Autor: admin

Two of the year’s big aviation shows fall into the next two weeks. For quality managers, they are a rare chance to talk to many suppliers and maintenance providers in person, in a few days, without a travel budget for each visit.

The dates

NBAA-BACE 2026: 20–22 October in Las Vegas, with the exhibition at the Las Vegas Convention Center West Hall and the aircraft static display at Henderson Executive Airport. According to AIN, the program includes more than 70 educational sessions and a Maintenance Track that offers Inspection Authorization renewal credit.

MRO Europe 2026: RAI Amsterdam. The conference runs 27–28 October, the exhibition 28–29 October, according to Aviation Week.

Five questions worth bringing

From my own experience, a booth conversation is not a supplier audit. But the right questions tell you quickly whom you should audit next:

1. „Where are you with IA9100?“ The IAQG’s key change summary adds information security, stronger sub-tier control and counterfeit prevention as requirements. A supplier who has not looked at it yet is a supplier to watch.

2. „Which special processes do you buy in?“ Plating, heat treatment, NDT. The answer tells you how deep your sub-tier risk goes.

3. „How do you watch obsolescence?“ A required element under IA9100 8.1.4 — and a good indicator of counterfeit-part discipline.

4. For EASA Part-145 organisations: „How far are you with Part-IS?“ It applies to Part-145 maintenance organisations since 22 February 2026, with 18 months to reach full maturity.

5. „How has your team changed in the last year?“ Turnover in quality and inspection roles moves before ppm does.

One rule

Do not qualify a supplier at a booth. Use the show to decide where your next on-site audit goes.

Sources

• AIN — NBAA-BACE taking shape: expanded program, most OEMs (3 September 2026), ainonline.com
• Aviatize — NBAA-BACE 2026, aviatize.com
• Aviation Week — MRO Europe future dates, mroeurope.aviationweek.com
• IAQG — IA9100 Key Change Summary, clause view (November 2023), iaqg.org
• Jones Day — Civil Aviation Cybersecurity: EASA Part-IS (February 2026), jonesday.com

„Which course should I take to get into quality?“ I get this question from both sides of the Atlantic. The honest answer: it depends on where you want to work. Germany and the United States build quality careers on two different logics. One is course-based. The other is experience-and-exam-based.

Germany: course first, certificate at the end

The DGQ (Deutsche Gesellschaft für Qualität) path is the classic entry point. The DGQ Qualitätsbeauftragter course, for example as offered by Eckert Schulen, covers 90 teaching units plus exam preparation — either two blocks of five days full-time or twelve Saturdays part-time. The part-time price listed in their datasheet (11 October 2024) is EUR 1,983.51, exam fee and materials included. The datasheet lists no work-experience requirement. Completing the course and the exam is what counts.

International: CQI/IRCA auditor courses

For auditing, CQI/IRCA certified ISO 9001 Auditor/Lead Auditor courses are recognised in both markets. SGS describes the format as five days or 40 hours, ending with an exam plus continuous assessment. The resulting certificate of achievement is valid for five years and is the basis for CQI/IRCA auditor certification.

USA: experience is the entry ticket

ASQ certifications are exam-based, and most require documented work experience:

• CQIA (Certified Quality Improvement Associate): 2 years of work experience or an associate degree. 110 questions. USD 434, members USD 334.
• CSSGB (Six Sigma Green Belt): 3 years of experience in the body of knowledge. 110 questions. USD 483, members USD 383.
• CQA (Quality Auditor): 8 years of experience, 3 of them in a decision-making position. 165 questions, 5 hours 18 minutes. USD 550, members USD 450.
• CQE (Quality Engineer): 8 years, 3 in a decision-making position; a bachelor’s degree waives four years. 175 questions. USD 550.

My reading

From my own experience hiring and working with quality staff in both countries: a German course certificate opens doors in DACH, but a US hiring manager will usually ask „which ASQ certification?“ first. Someone moving from Germany to the US is well served by combining both — the German qualification for depth, and an ASQ certificate as a recognisable signal.

