Last updated: August 6, 2026
Key Takeaways
-
Aerospace and defense CNC suppliers operate under a layered framework that includes AS9100D, ITAR, DFARS, CMMC Level 2, NADCAP and AS9102.
-
AS9100D certification is facility specific and adds more than 100 aerospace requirements beyond ISO 9001, including risk management and traceability.
-
ITAR, DFARS and CMMC Level 2 impose strict data security, domestic sourcing and cybersecurity controls that buyers verify through documented evidence.
-
NADCAP accreditation covers special processes such as heat treatment and welding, while AS9102 First Article Inspection validates every production article.
-
Precision Advanced Manufacturing maintains AS9100D, ITAR and full compliance systems across U.S. facilities, supporting aerospace and defense qualification.
AS9100D vs ISO 9001 for Aerospace CNC Programs
ISO 9001:2015 establishes a general quality management baseline for many industries. AS9100D incorporates the full ISO 9001:2015 text and adds more than 100 sector-specific requirements. These additions cover formal operational risk management, full supply chain traceability, first article inspection per AS9102, counterfeit parts prevention, configuration management and product safety.
AS9100 Rev D requires stricter traceability than ISO 9001. Parts must be traceable to raw material source, manufacturing process records and inspection data across the entire supply chain. An ISO 9001 certificate alone does not satisfy aerospace program requirements.
Buyers verify that AS9100D certification is facility specific. Registrars issue certificates to a specific organization at a specific location after a successful on-site audit by an accredited third party. A supplier cannot hold or borrow AS9100D certification through a partner or subcontractor. This facility-specific requirement will carry forward into IA9100, the rebranded successor to AS9100 expected to publish in Q4 2026.
IA9100 introduces new Clause 7.1.7 on information security. This clause requires cybersecurity controls for CNC program storage, DNC server access and digital QMS data. Buyers qualifying suppliers now can confirm readiness for this transition by reviewing current information security controls.
Regulatory Gates for Defense CNC Work: ITAR, DFARS and CMMC
ITAR imposes stricter controls than CUI under CMMC. ITAR-controlled data must remain under U.S. jurisdiction on U.S. soil and be handled only by U.S. persons. Foreign nationals cannot access ITAR data without a Technical Assistance Agreement.
DFARS 252.204-7012, as updated by class deviations and a May 2026 regulatory change, requires adequate security for covered defense information using NIST SP 800-171 Rev 2 controls. Contractors and subcontractors must report cyber incidents promptly to the Department of Defense and flow requirements down to subcontractors.
Although 32 CFR Part 170 originally scheduled CMMC Phase 2 to begin November 10, 2026, the Department of Defense suspended those Phase 2 requirements on July 13, 2026. Machine shops become subject to CMMC Level 2 when they receive, store, process or transmit controlled unclassified information such as defense technical drawings, CAD/CAM files, specifications or inspection data.
DFARS 252.204-7021, as modified by class deviations including 2026-O0043, requires contractors to obtain the CMMC level specified in the contract prior to award. Contractors must maintain certification throughout the contract period and flow applicable CMMC requirements to subcontractors handling federal contract information or CUI.
For material sourcing, DFARS 252.225-7009 requires domestic or qualifying-country sourcing documentation via mill test reports only for specialty metals used in defense items. It does not mandate conflict-mineral declarations or general country-of-origin declarations for CNC machined parts.
NADCAP Special-Process Accreditation in CNC Supply Chains
NADCAP accreditation applies to special processes whose results cannot be fully verified by later inspection or testing. Common examples include heat treatment, welding, non-destructive testing, chemical processing and coatings when mandated by OEM drawings, purchase orders or flow-down requirements.
For aerospace CNC machining suppliers, NADCAP accreditation typically applies to downstream or adjacent special processes. These processes may occur in-house or at subcontractors and include heat treating, plating and coatings.
