Difference Between ITAR Compliance and AS9100 Certification

Last updated: July 27, 2026

Key Takeaways for Aerospace and Defense Teams

• ITAR is a mandatory U.S. federal export-control regulation that restricts access to defense articles and technical data, while AS9100 is a voluntary quality management standard focused on aerospace manufacturing processes.
• ITAR registration is required for any U.S. manufacturer of items on the U.S. Munitions List, with strict penalties for violations, while AS9100 certification is a three-year voluntary standard that automatically satisfies ISO 9001:2015 requirements.
• Commercial aerospace programs typically require AS9100 certification, while many military and defense programs require both ITAR registration and AS9100 certification depending on part classification and customer requirements.
• AS9100 certification does not satisfy ITAR obligations, and ITAR registration does not fulfill quality management requirements, because each framework addresses distinct compliance needs that cannot substitute for one another.
• Precision Advanced Manufacturing holds AS9100D, ISO 9001:2015 and ITAR registrations to support programs requiring one or both frameworks, and teams can discuss compliance requirements for a specific program.

ITAR Export Control Versus AS9100 Quality Management

ITAR is codified at 22 CFR Parts 120–130 and administered by the U.S. Department of State Directorate of Defense Trade Controls under the Arms Export Control Act. It exists to prevent defense articles and controlled technical data from reaching foreign adversaries or unauthorized end users. ITAR is federal law, not a best-practice framework, so its requirements are mandatory and carry enforcement consequences that voluntary standards do not.

The federal-law status of ITAR appears in several key characteristics.

• Registration with DDTC is mandatory for any U.S. manufacturer of items on the U.S. Munitions List, even for domestic-only production.
• Controls follow the item throughout its lifecycle, applying to every component, part and piece of technical data.
• Civil penalties reach $1,267,619 per violation, and criminal penalties reach $1,000,000 per violation plus up to 20 years imprisonment.
• Deemed exports, which are disclosures to foreign nationals inside the United States, are subject to the same controls as physical exports.

AS9100 Rev D is an internationally recognized quality management system standard developed by the International Aerospace Quality Group. It builds on ISO 9001:2015 and adds aerospace-specific requirements including product safety, configuration management, traceability, operational risk management, supplier oversight and counterfeit parts prevention.

AS9100 certification has its own defining characteristics.

• Voluntary standard focused on quality, reliability and supply chain consistency.
• Certificates are valid for three years with annual surveillance audits in years one and two and a full recertification audit in year three.
• Achieving AS9100D automatically satisfies ISO 9001:2015 requirements.
• Prime contractors including Boeing, Lockheed Martin and Raytheon routinely require AS9100 certification as a condition of supplier qualification.

Program Scenarios: When ITAR, AS9100 or Both Apply

AS9100 certification signals aerospace quality capability to buyers, while ITAR registration signals eligibility to handle controlled defense-related work. The two frameworks are distinct and not interchangeable. The appropriate path depends on part type, customer base and program risk.

Commercial aerospace programs such as civil aircraft structures, avionics subassemblies and propulsion components typically require AS9100 certification. ITAR registration may not apply unless the part or its technical data appears on the U.S. Munitions List.

Military and defense programs introduce ITAR obligations. ITAR applies to military aircraft, satellites, space systems and defense hardware, where part-level or data-level control determines supplier eligibility. Many of these programs also require AS9100 through direct contract language or prime contractor flowdown.

Space and satellite programs frequently require both frameworks. Structural components, precision mechanisms and associated technical data often appear on the U.S. Munitions List, while the quality expectations of prime integrators demand AS9100-level process discipline.

Defense contracts do not uniformly require AS9100. Lower-risk, non-flight items may require only ISO 9001. Legacy or sole-source programs may operate under older quality requirements. Even when AS9100 is not explicitly mandated, many primes assess supplier quality management systems against AS9100-style expectations for configuration control, traceability and internal audits.

One standard cannot substitute for the other. AS9100 certification does not satisfy ITAR obligations, and ITAR registration does not satisfy quality management requirements.

Precision Advanced Manufacturing holds AS9100D and ISO 9001:2015 registrations and is ITAR registered, supporting programs that require one or both frameworks. Connect with the compliance team to discuss requirements for a specific program.

Cost, Timeline and Sequencing for ITAR and AS9100

ITAR registration is a federal administrative process managed through DDTC. Registration can take several weeks depending on organization size and maturity. Ongoing compliance requires a Technology Control Plan, U.S. person screening, controlled data handling and designated empowered official responsibilities, which extend well beyond the initial registration.

Most aerospace manufacturers complete AS9100 certification in six to 12 months. Organizations with an existing ISO 9001 quality management system move faster because documentation and internal audit programs are already in place. Those organizations typically see reductions in both AS9100 implementation cost and timeline.

Sequencing matters for suppliers building both programs simultaneously. Starting with AS9100 creates a quality management foundation that accelerates ITAR implementation. A company with a mature AS9100 system can often establish a functional ITAR compliance program more quickly than a company starting from zero because AS9100 processes for document control, supplier management, internal audits and corrective action provide a base that ITAR-specific controls such as access restrictions, controlled data marking and foreign-visitor protocols can build on.

Documentation burden under both systems is substantial but overlapping. Aerospace and defense organizations can integrate AS9100 and ITAR obligations into a single management system by reusing common elements such as document control, internal audit, corrective action, management review and risk management. Maintaining separate programs for each framework increases administrative overhead without adding compliance value.