Three practical tips

1. Starting out: CQIA (US; two years of experience or an associate degree) or DGQ QB (DACH).
2. Moving into auditing: a CQI/IRCA lead auditor course travels well between markets.
3. Planning the US move: check the ASQ experience requirement early. The clock counts your European years too.

Sources

• ASQ — Certified Quality Improvement Associate (CQIA), asq.org
• ASQ — Certified Six Sigma Green Belt (CSSGB), asq.org
• ASQ — Certified Quality Auditor (CQA), asq.org
• ASQ — Certified Quality Engineer (CQE), asq.org
• Eckert Schulen — DGQ Qualitätsbeauftragter, datasheet (11 October 2024), eckert-schulen.de
• SGS — ISO 9001:2015 QMS Auditor/Lead Auditor Training Course (CQI and IRCA Certified), sgs.com

Authority audits rarely start in the workshop. They start at a table with a stack of records. From my own experience accompanying audits on both sides of the Atlantic, the first two hours decide the tone of the whole visit. Inspectors open the documents that prove the system works on paper — then they walk out to check whether reality matches.

Here are the records that come up first, with the regulation behind each one.

1. Organisation chart and rosters

14 CFR 145.209(a) requires an organisational chart identifying each management position with authority to act on behalf of the repair station, its area of responsibility and its duties. 145.209(b) requires procedures for maintaining and revising the rosters required by 145.161. Under EASA Part-145, the nominated persons and their acceptance by the competent authority play the same role. Typical gap: the chart shows a name that left months ago.

2. Training records

145.163(c) requires individual training records „in a format acceptable to the FAA,“ retained for a minimum of two years. EASA requires human factors continuation training in each two-year period (AMC2 145.A.30(e)). Typical gap: training happened, but the record does not show the content, the date or the trainer.

3. Capability list and scope

145.209(d) requires procedures for revising the capability list and notifying the Flight Standards office. Inspectors compare the list with the jobs in progress on the floor. Typical gap: work performed that is not on the list, or a list that promises more than the tooling supports.

4. Reporting evidence

FAA: 145.221(a) — report serious failures, malfunctions or defects within 96 hours. EASA: occurrences within 72 hours (Regulation (EU) No 376/2014, 145.A.60). Inspectors look for the procedure and for evidence that it has been used. An empty log after a year of operation raises questions rather than confidence.

5. Management system evidence (EASA)

Since 2 December 2024, Part-145 organisations must operate a management system under 145.A.200 covering safety policy, occurrence reporting, safety promotion and safety risk management, with internal safety reporting under 145.A.202. Inspectors ask for the hazard register and how a reported hazard turned into an action.

6. Manual revision status

145.209(j) requires procedures for revising the manual and notifying the responsible Flight Standards office. EASA expects the MOE revision to be approved or managed under the agreed procedure. Typical gap: the floor works to a different revision than the one in the quality office.

A practical preparation sequence

1. Two weeks before: pull the six record sets above and check one sample per set against the floor.
2. One week before: close what can be closed. Document what cannot, with a date and an owner.
3. Day before: one person knows where every record is. Not three.

Sources

• U.S. Government — 14 CFR 145.163, 145.209, 145.221 (current), law.cornell.edu
• Transport Malta — IAN 26 Part-145, Regulation (EU) 2021/1963 (Issue 2, 2023), transport.gov.mt
• Transport Malta — IAN 01 Occurrence Reporting (Issue 7), transport.gov.mt
• Transportstyrelsen — Part-145 Human Factors training guidance, transportstyrelsen.se

On Tuesday, 29 September 2026, the first Airbus A350F (MSN700, registration F-WXLD) took off from Toulouse at 10:31 local time. On board: two pilots and three flight test engineers. Airbus describes the next step as a 10-month, 400 flight-hour test campaign. Air Cargo News reports that Airbus targets certification by EASA and the FAA around the middle of 2027.

The facts

Airbus states a payload capability of 111 tonnes and up to 40% lower fuel burn than the current in-service competition. According to Air Cargo News, 115 A350 freighters have been ordered by at least 14 customers, and a second test aircraft (MSN701) is in final assembly and expected to fly later in 2026.

