Quality & Certifications Guide

What it is: the international standard for Quality Management Systems (QMS). Requires documented procedures, management commitment to quality, continuous improvement, and third-party audit. The baseline certification for any serious manufacturer.

What it means in practice: the manufacturer has documented processes, trains employees to follow them, audits their own systems, and has been assessed by an accredited certification body (registrar).

What it does NOT mean: ISO 9001 does not define specific product quality requirements, does not mean parts will be perfect, and does not guarantee your specific requirements are met. It means the supplier has a system to consistently produce what their procedures specify.

When to require it: for any significant commercial, industrial, or consumer product purchase from a supplier. The floor for supplier qualification in most industries.

What it is: the aerospace and defense quality management standard. Built on ISO 9001 with significant additional requirements specific to aviation, space, and defense: configuration management, risk management, first article inspection, control of nonconforming product.

The OASIS database: all AS9100 certified organizations are listed in the OASIS database (oasis.sae-international.org). Always verify AS9100 certification in OASIS, not just from a certificate the supplier provides. Certificates can be forged; the OASIS database cannot be falsified.

When to require it: any aerospace or defense application. Often flows down from prime contractors to their supply chain as a contractual requirement.

What it is: the quality management standard for medical device manufacturers and their supply chain. Stricter than ISO 9001 with additional requirements for design controls, sterility, traceability, post-market surveillance, and complaint handling.

Traceability requirements: medical device manufacturers must be able to trace every component in a finished device to its material lot, manufacturing batch, and test results. Implantable device traceability requirements are even more stringent — lot traceability for 10+ years.

When to require it: any supplier to a medical device manufacturer, especially for components that contact the patient or are incorporated into a regulated device.

What ITAR is: International Traffic in Arms Regulations — US regulations governing the export and import of defense-related articles and services on the US Munitions List (USML). Administered by the State Department.

The foreign national issue: ITAR's "deemed export" rule means that sharing technical data with a foreign national in the US (even an employee) may constitute an export requiring a license. This affects manufacturers with international workforces significantly.

Supplier verification: verify ITAR registration at the DDTC website. Registration expiration dates must be current. Note: Registration does not equal compliance, it just means they are in the system.

What an MTR is: a certified document provided by the material supplier confirming the chemical composition and mechanical properties of a specific heat or lot of material, traceable to the specific certification standard (AMS, ASTM, etc.).

What an MTR must include: material specification and grade, heat or lot number (traceability identifier), chemical composition test results, mechanical property test results, certification statement, manufacturer name.

When to require MTRs: always for aerospace, medical, structural applications (pressure vessels, load-bearing structures), government contracts, and any application where material substitution would be dangerous. Counterfeit materials are a real risk in global supply chains.