AS9100 Supplier Management: The Complete 2026 Clause 8.4 Guide

AS9100 supplier management is where aerospace quality systems most often break, because so much of the finished product is made, processed or tested outside your walls. AS9100 Rev D clause 8.4 takes ISO 9001’s requirements for “externally provided processes, products and services” and adds a register, risk-based controls, performance monitoring that includes on-time delivery, and a long list of requirements that must be flowed down through the supply chain.

This guide to AS9100 supplier management walks through what clause 8.4 requires, how to structure a supplier management process that auditors accept, and the flow-down clauses most purchase orders miss. It reflects AS9100D, which remains the certifiable revision as of October 2026.

What Counts as an External Provider

AS9100D uses “external provider” rather than “supplier,” and the scope is broad. It covers anyone providing a process, product or service that affects what you deliver: raw material mills, distributors, subcontract machinists, heat treaters, platers, NDT laboratories, calibration labs, design consultants and even sister sites in your own group. Customer-directed sources are still your external providers; the customer’s designation does not remove your responsibility to control them.

A common audit finding is an approved supplier list that covers material vendors but omits calibration services or outsourced inspection. If their output affects conformity, they belong in the process.

The Core AS9100 Supplier Management Requirements in Clause 8.4.1

Clause 8.4.1 requires a documented process for controlling external providers, one of only a few explicitly documented processes in AS9100D. The aerospace additions require you to:

• Define responsibility and authority for approval status decisions, changes to approval status, and the conditions for controlled use of providers depending on that status
• Maintain a register of external providers that includes approval status (for example approved, conditional or disapproved) and the scope of approval (for example product type or process family)
• Periodically review provider performance, including process, product and service conformity and on-time delivery performance
• Define actions to take when providers do not meet requirements
• Define requirements for controlling documented information created by or retained by external providers
• Ensure customer-designated or approved sources are used when the customer requires it

You must also identify and manage risks associated with external providers. That ties supplier management directly to your operational risk management under clause 8.1.1.

Building the External Provider Register

The register is the single document auditors ask for most often in supplier management. A good one answers these questions at a glance:

Field	Why it matters
Provider name and site address	Approval applies to a site, not a company group
Approval status	Approved, conditional, probation or disapproved, with dates
Scope of approval	What they are approved to supply, such as specific processes or material types
Basis of approval	AS9100 certificate, Nadcap accreditation, audit, first article, customer designation
Certification status and expiry	Checked in the IAQG OASIS database where applicable
Risk rating	Drives audit frequency and incoming inspection level
Performance metrics	Quality and on-time delivery for the review period
Next review date and owner	Evidence of periodic review

Scope of approval is the field most often missing. If you approved a shop for machining and later sent them a part needing anodizing, the register should show that the approval does not cover it.

Supplier Selection and Evaluation

AS9100D does not prescribe a selection method, but it expects criteria based on the provider’s ability to meet your requirements. Typical evidence, in increasing order of assurance:

1. Questionnaire and capability review
2. Third-party certification (AS9100, AS9110, AS9120 or ISO 9001), verified in OASIS
3. Special process accreditation such as Nadcap, where applicable. See our Nadcap vs AS9100 comparison
4. Successful first article inspection of a representative part
5. On-site audit by your quality team

Match the depth of evaluation to risk. A distributor of standard hardware with an AS9120 certificate may need nothing more than certificate verification and incoming inspection. A sole-source supplier of a flight-critical casting probably needs an audit.

Monitoring Performance, Including On-Time Delivery

The explicit mention of on-time delivery is one of the clearest aerospace additions. Your review must cover conformity and delivery, and you should be able to show the data. Most organizations calculate a scorecard monthly or quarterly using:

• Quality: rejected quantity or lots, escapes found at customer, corrective action responsiveness
• Delivery: percentage of lines delivered on or before the agreed date
• Responsiveness: quote turnaround, communication, documentation accuracy

Define thresholds that trigger action, such as a corrective action request, increased inspection, conditional status or removal. Our AS9100 on-time delivery guide covers how to measure delivery consistently, both for your own performance and for suppliers.