Why a quality manager should care

A first flight is the visible moment. The quality work behind it is invisible and much longer. Every part on a flight test aircraft has to match its type design data, and every deviation found during the campaign flows back into production drawings, supplier specifications and first article inspections.

From my own audit experience, the weeks after a programme milestone are when supplier change control gets tested hardest. Engineering changes move fast. Purchase orders, drawings and inspection plans at sub-tier level follow slowly — sometimes not at all.

Where it shows up for suppliers

Three areas deserve attention in any new or changing programme:

First article inspection. AS9102 Revision C (June 2023) requires the reason for a full or partial FAI to be stated on every FAI, and the person approving the FAIR should not be the same person who performed it. Any design change that affects form, fit or function triggers a new or partial FAI.

Configuration at sub-tier level. The IAQG’s IA9100 Key Change Summary (November 2023) restructures clause 8.4 to strengthen „direct and sub-tier control.“ Programmes in test phases are where that control is stressed.

Dual authority certification. When EASA and the FAA certify in parallel, documentation has to satisfy two sets of reviewers. Inconsistent records between the two packages are a common source of findings.

Three actions for suppliers on new programmes

1. Check that every open engineering change has a matching FAI decision (full, partial, or not required — with reason).
2. Ask your sub-tier suppliers for their current drawing revision on one part. Compare. Do it this week.
3. Keep a single change log that both your EASA and FAA customers‘ requirements can be traced to.

Sources

• Airbus — A350F first flight live and freighter journey (29 September 2026), airbus.com
• Air Cargo News — First Airbus A350F takes off (29 September 2026), aircargonews.net
• Aviation A2Z — Airbus A350F operates its first test flight (29 September 2026), aviationa2z.com
• Discus Software — AS9102 Rev C: What you need to know (2023), discussoftware.com
• General Dynamics Land Systems — AS9102C Numbered Explanation (December 2025), gdls.com
• IAQG — IA9100 Key Change Summary, clause view (November 2023), iaqg.org

Same number. Two very different rulebooks. When a European maintenance organisation opens a site in the United States, the most common assumption I hear is that an EASA Part-145 approval and an FAA Part 145 certificate are roughly the same thing with different letterheads. They are not. Below are seven differences that decide how you staff, document and run a US repair station. Every point is tied to the regulation text.

1. Who may sign the release

Under 14 CFR 145.157(a), a repair station located inside the United States must ensure that each person authorized to approve an article for return to service is „appropriately certificated as a mechanic or repairman under part 65.“ The alternative of training or 18 months of practical experience in 145.157(b) applies only to repair stations located outside the United States. Under EASA Part-145, certifying staff are qualified through the Part-66 licence system and the organisation’s own authorisation (145.A.30 and 145.A.35). A Part-66 licence does not replace a Part 65 certificate at a domestic US station.

2. One manual or two

EASA expects a Maintenance Organisation Exposition (MOE). The FAA expects a Repair Station Manual whose minimum content is listed in 14 CFR 145.209 — from the organisational chart and rosters to the capability list, the training program revision procedure, work at another location and contract maintenance — plus a quality control manual under 145.211. Translating an MOE does not produce a compliant RSM. The structure is different, and FAA inspectors read against 145.209 line by line.

3. Management system and safety risk management

Commission Implementing Regulation (EU) 2021/1963 added a management system to Part-145 (145.A.200), including safety policy, occurrence reporting, safety promotion and safety risk management, plus internal safety reporting with just-culture principles (145.A.202). Existing organisations had until 2 December 2024 to comply. On the FAA side, the Safety Management System final rule of April 2024 extended 14 CFR Part 5 to Part 135 operators, §91.147 air tour operators and certain Part 21 holders. Part 145 repair stations were not included. The FAA stated it „decided not to expand the applicability of this rule beyond the original proposal.“

4. Reporting deadlines

EASA: occurrences are reported within 72 hours of the organisation becoming aware of them, unless exceptional circumstances prevent this (Regulation (EU) No 376/2014 and 145.A.60, as applied by national authorities). FAA: 14 CFR 145.221(a) requires a report „within 96 hours after it discovers any serious failure, malfunction, or defect of an article.“ Two clocks, two triggers, two report formats. A dual-approved organisation needs one internal procedure that meets the stricter timeline.