CMMC Cybersecurity Requirements in Defense Programs

ITAR and AS9100 are not the only compliance frameworks defense suppliers encounter. Defense suppliers handling Controlled Unclassified Information face a third compliance layer, the Cybersecurity Maturity Model Certification framework administered by the Department of Defense. CMMC governs the protection of Controlled Unclassified Information in contractor information systems and is distinct from both ITAR and AS9100.

The three frameworks address different risk domains. ITAR controls access to defense technical data and physical articles. AS9100 governs quality management processes. CMMC governs cybersecurity practices for information systems. For defense programs involving ITAR-controlled technical data stored or transmitted digitally, ITAR access controls and CMMC cybersecurity requirements apply simultaneously and must be addressed in parallel.

Suppliers building toward CMMC compliance benefit from existing AS9100 infrastructure. Configuration management, document control and risk management processes established under AS9100 support the documentation and process-control expectations of CMMC, though cybersecurity-specific controls still require dedicated implementation.

What ITAR and AS9100 Mean for Supplier Selection

Procurement teams qualifying suppliers for defense and aerospace programs carry the documentation burden of verifying both regulatory and quality compliance. A supplier operating under both ITAR registration and AS9100D certification reduces that burden by consolidating compliance evidence into a single source.

Aerospace procurement teams verify AS9100 certification, ITAR registration status and approved process documentation before reviewing quotes or equipment lists from potential suppliers. Suppliers not listed in the IAQG OASIS Certified Supplier Directory are typically not visible to aerospace buyers conducting qualification searches.

Traceability requirements under both frameworks demand material certifications, inspection records and chain-of-custody documentation from raw material through final delivery. AS9100D configuration management and ITAR recordkeeping obligations reinforce each other when managed within an integrated quality system.

Scaling from prototype to production without changing suppliers reduces requalification risk, documentation gaps and schedule exposure. Precision Advanced Manufacturing operates under AS9100D, ISO 9001:2015 and ITAR-compliant quality systems across prototype and full-rate production programs, with full traceability and documentation at every stage.

For programs transitioning from an existing supplier, Precision Advanced Manufacturing provides complete documentation, material traceability and engineering support to support continuity. Evaluate fit for a program through a dedicated review.

Decision Framework for Program Compliance Paths

The choice between ITAR registration, AS9100 certification or both depends on part classification, customer requirements and data handling. Sourcing teams can apply the following criteria to determine which compliance path a program requires.

• If the part or its technical data appears on the U.S. Munitions List, ITAR registration is mandatory for the supplier regardless of whether the part is exported.
• If the customer is a prime contractor for a major aerospace or defense program, AS9100 certification is likely required through contract flowdown or approved-supplier-list conditions.
• If the program involves both commercial and defense work at the same supplier, both ITAR registration and AS9100 certification are needed.
• If the program involves Controlled Unclassified Information in digital form, CMMC requirements apply in addition to ITAR and AS9100 obligations.
• If the part is commercial aerospace only with no U.S. Munitions List classification, AS9100 certification is the primary qualification requirement.

Precision Advanced Manufacturing holds the registrations and certifications that defense and aerospace programs require. Connect with the team to confirm compliance alignment for a specific program.

Frequently Asked Questions on ITAR and AS9100

Is ITAR compliance a certification?

ITAR compliance is not a certification. It is a mandatory federal regulatory obligation administered by the U.S. Department of State Directorate of Defense Trade Controls. Companies that manufacture items on the U.S. Munitions List must register with DDTC and maintain ongoing compliance through a Technology Control Plan, access controls, recordkeeping and designated empowered official responsibilities. There is no third-party certificate issued for ITAR compliance. Registration status can be verified through DDTC, but it does not carry the same auditable, certificate-based structure as AS9100.

Can AS9100 certification satisfy ITAR requirements?

As noted earlier, AS9100 and ITAR address entirely different obligations, quality management versus export control, so neither can substitute for the other. AS9100 governs how parts are designed, produced, inspected and documented. ITAR governs who can access defense articles and controlled technical data. A supplier can hold AS9100D certification and still be ineligible for defense work if it is not ITAR registered. Conversely, a supplier can be ITAR registered without AS9100 certification, though most prime contractors require both for flight-critical or defense-program work.

Which comes first, ITAR registration or AS9100 certification?

The sequencing depends on the supplier starting point and program requirements. For suppliers with an existing ISO 9001 quality management system, pursuing AS9100 certification first is often practical because the documentation and audit infrastructure already in place reduces the AS9100 implementation timeline. That same infrastructure then accelerates ITAR compliance buildout. For suppliers responding to an immediate defense program requirement, ITAR registration may need to proceed in parallel with AS9100 preparation. Both frameworks must be in place before a supplier can be fully qualified for most defense aerospace programs.

Do all defense contracts require AS9100 certification?

Not all defense contracts explicitly require AS9100 certification. Requirements depend on the customer, the program, the type of work and the risk level of the parts involved. However, even when AS9100 is not explicitly mandated, prime contractors and defense agencies frequently assess supplier quality management systems against AS9100-style expectations for configuration control, traceability and internal audits. Suppliers without AS9100 certification are also absent from the IAQG OASIS database, which is the primary registry aerospace buyers use to identify qualified suppliers.