Verification of Purchased Products (Clause 8.4.2)

The level of control you apply depends on risk and the provider’s performance. AS9100D adds specific expectations:

• Verification activities can include reviewing objective evidence, inspection on receipt, source inspection and delegation of verification to the provider.
• Where you rely on provider test reports to accept product, such as material certificates, you need a process to evaluate that data, and for raw material, periodic validation of test reports is expected based on risk.
• Where you delegate verification to the provider, define the scope and requirements and keep a register of delegations.

The AS9100 Supplier Management Flow-Down Checklist (Clause 8.4.3)

Clause 8.4.3 lists the information you must communicate to external providers, typically through purchase orders and quality clauses. The aerospace version adds several items to ISO 9001’s list. Use this as a checklist when reviewing your standard purchase order terms:

• Identification of relevant technical data: specifications, drawings, process requirements, work instructions, including revision
• Requirements for approval of products, methods, processes, equipment and release
• Required competence and qualification of persons
• Requirements for design, test, inspection and verification, including production process verification such as first article inspection
• Use of statistical techniques for product acceptance, where applicable
• Critical items, including key characteristics
• Requirements for test specimens
• Requirements for the provider’s quality management system
• Requirements to use customer-designated or approved external providers, including special process sources
• Requirement to notify you of nonconforming outputs and obtain approval for their disposition
• Requirement to prevent the use of counterfeit parts
• Requirement to notify you of changes to processes, products, services, providers or manufacturing location, and to obtain approval
• Requirement to flow down applicable requirements to their own external providers
• Right of access for you, your customer and regulatory authorities to facilities and records throughout the supply chain
• Records retention requirements
• Ensuring their people are aware of their contribution to conformity, product safety and the importance of ethical behavior

Check the exact wording against the standard, which is available as AS9100D from SAE, and add any customer-specific clauses your primes require.

Common AS9100 Supplier Management Audit Findings

• Register missing scope of approval or approval basis
• No evidence of periodic performance review, or reviews without on-time delivery data
• Expired supplier certificates not noticed
• Purchase orders that omit counterfeit prevention, change notification or right of access
• Material certificates accepted without any validation process
• Calibration and inspection service providers left out of the process

The AS 9100 Toolkit includes a supplier control procedure, an external provider register and a consolidated registers workbook aligned to AS9100D. For the wider context of the AS9100 family, see our guide to aerospace quality management, and for related controls read our counterfeit parts prevention guide.

Linking AS9100 Supplier Management to Risk

AS9100D expects controls proportionate to risk, and the strongest AS9100 supplier management processes make that link explicit. Rate each provider on factors such as product criticality, special processes, sole-source status, past performance and counterfeit exposure, then let the rating drive the control level:

Risk rating	Typical controls
Low	Certificate check in OASIS, standard incoming inspection, annual scorecard review
Medium	Capability review, first article on new parts, quarterly scorecard
High	On-site audit, source inspection or enhanced receiving inspection, monthly scorecard, defined escalation path

Document the rating method in your procedure so auditors can see why two suppliers receive different treatment. Consistent, risk-based AS9100 supplier management is far easier to defend than a one-size-fits-all approach.

AS9100 Supplier Management for Small Organizations

A small shop with twenty active suppliers does not need a supplier portal. A spreadsheet register, a one-page evaluation form, a quarterly scorecard tab and a standard set of purchase order quality clauses will satisfy AS9100D if they are kept current. The effort should go into keeping data accurate and acting on poor performance, not into tools.

Frequently Asked Questions

Do AS9100 suppliers have to be AS9100 certified?

No. AS9100D does not require external providers to hold any certification. You choose the controls based on risk. Many primes, however, require AS9100 or AS9120 certification of their suppliers by contract.

How often should suppliers be re-evaluated?

The standard says periodically and leaves frequency to you. Annual reviews are common, with more frequent reviews for high-risk or poorly performing providers.

Is an approved supplier list mandatory under AS9100?

Yes, in effect. Clause 8.4.1 requires a register of external providers with approval status and scope of approval.

What is the first step in AS9100 supplier management?

List every external provider whose output affects conformity, including service providers such as calibration and testing labs, then record approval status and scope for each in a register.