5. Training program approval

14 CFR 145.163 requires an employee training program „approved by the FAA“ with initial and recurrent training. Individual training records must be kept for at least two years, and program revisions go to the responsible Flight Standards office. EASA does not approve a separate training program in the same way; competence is managed under 145.A.30 and described in the MOE.

6. Human factors

EASA requires that personnel competence includes an understanding of human factors and human performance (145.A.30(e)), with initial training and continuation training in each two-year period (AMC2 145.A.30(e)). The FAA strongly recommends human factors content in the approved training program, but under Part 145 it is not a regulatory requirement, as FAA guidance discussed by ARSA confirmed.

7. Information security

Since 22 February 2026, Part-IS (Implementing Regulation (EU) 2023/203) applies to Part-145 maintenance organisations, with an additional 18-month period to reach full maturity of the information security management system. The text of 14 CFR Part 145 contains no equivalent requirement.

What this means in practice

From my own project work: the gaps rarely sit in the workshop. They sit in the paperwork that connects people, certificates and manuals. A US site that copies its European parent’s system usually fails on point 1 and point 2 first.

Three actions

1. Map every person who signs a release against 145.157(a). Certificate type and number, not job title.
2. Build the RSM from the 145.209 list, then cross-reference the MOE — not the other way round.
3. Write one occurrence-reporting procedure that meets the 72-hour EASA clock and the 96-hour FAA clock.

Sources

• U.S. Government — 14 CFR 145.157, 145.163, 145.209, 145.211, 145.221 (current), law.cornell.edu
• Federal Aviation Administration — Safety Management Systems Final Rule (April 2024), faa.gov
• Federal Register — Safety Management Systems, 89 FR (26 April 2024), govinfo.gov
• Transport Malta — IAN 26 Part-145, Regulation (EU) 2021/1963 changes, Issue 2 (2023), transport.gov.mt
• Transport Malta — IAN 01 Occurrence Reporting, Issue 7, transport.gov.mt
• Transport Malta — IAN 07 Human Factors Training, transport.gov.mt
• ARSA — FAA Releases Inspector Guidance on Human Factors Training Programs (6 September 2008), arsa.org
• Jones Day — Civil Aviation Cybersecurity: EASA Part-IS Sets New Information Security Obligations (February 2026), jonesday.com
• ILT (Netherlands) — Part-IS, english.ilent.nl

Five regulatory frameworks are simultaneously active in Q4 2026 that affect quality management systems in aerospace and automotive. IA9100 is publishing. EASA 2023/203 cybersecurity requirements are fully in force. The EU AI Act became enforceable in August. EU Battery Regulation enforcement is in active phase. REACH amendment cycles continue. The compliance response most organizations are building is five parallel programmes: an IA9100 transition project, a cybersecurity compliance project, an AI Act compliance assessment, a battery regulation supply chain project, and a REACH monitoring update. This is the wrong architecture.

The right architecture is recognizing that these five regulatory frameworks are, at their operational core, requiring the same organizational processes. Documented risk assessment. Supply chain traceability. Incident reporting and notification. Change management with documented approval. Supplier evaluation with sub-tier visibility. Audit-ready documentation with version control and retention requirements. These are the requirements that appear in all five frameworks simultaneously — with different labels, different scope definitions, and different enforcement mechanisms, but requiring the same organizational capabilities to satisfy.

1. The Process Overlap Map

Risk assessment: IA9100 Clause 6.1 (risk and opportunity management), EASA 2023/203 (information security risk assessment), EU AI Act Article 9 (risk management for high-risk AI), EU Battery Regulation Article 72 (supply chain due diligence risk assessment). Four regulatory requirements for documented risk assessment processes — all satisfiable through a single integrated risk management framework that is scoped to cover quality, cybersecurity, AI, and supply chain risks in a unified process.

