Back to Home

    The Complete Guide to AS9100D Certification for Small CNC Shops (2026 Edition)

    A real-world playbook written mid-certification by a 5-employee aerospace CNC shop in Hanover, Pennsylvania. Covers cost, timeline, the 9 controlled documents, grant funding, registrar selection, and the traps that generate first-pass nonconformities.

    Last reviewed: May 12, 2026

    TL;DR — The Numbers That Matter

    • Total cost, 5-employee shop: $12,000–$18,000 gross, $9,000–$14,000 net after grants.
    • Timeline: 4–6 months from kickoff to certificate, assuming one dedicated Management Representative allocating 5–10 hours per week.
    • Documents required: 9 controlled process documents plus operator-level procedures.
    • Stage 1 vs Stage 2: Stage 1 is 1 day (readiness). Stage 2 is 2–3 days (operational). Both required.
    • Annual surveillance: $3,000–$5,000 per year after certification.
    • First-pass rate: Well over 80% of small shops that complete one full internal audit + management review before Stage 2 pass on the first attempt.

    Why AS9100D Exists (and Why Small Shops Need It)

    AS9100D is the aerospace industry's quality management standard, published by SAE International and IAQG. It contains every clause of ISO 9001:2015 plus roughly 100 aerospace-specific additions covering configuration management, counterfeit part prevention, product safety, human factors, and First Article Inspection to AS9102.

    For prime contractors like Boeing, Lockheed Martin, Northrop Grumman, and Raytheon, AS9100D certification is typically the minimum bar for direct-supplier consideration. Tier-1 suppliers to those primes flow the same requirement down to Tier-2 and Tier-3 machining shops. In practice, that means an ITAR-registered CNC shop that wants to hold direct or near-direct aerospace contracts almost always needs an AS9100D certificate on the wall.

    The strategic value beyond the direct contract is quote velocity: certified shops are frequently pre-approved on aerospace RFQ portals, which shortens the sales cycle from months to days. That single lever usually justifies the entire cost of certification within the first year.

    Cost Breakdown — What a 5-Employee Shop Actually Spends

    Line Item Low High Notes
    Registrar Stage 1 audit $2,500 $4,000 1 day, on-site or virtual
    Registrar Stage 2 audit $5,500 $8,000 2–3 days on-site
    Template document package $500 $2,000 Or consultant equivalent
    Internal auditor training (1 person) $500 $1,500 16-hour course, in-person or virtual
    Calibration / gage R&R work $1,000 $2,000 One-time catch-up if not already current
    Optional consultant support $0 $8,000 Skip if self-implementing
    Gross total (self-implement) $10,000 $17,500
    Less: state manufacturing grants -$3,000 -$5,000 WEDnetPA, DCED, SBDC, MEP
    Net cost, first year $7,000 $12,500

    The 9 Controlled Documents (What Each One Actually Contains)

    AS9100D doesn't literally name 9 documents — but the standard requires documented information for these processes. Every small shop's QMS should include:

    1. Quality Manual — scope, exclusions (typically design), process map, top-level policy.
    2. Control of Documented Information — how documents are approved, versioned, and retired; how records are kept.
    3. Design and Development — full procedure, or a written justification for excluding this clause (most contract machine shops exclude it).
    4. Purchasing and External Provider Controls — supplier approval, PO language for counterfeit parts (mandatory), receiving inspection.
    5. Production and Service Provision — job traveler, First Article Inspection to AS9102, configuration management, FOD control.
    6. Control of Nonconforming Outputs and Corrective Action — NCR process, root cause, effectiveness verification.
    7. Internal Audit Procedure — annual schedule, auditor competence, reporting.
    8. Management Review — required inputs (customer satisfaction, audit results, risks, opportunities), meeting cadence, outputs.
    9. Risk-Based Thinking and Product Safety — how risks and product safety issues are identified, assessed, and mitigated across the QMS.

    Grant Funding — Where the $3,000–$5,000 Actually Comes From

    Most first-time small shops leave grant money on the table because they don't know where to apply. In Pennsylvania, the practical stack is:

    • WEDnetPA — training grants covering the internal auditor course and staff awareness training. Typically $450 per employee.
    • PA DCED Manufacturing PA — Manufacturing PA Innovation Program and related grants can offset registrar and consultant fees.
    • PA SBDC + SSBCI — Small Business Development Center support plus State Small Business Credit Initiative capital for equipment and quality upgrades.
    • NIST MEP (MASCPA in PA) — Manufacturing Extension Partnership; cost-shared consulting and specific AS9100 readiness programs.
    • Catalyst Connection — regional MEP partner in western PA; check for aerospace-specific initiatives.

    The Six-Stage Certification Timeline

    1. Weeks 1–2: Scope and gap analysis. Produce a gap register (40–80 items typical) and a cost model.
    2. Weeks 3–10: Author the 9 controlled documents. Adapt templates — don't paste.
    3. Weeks 11–14: Implement and train. Run every process live for at least 30 days to build audit-worthy records.
    4. Weeks 15–17: First internal audit and management review. Both mandatory before Stage 2.
    5. Weeks 18–20: Stage 1 registrar audit (1 day). Fix findings.
    6. Weeks 22–26: Stage 2 registrar audit (2–3 days). Close any nonconformities within 60–90 days. Certificate issues.