Prime aerospace subscribers such as Boeing treat NADCAP accreditation as a prerequisite for supplier qualification on critical processes. This expectation extends across the supply chain.
Buyers confirm that any special process performed on their parts, whether in-house or subcontracted, is covered by a current NADCAP certificate. The certificate must match the specific facility, equipment and process. NADCAP heat-treatment accreditation applies only to the facility, equipment and process scope listed on the certificate.
AS9102 First Article Inspection and Documentation Flow
First Article Inspection per AS9102 provides formal documented validation that the first production article from each distinct manufacturing process meets all drawing requirements. This requirement forms a core element of AS9100 quality management systems for aerospace suppliers.
AS9102 FAI applies to new parts and to any change affecting form, fit or function. Triggers include a new machine, new fixture, tooling change, program revision, material supplier change, operator certification lapse or a production gap longer than two years.
A complete FAI package includes:
-
A balloon-referenced dimensional report against the engineering drawing
-
Material certifications with chemistry and mechanical properties
-
Process certifications for all special processes
-
Functional test results where applicable
-
Review of the full production documentation package
GD&T Tolerances and Inspection for Mission-Critical Parts
Statistical process control in aerospace CNC manufacturing monitors process variation and supports compliance with tight tolerances on structural and mission-critical parts.
Key characteristics are features that could significantly affect safety, performance or fit if out of tolerance. AS9100 requires that these features be identified, documented and inspected under controlled procedures distinct from standard dimensional checks.
AS9100D Clause 8.5.1 requires a documented setup sheet for every CNC operation. The sheet includes part number and revision, operation number, machine ID, fixture identification, tool list with holder and insert details, program filename and revision, work offset values, raw stock dimensions and material specification, first article inspection points and special instructions.
Inspection records reference calibrated equipment and remain available for the life of the program. Traceability documentation in aerospace CNC machining follows program requirements so it can support regulatory notifications, fleet reviews and corrective actions.
Supplier Evaluation Checklist: Exact Requirements Buyers Should Demand
Buyers can use this checklist to verify supplier compliance across key regulatory and quality requirements.
-
AS9100D certification: Request a current certificate showing facility address, scope, registrar name and expiration date. Confirm that the certificate covers the location performing the work.
-
ISO 9001:2015 registration: Request the ISO certificate and verify alignment with AS9100D processes for aerospace work.
-
ITAR registration: Request the ITAR registration confirmation letter and procedures for U.S. person verification and data access control.
-
DFARS 252.204-7012 compliance: Request documented NIST SP 800-171 implementation, cyber incident response plan and subcontractor flow-down procedures.
-
CMMC Level 2 status: Request current self-assessment or C3PAO assessment status and procedures for handling and storing CUI.
-
Material traceability: Request a sample material certification package with mill test reports, heat or lot traceability and physical marking procedures.
-
AS9102 FAI capability: Request a sample FAI package from a recent production run, including dimensional report, material certs, process certifications and functional test results.
-
NADCAP accreditation: For any special processes, request current NADCAP certificates scoped to the specific facility, equipment and process.
Precision Advanced Manufacturing maintains documented systems aligned with these requirements.
How Precision Advanced Manufacturing Meets Buyer Requirements
Precision Advanced Manufacturing is a U.S.-based metal machining and fabrication provider with facilities in California and Texas. The company holds AS9100D and ISO 9001:2015 registrations and maintains ITAR registration. Quality systems support regulated, mission-critical programs in commercial aerospace, military and defense, space and satellites and UAV sectors.
Every production run includes complete documentation such as material certifications, machining records, in-process and final inspection data and process certifications for special processes. CNC programs follow version control and distribution from controlled sources. FAI packages follow AS9102 for every qualifying event, including design changes, tooling changes and production gaps.
Precision Advanced Manufacturing provides integrated capabilities that include multi-axis CNC machining, precision fabrication, specialty welding, secondary finishing and engineering support under a single quality system. This structure reduces supplier fragmentation and lowers the documentation burden on customer quality teams. The company scales from prototype through full-rate, multi-shift production without changing the quality controls validated during initial qualification.