Supplier evaluation and sub-tier control: IA9100 Key Change Summary (sub-tier controls), EASA 2023/203 (third-party information security), EU AI Act prEN 18286 Clause 9.2 (supplier competence, security-by-design), EU Battery Regulation Article 72 (due diligence for critical minerals through sub-tiers). Four regulatory frameworks requiring supplier evaluation that extends beyond direct Tier-1 relationships — all satisfiable through a single extended supplier qualification framework that incorporates cybersecurity, AI compliance, and material traceability assessments into the standard qualification process.

Incident reporting: IA9100 (nonconformance and corrective action), EASA 2023/203 (cybersecurity incident notification to competent authority), EASA 376/2014 (occurrence reporting), EU AI Act Article 73 (serious incident reporting for high-risk AI). Four reporting frameworks with different authorities, different timelines, and different scope definitions — all requiring documented detection procedures, severity assessment, and structured notification processes that a single integrated incident management system can address.

Change management: IA9100 (configuration management and change notification), EASA Part 21 (design change approval), EU AI Act (change management for continuously learning systems), REACH (notification of material changes affecting SVHC compliance). Four change management requirements — all requiring documented change assessment, approval before implementation, and customer/authority notification that a single change control process with appropriate scope can satisfy.

2. Why Parallel Programmes Fail

The failure mode of parallel compliance programmes is structural, not organizational. When the same supplier is evaluated separately for quality (AS9100 audit), cybersecurity (EASA 2023/203 compliance check), AI Act compliance (Article 17 QMS review), and battery regulation (carbon footprint declaration status), the supplier faces four separate engagement requests from the same customer. Each request is answered in isolation. The information produced is stored in four different systems. The gaps identified generate four separate corrective action cycles. The inefficiency is not a project management problem — it is an architecture problem.

An integrated framework conducts one comprehensive supplier assessment that covers quality system compliance, cybersecurity status, AI system inventory, battery compliance status, and REACH material declarations simultaneously. The assessment produces one finding set, one corrective action plan, and one follow-up schedule. The supplier engagement is more efficient, the data is more coherent, and the compliance coverage is more complete.

3. Building the Integrated Framework

The integration point is the supplier quality agreement. A single updated SQA that incorporates the cybersecurity clause, AI Act clause, battery regulation clause, and REACH notification clause — as described in the September 17 post in this series — creates the contractual foundation for integrated compliance management. The supplier qualification audit that covers all four areas in a single visit creates the operational foundation. The supplier performance scorecard that tracks compliance status across all four areas creates the monitoring foundation.

This is not complexity for its own sake. It is the recognition that the regulatory landscape in 2026 has produced a coherent set of organizational requirements that a mature quality management system can address in an integrated way — and that the organizations building integrated systems are more resilient to future regulatory change than those building compliance silos that will need to be rebuilt every time a new regulation enters force.

3 Concrete Actions

1. Map your current compliance activities against the process overlap categories described above — risk assessment, supplier evaluation, incident reporting, change management. For each category, identify which regulatory requirements are currently being addressed by separate processes and what would be required to unify them. The mapping exercise typically reveals 3-5 major process consolidation opportunities that reduce compliance overhead while improving compliance coverage.

2. Design your IA9100 gap analysis to simultaneously cover EASA 2023/203, EU AI Act prEN 18286, and EU Battery Regulation supply chain requirements. The gap analysis output should be a single action plan that closes all regulatory gaps through shared process improvements, not a separate action plan for each regulation. This requires cross-functional involvement — quality, IT, procurement, legal — but produces a more coherent result than sequential single-regulation gap analyses.

3. Pilot the integrated supplier assessment approach on your top three critical suppliers in Q4 2026. The pilot assessment should cover quality system compliance, cybersecurity status, AI system inventory, battery compliance status, and REACH declarations in a single structured audit using a combined assessment protocol. The efficiency gain and the coherence improvement will be visible in the first pilot — and the protocol can be standardized across the supplier base in 2027.

