 family closely, including the upcoming IAQG revision that will affect every organization certified to AS9110 or AS9120.

👉 Get updates on AS9100-family standards, including AS9110, AS9120, and the 2026 IAQG revision
👉 Be first to access new aerospace gap assessment tools and documentation resources as they’re released

Industrial Compliance. Clearly Explained.

NADCAP vs AS9100: Do You Need Both for Aerospace Certification in 2026?

This guide explains the difference between Nadcap accreditation and AS9100 certification, and why AS9100 is typically a prerequisite for Nadcap. It covers which special processes fall under Nadcap, how the two programs relate, common documentation gaps auditors flag, and includes a readiness checklist for suppliers transitioning from AS9100 certification into Nadcap accreditation.

Understanding the difference between quality system certification and special process accreditation

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Do I Need NADCAP If I’m Already AS9100 Certified?

Short answer: probably — but not for the reason most people assume.

NADCAP vs AS9100 isn’t really an either/or question — it’s two different types of approval that most aerospace suppliers eventually need together.

AS9100 certifies your quality management system. Nadcap accredits specific special processes — heat treating, welding, non-destructive testing, chemical processing, and others where a finished part can look perfect and still be defective in a way no inspection will catch. One certifies how your company runs. The other certifies whether a specific process, done in a specific way, actually works.

If your shop performs any of those processes — or you outsource them to a supplier who does — being AS9100 certified doesn’t automatically cover you. Primes like Boeing, Airbus, and Rolls-Royce increasingly require Nadcap accreditation as a separate, additional condition of doing business, regardless of your QMS certification status.

I watched this play out at a contract coating facility during a Nadcap audit. The production team proudly showed off a batch of aerospace brackets that had passed thickness and adhesion testing with no issues. The paperwork told a different story. The oven chart recorder showed the programmed temperature, but nothing documented that the part itself had reached cure spec before the timer started. The thermocouple used to qualify that oven had been swapped out months earlier during routine maintenance, and nobody had updated the work instruction to match. The finish looked fine. The documentation didn’t prove the process had actually happened the way it was supposed to — and that’s what closed the audit as a finding.

Split-screen infographic showing successful and failed aerospace audit documentation, illustrating how objective evidence supports NADCAP vs AS9100 compliance. — Proper documentation and objective evidence often determine the difference between a successful audit and a nonconformance during NADCAP vs AS9100 compliance.

AS9100 Rev D Gap Assessment Checklist: Before you add Nadcap to your roadmap, confirm your QMS foundation is solid. Run the 74-item, clause-by-clause gap check most operations managers wait too long to do →

Get the Free AS9100 Rev D Gap Assessment Checklist

In This Guide

What Nadcap actually accredits — and why it’s not a QMS certification
Why AS9100 is a prerequisite for most Nadcap accreditation paths
A side-by-side comparison of scope, governance, and audit structure
Which processes fall under Nadcap’s special process categories
What auditors actually flag when process verification records fall short
Real decision-stage guidance for suppliers at every point in the process
Where the standards and accreditation criteria come from — and how to buy or start

👉 Start Here (Top Resources)

Buying the AS9100 standard itself: SAE AS9100 — ANSI Webstore — the current official edition, direct from ANSI’s authorized store.
Building or tightening your QMS documentation before a Nadcap audit: 9001Simplified Documentation Kits — pre-built procedures and forms that hold up under both AS9100 and Nadcap’s quality-system scrutiny, without hiring a consultant.
AS9100 training for your internal audit team: BSI AS9100 Training Courses — useful if you’re staffing up internal audit capability before pursuing Nadcap.

What Nadcap Actually Accredits

Nadcap — no longer written in all caps, and no longer standing for “National Aerospace and Defense Contractors Accreditation Program” in PRI’s own branding — is an industry-managed accreditation program administered by the Performance Review Institute (PRI). It’s governed directly by the aerospace primes that require it: Boeing, Airbus, Rolls-Royce, Honeywell, and others sit on the task groups that write and revise the audit criteria. AS9100 itself, by contrast, is published and maintained by SAE International, the aerospace industry’s standards-development body.

Here’s the distinction that trips people up: Nadcap doesn’t accredit your company. It accredits a specific process, performed a specific way, at a specific facility. If you run heat treating and chemical processing, you’d pursue separate Nadcap accreditations for each — and you wouldn’t automatically hold accreditation for a process you don’t perform. That’s fundamentally different from AS9100, which certifies your entire quality management system as one integrated audit.