    Registrar Selection — What Actually Matters

    Get at least three written quotes. Compare on:

    • Total quoted cost including travel. Some registrars quote low audit-day rates and recover margin on mileage and hotel.
    • Auditor experience in machining specifically. An auditor whose background is composites or avionics assemblies will over-audit a machining shop.
    • Surveillance cadence and duration. Annual is standard; some registrars offer 6-month cycles that are less efficient.
    • Willingness to conduct virtual Stage 1. Removes 1 day of travel cost with no compliance impact.

    Practical shortlist for small shops: NQA, DEKRA, NSF-ISR, Perry Johnson, TÜV SÜD America, BSI.

    The Three Traps That Cause First-Pass Failures

    1. No completed internal audit. The audit must be documented, closed, and dated before Stage 2. Auditors treat this as a hard gate.
    2. No completed management review. Same rule. The review must include the mandatory inputs (customer satisfaction, audit results, risks, opportunities) and produce documented outputs.
    3. Open corrective actions. If the shop has known NCRs with no root cause or effectiveness verification, the registrar will issue a major finding.

    Frequently Asked Questions

    How much does AS9100D certification cost for a small CNC shop?

    For a 5-employee CNC shop, AS9100D certification typically costs $12,000 to $18,000 gross before grants. That includes the registrar audit ($8,000–$12,000 split between Stage 1 and Stage 2), consultant or template support ($2,000–$4,000), internal audit training ($500–$1,500), and calibration or gage R&R work ($1,000–$2,000). State manufacturing grants (WEDnetPA, DCED, MEP centers, SBDC-linked SSBCI programs) often cover $3,000–$5,000, bringing net cost to $9,000–$14,000. Ongoing surveillance audits run $3,000–$5,000 per year.

    How long does AS9100D certification take?

    A realistic timeline for a small CNC shop with no existing quality manual is 4 to 6 months from kickoff to certificate issuance. That breaks down as roughly 6 to 8 weeks to build the 9 controlled documents (Quality Manual, Control of Documented Information, Design and Development, Purchasing, Production and Service Provision, Nonconformity and Corrective Action, Internal Audit, Management Review, Risk-Based Thinking), 2 to 4 weeks to run the first internal audit and management review, 4 to 6 weeks between Stage 1 and Stage 2 registrar audits, and 2 to 4 weeks after Stage 2 for the registrar to issue the certificate.

    What is the difference between ISO 9001 and AS9100D?

    AS9100D contains all of ISO 9001:2015 verbatim, plus roughly 100 aerospace-specific additions. The big adds are: configuration management, counterfeit part prevention (with mandatory PO language), product safety, human factors and awareness training, foreign object debris (FOD) controls, project management for AOG or high-priority work, First Article Inspection to AS9102, and stricter risk-based thinking tied to product safety. If a shop already runs an ISO 9001 QMS, the delta to AS9100D is typically 6 to 10 weeks of focused work, not a full rebuild.

    Do I need a consultant to get AS9100D certified?

    No — a small shop with one dedicated Management Representative can self-implement using template packages (typically $500–$2,000) plus a paid internal audit training course. Consultants become worth the money when the shop has zero existing quality system, when leadership can't allocate 5–10 hours per week for 4 months, or when the shop must be certified against a fixed customer deadline. A hybrid model — self-authored documents plus a pre-audit gap assessment from a consultant — is often the best value.

    What are the 9 controlled documents required for AS9100D?

    AS9100D does not literally name 9 documents, but the standard requires documented information for at least these processes: (1) Quality Manual defining scope and processes, (2) Control of Documented Information (document and record control), (3) Design and Development controls (or a justified exclusion), (4) Purchasing and supplier controls including counterfeit-part PO language, (5) Production and Service Provision including FAI and configuration management, (6) Control of Nonconforming Outputs and Corrective Action, (7) Internal Audit procedure, (8) Management Review procedure, and (9) Risk-Based Thinking and Product Safety. Most template packages bundle these plus operator procedures like calibration, training, and FOD control.

    Which AS9100D registrar should I choose?

    For small shops, the practical shortlist is NQA, DEKRA, NSF-ISR, Perry Johnson, TÜV SÜD America, and BSI. Compare on four factors: (1) total quoted cost including travel, (2) auditor experience in machining specifically — not just aerospace generally, (3) surveillance audit cadence and duration, and (4) willingness to conduct a virtual Stage 1. Get at least three written quotes. Expect Stage 1 + Stage 2 combined to run $8,000–$12,000 for a 5-employee shop, with annual surveillance at $3,000–$5,000.

    Can a small CNC shop realistically pass AS9100D on the first try?

    Yes. Most first-time small-shop audits result in 2–6 minor nonconformities and zero majors, which allows the registrar to recommend certification pending a corrective action plan (typically 60–90 days). The failures that produce majors are almost always the same three: no evidence of a completed internal audit, no completed management review, or no completed corrective action from a known nonconformity. If a shop has done at least one full internal audit cycle and one management review before Stage 2, first-pass certification is the norm — not the exception.

    Building your quality system?

    Olympus Machining is a small aerospace CNC shop in Hanover, PA, actively working through AS9100D certification. We don't consult — but we're happy to compare notes with shops on the same path.

    Get in Touch

    Related Reading