👉 Request a Technical Consultation → www.skqc.org

Sources

• IAQG — IA9100 Key Change Summary: Six Named Areas, iaqg.org
• European Commission — Implementing Regulation (EU) 2023/203 Part IS CA, eur-lex.europa.eu
• European Parliament and Council — Regulation (EU) 2024/1689 (EU AI Act), Articles 9, 17, 73, eur-lex.europa.eu
• European Parliament and Council — Regulation (EU) 2023/1542, Article 72, eur-lex.europa.eu
• ECHA — REACH Regulation: Supply Chain Communication Requirements, echa.europa.eu
• Quality Magazine — ISO 9001 in 2026: How AS9100, IATF 16949, NIST and CMMC Fit Together (January 8, 2026), qualitymag.com
• European Parliament and Council — Regulation (EU) 376/2014 on Occurrence Reporting, eur-lex.europa.eu

#RegulatoryConvergence #QualityManagement #AerospaceQuality #IntegratedCompliance #IA9100 #EUAIAct #EASA #REACH #SKQC

Most supplier quality agreements in aerospace and automotive were written before four regulatory realities entered enforcement. EU AI Act Article 17 became enforceable August 2026. EASA 2023/203 cybersecurity requirements were extended to declaration organizations in November 2025. EU Battery Regulation 2023/1542 carbon footprint enforcement began February 2026. REACH amendment 2026/0859 added a new substance to the restriction list in Q2 2026. None of these are reflected in supplier quality agreements that have not been updated since 2023 or earlier. An SQA without these clauses cannot be used to enforce the corresponding supplier obligations — and the obligations are active now, not in a future compliance window.

Quality Magazine’s January 2026 analysis of the converging regulatory landscape was direct: „Begin updating supplier quality agreements to anticipate cyber and export-control clauses.“ The same logic applies to all four regulatory areas in the current active enforcement landscape. The SQA is the contractual mechanism through which customer quality requirements become supplier obligations. Regulations that are not reflected in your SQA are regulations your supplier has no contractual obligation to comply with — regardless of whether they are legally required to comply with them independently.

1. The Cybersecurity Clause (EASA 2023/203 + IA9100)

For any supplier in the aviation supply chain — Part 145 organizations, Part 21 production approval holders, and suppliers to these organizations — the SQA should specify: the supplier maintains a documented ISMS consistent with the requirements of EASA Implementing Regulation 2023/203, covering information assets whose compromise could affect the safety relevance of supplied products or services. The supplier notifies the customer within 72 hours of any cybersecurity incident that may have compromised customer-related safety data. The supplier’s ISMS is subject to customer audit as part of the standard second-party audit programme. This clause satisfies both the EASA 2023/203 requirement and the IA9100 cybersecurity integration requirement simultaneously.

2. The AI System Clause (EU AI Act Article 17)

For suppliers using automated systems in quality-critical processes, the SQA should specify: the supplier maintains an inventory of AI systems used in the design, production, inspection, or quality assurance of customer parts. For any AI system that qualifies as high-risk under EU AI Act Annex III, the supplier maintains a documented quality management system consistent with Article 17 of Regulation (EU) 2024/1689. The supplier notifies the customer of any high-risk AI system introduced into quality-critical processes affecting customer parts, with minimum 30 days advance notice. Evidence of Article 17 QMS compliance is subject to customer review upon request.

3. The Battery Regulation Clause (EU 2023/1542)

For suppliers providing products containing industrial batteries above 2 kWh for EU market placement, the SQA should specify: the supplier maintains a verified carbon footprint declaration consistent with Article 7 of Regulation (EU) 2023/1542 for each battery model per manufacturing plant. From February 18, 2027, the supplier provides a compliant Digital Battery Passport via QR code for each battery delivered. The supplier maintains sub-tier raw material traceability for regulated critical minerals (lithium, cobalt, nickel, manganese, natural graphite) consistent with the due diligence requirements of Article 72. Evidence of compliance is subject to customer audit.