The processes covered are the ones that can’t be verified by looking at the finished part. A weld can look clean and still fail. A heat-treated part can meet dimensional spec and still have the wrong microstructure. This is the same principle behind AS9100 Clause 8.5.1(f) — controlled conditions for special processes — but Nadcap goes deeper, with process-specific technical criteria that a general QMS audit isn’t built to evaluate.

What Counts as a Nadcap “Special Process”?

Nadcap organizes accreditation into roughly 17 special process categories, each governed by its own Task Group. The ones most relevant to fabrication, machining, and coatings operations include:

Heat Treating — furnace pyrometry, controlled atmosphere, hardness verification
Welding — fusion welding, resistance welding, brazing
Non-Destructive Testing (NDT) — penetrant, radiographic, ultrasonic, magnetic particle
Chemical Processing — plating, anodizing, chemical conversion coatings
Coatings — thermal spray and other applied coatings on aerospace hardware
Materials Testing Laboratories — mechanical and chemical test labs
Composites — layup, curing, and bonding of composite structures
Non-Conventional Machining — EDM, chemical milling, laser processing
Elastomer Seals — molding and processing of seal components
Aerospace Quality Systems (AC7004) — the QMS alternative for suppliers without AS9100

If your facility touches any of these — or you flow work down to a subcontractor who does — that’s the process that needs its own Nadcap accreditation, separate from your AS9100 certificate.

Why AS9100 Is (Usually) a Prerequisite for Nadcap

Roadmap illustrating the typical aerospace supplier certification path from ISO 9001 and AS9100 to Nadcap accreditation for special processes. — This roadmap shows how manufacturers typically progress from a quality management system to Nadcap special process accreditation for aerospace customers.

PRI requires evidence of an acceptable quality management system before granting most Nadcap accreditations. For most aerospace suppliers, AS9100 certification is the route used to satisfy that expectation. In practice, that means one of two paths:

You already hold AS9100 certification from an accredited third-party registrar. PRI accepts this as satisfying the QMS prerequisite.
You don’t hold AS9100 yet. PRI will assess your QMS against AC7004 — a checklist-based alternative modeled on AS9003, audited directly by PRI rather than a separate registrar. If you go this route, expect an additional day added to your special process audit, at PRI’s day rate, which typically runs higher than standard registrar pricing.

Most suppliers who already have customers in aerospace choose the first path. If you’re already pursuing AS9100 certification for other reasons — customer requirement, competitive positioning — getting it in place before you start the Nadcap process avoids paying PRI’s premium AC7004 day rate for a QMS review you’ll need anyway.

Most common finding: Suppliers who assume their AS9100 certificate alone satisfies Nadcap’s documentation expectations for a specific process. It doesn’t. Nadcap auditors expect to see process-specific records — pyrometry surveys, weld procedure qualifications, NDT technique sheets — that go well beyond what a general AS9100 surveillance audit reviews.

Nadcap vs AS9100: Side-by-Side Comparison

Category	Nadcap	AS9100
What it certifies	A specific special process (heat treat, welding, NDT, etc.)	The organization’s entire quality management system
Governing body	Performance Review Institute (PRI), industry task groups	Third-party registrars accredited under the IAQG scheme
Scope of audit	Deep, technical, process-specific criteria	Broad, system-level clauses across the organization
Prerequisite	AS9100 (or PRI’s AC7004 equivalent) required first	ISO 9001 QMS foundation; no prerequisite certification
Who mandates it	Individual primes (Boeing, Airbus, Rolls-Royce, etc.) via contract flow-down	Increasingly required across the aerospace supply chain broadly
Reaccreditation cycle	Typically every 12–24 months, process-dependent	Typically annual surveillance, 3-year recertification
Applies to	Only the processes actually performed at that facility	The entire organization as a single certified entity

If you’re evaluating both standards side by side, buying them together through ANSI’s standards bundle is worth checking before purchasing individually — bundle pricing on standards documents tends to beat buying each one separately, and code CC2026 takes an additional 5% off through December 31, 2026.

Infographic comparing NADCAP vs AS9100 audit focus, showing system-level quality management requirements versus special process technical controls for aerospace manufacturers. — See how NADCAP vs AS9100 audits differ, with AS9100 evaluating quality management systems and Nadcap assessing technical controls for special processes.

Decision-Stage Guidance: Where Are You in This Process?

