Q3 2026 closes with a regulatory and supply chain landscape that is more demanding than Q3 of any previous year in the decade I have been tracking these frameworks. Eight specific signals require action before October — not monitoring, not planning, but concrete action. This is the synthesis of the September 2026 series: eight signals, one consolidated review.
Signal 1: EU AI Act — Enforceable Since August 2, 2026
The prohibited AI practices and general-purpose AI provisions of the EU AI Act became enforceable August 2, 2026. Article 17 QMS requirements for high-risk AI providers are active. If any supplier in your aerospace or automotive supply chain uses AI in quality-critical processes — automated inspection, defect detection, predictive process control — those systems may qualify as high-risk under Annex III Category 8. The AI system inventory that should precede any compliance assessment has not been conducted by most aerospace organizations. Start with your own production environment before extending to the supply base.
Signal 2: EASA 2023/203 Cybersecurity — Extended Scope Since November 2025
The November 2025 amendment to EASA 2023/203 extended ISMS requirements to declaration organizations across the aviation value chain. Part 145 maintenance organizations, design organizations, and their suppliers are in scope. An ISMS documented in the Maintenance Organization Exposition or equivalent quality system documentation is the minimum requirement. If your MOE does not contain ISMS documentation, that is a finding waiting to be identified at your next competent authority surveillance audit.
Signal 3: IA9100 — Publishing This Quarter
ISO 9001:2026 is expected September-October 2026. IA9100 follows. The gap analysis window that precedes publication — where analysis against the Key Change Summary provides 90-95% accuracy — is closing. Organizations that complete their gap analysis before the final text publishes have a 3-6 month implementation advantage over those who wait. The six named areas are confirmed. The transition window is two to three years. Both of these facts have been stable since November 2023.
Signal 4: REACH 2026/0859 — Material Review Required
The Q2 2026 REACH amendment adding 2,4-Dinitrotoluol requires systematic review of approved material lists against the current SVHC candidate list and Authorization List. The review should be completed before Q4 production planning locks in material specifications for 2027. Any approved material containing a restricted substance on a timeline that conflicts with your 2027 production schedule needs an alternative qualification initiated now.
Signal 5: EU Battery Regulation — Nine Months to DBP Deadline
The Digital Battery Passport deadline of February 18, 2027 is nine months away. For battery-value-chain suppliers who have not started DBP implementation, nine months is the minimum viable implementation timeline — and only if systems work and data is available. If your battery suppliers have not confirmed their DBP implementation status, Q4 2026 is the last realistic window to identify and manage suppliers who will not be ready.
Signal 6: NATO Rearmament — Supply Base Quality Strain Visible
All 32 NATO members exceeded 2% GDP in 2025. Germany grew 24%. The demand surge is straining a supply base sized for a decade of flat defence budgets. Suppliers operating at 90%+ utilization across commercial and defence programs simultaneously are under quality system stress that standard scorecards will not capture. Q4 supplier reviews should specifically examine capacity utilization correlated with quality KPIs for any supplier serving both commercial aerospace and defence programs.
Signal 7: Geopolitical Supply Chain — Titanium and Rare Earth Constraints Ongoing
China’s October 2025 rare earth export control escalation continues to affect production timelines for avionics and aeroengine components. Titanium supply from qualified Western sources remains constrained. The risk in Q4 2026 is unauthorized material substitution at Tier-2 and Tier-3 level — suppliers making sourcing decisions quietly without the formal change notification that aerospace qualification requires. The approved material list audit question is more important this quarter than at any point in the past three years.
Signal 8: Open Corrective Actions — The Q3 Backlog
Q3 is historically when corrective action backlogs build. The urgency from H1 quality escapes fades, SCARs from May and June have been open for 90+ days, and effectiveness verification data is absent for corrections that were closed on paper. Pull your SCAR age report before October. Any corrective action open more than 60 days without effectiveness data is an undocumented recurring risk — and a finding that an IA9100 transition audit will identify when it examines your corrective action effectiveness process.
3 Concrete Actions for October
1. Complete three specific reviews in October: your IA9100 gap analysis (use the IAQG Key Change Summary), your battery supplier DBP readiness status (confirm implementation timeline for each battery-containing product supplier), and your REACH approved material list review (cross-reference against the current ECHA SVHC candidate list and Authorization List). These three reviews address the three most time-constrained regulatory signals in the list above.
2. Add an AI system inventory questionnaire to your Q4 supplier audit agenda for any supplier using automated systems in quality-critical processes. The questionnaire should cover: what automated or AI-assisted systems are used in inspection, defect detection, or process control for customer parts; whether those systems have been assessed for EU AI Act Annex III high-risk classification; and what QMS documentation exists for those systems. The answers will tell you which suppliers require follow-up under Article 17 requirements.
3. Update your SQA template in Q4 to include the four regulatory clauses described in the September 17 post: cybersecurity (EASA 2023/203 + IA9100), AI Act (Article 17 QMS documentation), battery regulation (carbon footprint + DBP), and REACH (SVHC notification). Apply the updated template to new supplier agreements and to renewals of existing agreements with critical suppliers. The window to complete this before IA9100 publishes is Q4 2026.
👉 Request a Technical Consultation → www.skqc.org
Sources
- IAQG — IA9100 Key Change Summary (November 2023), iaqg.org
- European Commission — Implementing Regulation (EU) 2023/203 Part IS CA, as amended November 2025, eur-lex.europa.eu
- European Parliament and Council — Regulation (EU) 2024/1689 (EU AI Act), Article 17 and Annex III, eur-lex.europa.eu
- ECHA — REACH SVHC Candidate List and Authorization List, echa.europa.eu
- REACH Regulation (EU) 2026/0859 — Q2 2026 Amendment, eur-lex.europa.eu
- European Parliament and Council — Regulation (EU) 2023/1542, Article 72 and DBP timeline, eur-lex.europa.eu
- SIPRI — Trends in World Military Expenditure 2025 (April 27, 2026), sipri.org
- NATO — Secretary General Rutte Annual Report (March 26, 2026), nato.int
- CSIS — Rare Earth Export Restrictions One Year Later (May 2026), csis.org
- Quality Magazine — Aerospace Auditing and Quality Workforce Challenges (May 2025), qualitymag.com
#Q3Review #RegulatoryCompliance #QualityManagement #AerospaceQuality #IA9100 #EUAIAct #EASA #REACH #SupplyChain #SKQC