4. The REACH Notification Clause

For all suppliers providing materials, components, or assemblies: the SQA should specify: the supplier notifies the customer within 30 days of any REACH SVHC candidate list addition or restriction amendment that affects substances present in materials used in customer parts above the 0.1% w/w threshold. The supplier maintains substance declaration documentation consistent with REACH Article 33 for all parts containing SVHCs above threshold. The supplier notifies the customer in advance of any material substitution required by REACH compliance, and does not implement such substitutions without customer approval under the applicable change notification procedure.

3 Concrete Actions

1. Audit your current SQA template against these four clause areas. For each area, assess whether your current language creates an enforceable obligation or relies on a general standard reference that the supplier can interpret as they choose. A clause that says „the supplier shall comply with applicable regulations“ does not create an enforceable REACH notification obligation or an enforceable AI Act QMS documentation obligation — it creates a vague reference that will not survive a dispute.

2. Prioritize SQA updates by regulatory risk concentration in your supply base. Aviation suppliers: cybersecurity clause urgent (EASA 2023/203 active). Suppliers using AI in quality-critical processes: AI Act clause required (enforceable August 2026). Battery-value-chain suppliers: Battery Regulation clause urgent (February 2027 DBP deadline). All suppliers: REACH notification clause as standard requirement. The update sequence should reflect your actual exposure, not an alphabetical clause review.

3. Include a general regulatory change notification clause as standard in all updated SQAs: the supplier notifies the customer within 30 days of any change in their regulatory compliance status that could affect their ability to supply conforming products, including but not limited to loss or suspension of quality certification, regulatory enforcement action, material restriction compliance issues, and cybersecurity incidents affecting customer data. This clause converts your SQA from a point-in-time qualification document into a continuous monitoring mechanism at zero additional cost.

👉 Request a Technical Consultation → www.skqc.org

Sources

• Quality Magazine — ISO 9001 in 2026: How AS9100, IATF 16949, NIST and CMMC Fit Together (January 8, 2026), qualitymag.com
• European Parliament and Council — Regulation (EU) 2024/1689 (EU AI Act), Article 17 and Annex III, eur-lex.europa.eu
• European Commission — Implementing Regulation (EU) 2023/203 Part IS CA, eur-lex.europa.eu
• European Parliament and Council — Regulation (EU) 2023/1542, Articles 7 and 72, eur-lex.europa.eu
• ECHA — REACH Article 33: SVHC Disclosure Requirements, echa.europa.eu
• IAQG — IA9100 Key Change Summary: Six Named Areas of Substantive Change, iaqg.org
• REACH Regulation (EU) 2026/0859 — Amendment Q2 2026, eur-lex.europa.eu

#SupplierQualityAgreement #RegulatoryCompliance #EUAIAct #EASACybersecurity #REACH #EUBatteryRegulation #IA9100 #QualityManagement #SKQC

REACH Regulation 1907/2006 received amendment 2026/0859 in Q2 2026. The amendment adds 2,4-Dinitrotoluol to the restriction list — a substance used in certain energetic material formulations and historically present in some adhesive and coating systems. For aerospace quality managers with active material qualification programmes, this addition requires systematic review of current approved material lists for any specification that references this substance and notification to design and procurement teams to prevent its use in new designs.

The 2026/0859 amendment is not exceptional. It is representative of the ongoing REACH amendment cycle that has been generating material compliance obligations since the regulation’s adoption in 2006. What has changed is the pace and the scope: REACH SVHC candidate list updates now occur twice yearly, the Authorization List (Annex XIV) is updated annually, and the intersection of REACH restrictions with aerospace-specific material qualifications — special process approvals, NADCAP certifications, OEM material specifications — creates a compounding compliance management challenge.

1. The Approved Material List Problem

In aerospace production, the relationship between REACH compliance and approved material lists is structural. A First Article Inspection or PPAP conducted with a specific material formulation qualifies that formulation — not a chemically equivalent alternative. When a REACH restriction makes a substance unavailable, the qualified material formulation changes, and the FAI or PPAP qualification may no longer be valid for the reformulated material. The process approval that took 6-18 months to obtain must be repeated for the compliant alternative.