Procurement teams, program managers and supplier quality engineers can engage directly to receive a tailored documentation package aligned to program flow-down requirements. Request a quote to begin the qualification process.
Frequently Asked Questions
What documentation must accompany every AS9102 FAI for CNC parts?
A complete AS9102 First Article Inspection package includes a balloon-referenced dimensional report that maps every drawing callout to a measured value. It also includes material certifications showing heat or lot number, chemical composition and mechanical properties that conform to the applicable AMS, ASTM or MIL specification. Process certifications cover every special process performed on the part, and functional test results appear where the drawing or purchase order requires them. The package also includes a review of the full production documentation set, including the setup sheet, CNC program revision and operator records. Any nonconformance identified during FAI is documented with a disposition decision before the part is released. Buyers can request a sample FAI package from a recent production run during supplier qualification to verify format and completeness before program award.
When does CMMC Level 2 certification become mandatory for defense CNC suppliers in 2026?
Under 32 CFR 170.3(e), Phase 1 of CMMC implementation ran from November 10, 2025, through November 9, 2026, and allowed Level 2 self-assessments on applicable contracts. Phase 2 begins November 10, 2026, and requires C3PAO certification for contracts involving CUI, as detailed in the regulatory requirements section above. Machine shops that receive, store, process or transmit CUI such as defense technical drawings, CAD or CAM files or inspection data fall under this requirement. Prime contractors already flow CMMC requirements down to subcontractors at every tier under DFARS 252.204-7021. Suppliers that have not begun a C3PAO assessment should treat November 10, 2026, as a hard program-access deadline.
Which special processes require NADCAP accreditation versus standard AS9100D controls?
NADCAP accreditation applies to special processes whose results cannot be fully verified by later inspection or testing. In aerospace CNC supply chains, this typically includes heat treatment, welding, non-destructive testing, chemical processing, coatings and surface treatments when mandated by OEM drawings, purchase orders or prime flow-down requirements. The machining operation itself generally follows AS9100D process controls, documented setup sheets, CNC program version control and in-process inspection rather than NADCAP. Buyers identify every special process on the engineering drawing and confirm that the performing facility, whether the prime CNC supplier or a subcontractor, holds a current NADCAP certificate scoped to that specific process, equipment and location. A NADCAP certificate at one facility does not cover work performed at another.
How do buyers confirm material traceability from mill to finished aerospace component?
Material traceability in aerospace CNC machining relies on a documented chain that links every finished part to its raw material heat or lot number. The chain includes the mill test report showing chemical composition and mechanical properties that conform to the applicable specification. It also includes any distributor certificates of conformity that preserve the chain back to the original mill. Machining records identify the machine, operator, program revision and tooling used. In-process and final inspection records include calibration references, and process certifications document any special processes applied. Physical marking through laser engraving, dot peen or chemical etching identifies the part number, revision level and serial or lot number at every production stage. Buyers can request a complete traceability package for a sample part during supplier qualification and confirm that the supplier record retention policy meets program requirements, which often extend to the life of the aircraft or a minimum of 10 to 20 years.
Conclusion: Partner With a Supplier That Already Meets Every Standard
Qualifying a CNC supplier for aerospace and defense programs requires documented evidence across every compliance dimension, including AS9100D, ITAR, DFARS, CMMC Level 2, NADCAP, AS9102 and full material traceability. Suppliers that support these requirements with documented systems reduce program risk, lower the inspection burden on customer quality teams and help prevent delays.
Precision Advanced Manufacturing operates under these systems from U.S.-based facilities, with certified quality processes, complete documentation and engineering expertise that supports programs from prototype through full-rate production. The qualification groundwork already exists.
Request a quote and connect with Precision Advanced Manufacturing aerospace and defense manufacturing specialists to begin program evaluation.