If you are AS9100 certified and just found out a customer requires Nadcap → don’t panic and don’t assume you need to redo your QMS. Identify which specific process the customer needs accredited, pull the relevant Task Group’s audit criteria from PRI’s eAuditNet-based platform, and run a gap assessment against that specific checklist.
If you are not yet AS9100 certified but know Nadcap is coming → get AS9100 certification moving first. Paying a registrar for AS9100 is almost always cheaper than paying PRI’s added day rate for an AC7004 QMS review layered onto your special process audit.
If you are already Nadcap accredited for one process and adding a second → don’t assume your existing accreditation covers related work. Each process category has its own Task Group, its own audit criteria, and its own accreditation — verify the specific checklist before you commit resources.

The Objection Nobody Says Out Loud: “We Can’t Afford Two Certifications”

This is the real hesitation behind most delayed Nadcap decisions, and it’s worth addressing directly. You’re not paying for two unrelated programs. AS9100 gives you the documented QMS foundation — document control, corrective action, internal audit processes — that Nadcap auditors expect to already be in place before they even start evaluating your process-specific records. Facilities that treat AS9100 as a genuine operating system, not a binder for the auditor, spend less time and money on Nadcap corrective actions later. The two costs aren’t additive in the way they feel like they should be — a strong AS9100 implementation reduces the Nadcap audit burden.

If cost timing is the real constraint, accredit one process first — typically whichever one your highest-value customer is asking for — rather than trying to fund every applicable process category in the same audit cycle.

Quick Readiness Checklist: AS9100-to-Nadcap Transition

✅ AS9100 certificate is current and in good standing with your registrar
✅ You’ve identified every special process performed on-site or flowed down to a subcontractor
✅ You’ve pulled the specific Task Group audit criteria for each applicable process
✅ Calibration and equipment qualification records (pyrometry, thermocouples, gauges) are current and traceable
✅ Internal audits cover process-specific technical requirements, not just system-level clauses
✅ Work instructions match the actual equipment and setup currently in use — not what was documented at initial qualification

FAQ

Is Nadcap a certification or an accreditation?

It’s an accreditation, and the distinction matters. Certification typically applies to a management system (like AS9100). Accreditation applies to a specific technical process performed a specific way — Nadcap accredits your heat treating process, not your company as a whole.

Do I need AS9100 before I can get Nadcap accredited?

In most cases, yes. PRI requires evidence of an acceptable QMS before granting most Nadcap accreditations, and AS9100 certification is the route most suppliers use to satisfy that expectation. Without it, PRI will assess your QMS against AC7004 as part of the Nadcap audit, typically adding cost and time.

What is AC7004, and can I use it instead of AS9100?

AC7004 is PRI’s own checklist-based QMS assessment, based on AS9003, used when a supplier doesn’t hold AS9100. It’s audited exclusively by PRI rather than a third-party registrar, and it’s generally more expensive per day than a standard AS9100 surveillance audit.

How long does Nadcap accreditation take?

Many first-time suppliers should expect six months or longer from preparation to accreditation, with timelines varying significantly based on process scope and audit readiness.

How much does Nadcap accreditation cost?

Cost varies significantly based on the number of process categories, facility complexity, and whether you already hold AS9100. PRI provides a formal quote after you request an audit through their platform — there’s no flat published rate, since scope drives cost more than anything else.

Do Boeing, Airbus, and other primes actually require Nadcap?

For special processes, yes — it’s typically a mandatory contractual flow-down requirement, not optional best practice. If you perform heat treating, welding, NDT, or chemical processing for a prime that mandates Nadcap, AS9100 alone won’t satisfy that specific contract requirement.

Is Nadcap accreditation the same across every special process?

No. Each process category — heat treating, welding, NDT, coatings, and the rest — has its own Task Group, its own audit criteria, and its own accreditation cycle. Being accredited for one process doesn’t extend to another, even a related one.

How often do I need to renew Nadcap accreditation?

Reaccreditation audits typically happen every 12 to 24 months, depending on the process category and your audit history. Processes with a stronger track record may move to a longer reaccreditation cycle over time.

📥 Free Resources

AS9100 Rev D Gap Assessment Checklist — a 74-item, clause-by-clause checklist for aerospace suppliers assessing their QMS before certification or a Nadcap-adjacent audit.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements.

Not Sure What to Do Next?

🔹 Still researching whether you need Nadcap at all? Start with What Is AS9100? to confirm your QMS foundation is understood before layering on process-specific accreditation questions.

🔹 Ready to start preparing for a Nadcap audit? Run the AS9100 Rev D Gap Assessment Checklist first — closing QMS gaps now saves you from PRI flagging system-level issues during a process-specific audit.