This is not a theoretical concern. REACH restrictions on chromate conversion coatings — specifically hexavalent chromium compounds added to the Authorization List — have required re-qualification of surface treatment processes at aerospace manufacturers and their supply chains over the past decade. The automotive sector has managed similar transitions through IMDS (International Material Data System) tracking. Aerospace has historically managed REACH compliance less systematically, with significant variation between OEMs and their supply bases in how material compliance is tracked and flow-down managed.

2. What Systematic REACH Monitoring Requires

A quality management system that manages REACH compliance systematically has three integrated components:

Material data infrastructure. A maintained database linking each approved material specification to its chemical composition data at the substance level, with SVHC status tracked against the current REACH candidate list. This is the foundation that makes REACH amendment impact assessment possible without manual review of every material specification every time the candidate list updates.

Change notification integration. A process that links REACH candidate list updates and restriction amendments to the affected approved material list entries and generates a review trigger. The review determines whether the affected materials are in use, whether the restriction timeline requires action before the next scheduled material requalification, and whether an alternative material qualification is needed.

Supply chain flow-down. Contractual requirements in supplier quality agreements that require suppliers to notify the customer when a REACH restriction or SVHC addition affects materials used in customer parts, and to maintain material declaration documentation consistent with REACH Article 33 (SVHC content disclosure) requirements. Without this flow-down, REACH compliance at the customer level depends entirely on voluntary supplier disclosure.

3. The Intersection with IA9100 Sub-Tier Controls

IA9100’s strengthening of sub-tier supplier controls — one of six named areas in the Key Change Summary — creates a direct parallel with REACH compliance management. Both require visibility into what materials are present in delivered parts below the direct supplier level. The supplier who processes titanium with a REACH-restricted surface treatment, or bonds composite components with an adhesive containing an SVHC substance, may not be your direct Tier-1 supplier — they may be a Tier-2 or Tier-3 in your supply chain. Without the sub-tier visibility that IA9100 requires, REACH compliance at those levels is invisible until a product recall or customer material declaration dispute makes it visible.

3 Concrete Actions

1. Review your current approved material list against the most recent REACH SVHC candidate list and Authorization List. ECHA publishes both on its website with full substance identification. The review should flag any approved material specification that references, contains, or may contain substances on either list above the 0.1% w/w threshold. Materials flagged require assessment of restriction timeline, use volume, and alternative qualification status.

2. Add REACH compliance notification to your supplier quality agreements as an explicit requirement. The clause should require suppliers to notify you within 30 days of any REACH restriction or SVHC candidate list addition that affects materials used in your parts, and to maintain substance declaration data consistent with REACH Article 33 for all parts containing SVHCs above the 0.1% threshold. Without this contractual requirement, you are dependent on voluntary supplier disclosure.

3. For aerospace organizations with NADCAP-approved special processes: verify that your NADCAP-qualified processes do not use substances that have been added to the REACH Authorization List (Annex XIV) without an active authorization or ongoing authorization application. NADCAP process qualification and REACH authorization are separate systems — a NADCAP-qualified process using an Annex XIV substance without authorization is non-compliant regardless of NADCAP status, and the consequence is market access loss for any parts produced with that process for EU market products.

👉 Request a Technical Consultation → www.skqc.org

Sources

• European Parliament and Council — Regulation (EU) 1907/2006 (REACH), as amended by 2026/0859, eur-lex.europa.eu
• ECHA — SVHC Candidate List and Authorization List (Annex XIV), echa.europa.eu
• ECHA — REACH Substance Restriction Process and Timeline, echa.europa.eu
• IAQG — IA9100 Key Change Summary: Sub-Tier Supplier Controls, iaqg.org
• ASD-STAN — Aerospace Material Specification Compliance and REACH Interface
• NADCAP — Accreditation Requirements for Special Processes in Aerospace, pri.org

#REACH #SVHC #AerospaceQuality #MaterialQualification #SupplierQuality #QualityManagement #NADCAP #SKQC