🔹 Need to buy the standard itself? Get the current edition of SAE AS9100 through ANSI Webstore, and check the ANSI standards bundle with code CC2026 if you’re purchasing multiple related standards at once.

Nadcap and AS9100 aren’t competing paths — they’re layered requirements, and treating them as separate line items instead of one connected system is where most suppliers lose time and money. The Standards Navigator covers both sides of aerospace compliance: the QMS foundation and the special process accreditation built on top of it.

Stop Guessing at What Your Customer Actually Requires

Suppliers who wait until a customer flow-down requirement lands in their inbox end up scrambling to figure out which Task Group criteria apply and whether their existing documentation even comes close. Suppliers who build Nadcap readiness into their AS9100 QMS from the start walk into that audit with process records already in the shape auditors expect to see.

The Standards Navigator tracks AS9100, Nadcap, and the aerospace supply chain requirements layered on top of both — so you’re not piecing this together from forum threads and PRI’s website.

👉 Get updates on AS9100 and Nadcap accreditation requirements as they develop
👉 Be first to access new aerospace compliance checklists and gap assessment tools

Industrial Compliance. Clearly Explained.

Two Audits, One QMS Standard — and a Decision Most Manufacturers Get Wrong

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Is ISO 13485, and What Is MDSAP Built on Top Of It?

Quick Answer

MDSAP vs ISO 13485: Side-by-Side

The 2026 Regulatory Shift: QMSR and the Revised MDSAP Audit Approach

Do You Need MDSAP? Decision-Stage Signals

What MDSAP Actually Costs You — And What It Saves

Documentation Issues That Can Create Problems in MDSAP Readiness

MDSAP Readiness Checklist

Frequently Asked Questions

Is MDSAP the same thing as ISO 13485?

Do I need to be ISO 13485 certified before I can apply for MDSAP?

Which countries does MDSAP cover?

Is MDSAP required to sell medical devices in the United States?

How did the FDA’s 2026 QMSR change affect MDSAP?

How much does an MDSAP audit cost compared to a standard ISO 13485 audit?

Can a small manufacturer participate in MDSAP?

Does an MDSAP certificate replace my ISO 13485 certificate?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of the Next Regulatory Shift

Subscribe

Your Internal Audit Program Is What Helps Keep Your AS9100 Certification Credible

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Clause 9.2 Actually Requires

The AS9100 Internal Audit Process: A Six-Part Workflow Built From Clause 9.2.2

1. Audit Program

2. Audit Criteria and Scope

3. Auditor Selection

4. Reporting Results

5. Corrective Action

6. Retained Documentation

What Should an AS9100 Internal Audit Checklist Include?

How Internal Audit Results Feed Into Management Review

Objection: “We Don’t Have Staff to Audit Objectively”

Quick Internal Audit Readiness Checklist

Frequently Asked Questions

What does Clause 9.2 of AS9100 actually require?

How often do AS9100 internal audits need to happen?

Can one person run the entire internal audit program on a small team?

Do internal audit findings have to be reported to the registrar?

What’s the difference between an internal audit and the AS9101 certification audit?

Can internal audits be conducted remotely?

What happens if our internal audit program has gaps when the registrar shows up?

Is a documented procedure enough, or do we need to prove the audits actually happened?

📥 Free Resources

Not Sure What to Do Next?

Before You Go

Subscribe

Choosing the Wrong Registrar Costs More Than the Audit

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Does AS9100 Accreditation Actually Mean?

How to Verify a Registrar Is Legitimately Accredited

What Separates a Good Aerospace Auditor From a Generalist

How These Certification Bodies Were Evaluated

AS9100 Certification Bodies Worth Comparing

Best Overall for Multi-Standard Aerospace Suppliers: BSI Group

Best for Aerospace-Focused Certification Experience: Perry Johnson Registrars (PJR)

Best for Manufacturers Entering Aerospace Supply Chains: NSF-ISR

Best for Global or Multi-Site Operations: DEKRA Certification

Best for Defense and Marine-Adjacent Aerospace: ABS Quality Evaluations

Best for Combined Aerospace and Industrial-Process Certification: DNV

Questions to Ask Before You Sign

Cost and Timeline: What to Expect

Common Mistakes When Selecting a Registrar

What to Do After You Select a Certification Body

FAQ

Can any ISO 9001 certification body also certify AS9100?

How do I verify a certification body is actually accredited for AS9100?

Is the cheapest registrar always the wrong choice?

Do I need a different registrar for AS9100, AS9110, and AS9120?

Can I switch certification bodies mid-cycle if I’m unhappy with my current one?

Does a certification body also provide consulting or documentation help?