Autor: admin

EU AI Act Article 17: The Quality Management System Requirement That Aerospace Suppliers Are Missing

admin

August 2, 2026: the EU AI Act became enforceable for high-risk AI systems and general-purpose AI models. Article 17 of the Act requires providers of high-risk AI systems to establish and document a quality management system. This is not a cybersecurity requirement or a data protection requirement — it is a quality management requirement that uses the same language, the same concepts, and much of the same structure as ISO 9001 and the sector standards built on it.

For aerospace quality managers, there are two distinct questions. The first: does your organization provide high-risk AI systems under the Act’s definition? The second — and the one most organizations are not asking yet: do your suppliers? Annex III of the EU AI Act lists categories of high-risk AI systems. Category 8 — AI used in safety components of products covered by harmonized EU legislation — explicitly covers machinery, aviation, automotive, and defense product categories. AI used in quality inspection, predictive maintenance, automated defect detection, or process control in aerospace production may qualify as a high-risk system under this definition, regardless of whether the organization deploying it considers itself an „AI company.“

1. What prEN 18286 Requires — The QMS Standard for the AI Act

CEN and CENELEC published the first draft AI Act QMS standard — prEN 18286:2025 — for public consultation in late 2025. Compliance Week confirmed in its January 2026 analysis: „This is a landmark step forward for artificial intelligence governance and regulation, and compliance managers should prepare for it to be finalized and published by the end of 2026.“ The CMS Law analysis of prEN 18286 was specific about its integration potential: „The requirements can be built into existing sector quality systems such as medical devices or automotive rather than creating a new standalone QMS, provided those systems are updated to incorporate all of this standard’s controls.“

The standard’s QMS requirements are recognizable to anyone who works with ISO 9001 or AS9100. The VDE April 2026 analysis confirmed the parallel: „The QMS must cover design and development controls, including verification, validation, and change management procedures, particularly for continuously learning systems where predetermined changes must be documented and controlled. It requires the establishment of data governance processes for acquisition, labeling, storage, analysis, and retention.“

The supplier management requirements in prEN 18286 — Clause 9.2, requiring supplier competence assessment, security-by-design evaluation, and vulnerability disclosure procedures — map directly onto IA9100’s sub-tier control requirements and EASA 2023/203’s third-party information security requirements. These are the same organizational requirements appearing in three regulatory frameworks simultaneously.

2. The Supplier Qualification Dimension

The aerospace supplier qualification question created by the EU AI Act is specific: if a supplier uses AI in a quality-critical process — automated dimensional inspection, surface defect detection, material identification, predictive process control — does that AI system qualify as high-risk under Annex III? And if so, does the supplier have a documented QMS consistent with Article 17 and prEN 18286 for that system?

Most aerospace supplier qualification processes do not currently ask this question. Standard AS9100 audits do not systematically assess AI system compliance. Second-party audits focused on production process capability do not typically examine the QMS documentation for automated inspection systems. The gap is structural: aerospace supplier qualification was designed before AI systems became operational in aerospace manufacturing at scale, and it has not been updated to reflect the regulatory requirements that AI deployment now triggers.

3. The „Quality“ Reframing in prEN 18286

One aspect of prEN 18286 that the CMS Law analysis highlighted deserves specific attention: „‚Quality‘ is expressly reframed around regulatory compliance and protection of health, safety and fundamental rights, rather than customer satisfaction.“ This reframing matters for aerospace quality managers because it aligns the AI Act’s QMS concept with the safety-oriented quality management framework that aerospace already operates under. An aerospace QMS built around EN 9100 / IA9100 already frames quality in terms of safety and regulatory compliance — the conceptual alignment with prEN 18286 is strong.

3 Concrete Actions

1. Conduct an AI system inventory for your own organization and your critical suppliers. The inventory should identify all AI systems used in quality-critical processes — inspection, defect detection, process control, predictive maintenance — and assess whether each system potentially qualifies as high-risk under EU AI Act Annex III Category 8. This is a scoping exercise, not a compliance audit, and it can be conducted as part of a standard supplier audit using a structured questionnaire.

2. For suppliers who use AI in quality-critical processes and whose systems may qualify as high-risk: add EU AI Act QMS documentation to your supplier quality agreement requirements. The requirement should specify that the supplier maintains documented design and development controls, post-market monitoring procedures, and incident reporting processes for any high-risk AI system used in the production of your parts. This requirement can be integrated into the existing cybersecurity clause described in the September 17 post in this series.

3. Monitor prEN 18286 publication — expected end of 2026 — and plan to assess your existing QMS against its requirements when the final text publishes. The assessment will likely reveal strong alignment with your existing IA9100 or EN 9100 quality system in most areas, with specific gaps in AI-specific areas (data governance, continuous learning system controls, post-market AI monitoring). Closing those gaps before the first regulatory enforcement actions under the AI Act produces better outcomes than addressing them reactively.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • European Parliament and Council — Regulation (EU) 2024/1689 (EU AI Act), Articles 17 and Annex III, eur-lex.europa.eu
  • CEN/CENELEC — prEN 18286:2025: Quality Management System for EU AI Act Regulatory Purposes (public consultation draft)
  • Compliance Week — First Standard for EU AI Act Targets Quality Management Regime (January 7, 2026), complianceweek.com
  • CMS Law — The First Draft AI Act Standard for Public Consultation: What prEN 18286 Signals (December 12, 2025), cms.law
  • VDE — EU AI Act: Quality Management System (April 10, 2026), vde.com
  • Legal Nodes — EU AI Act 2026 Updates: Compliance Requirements and Business Risks (April 10, 2026), legalnodes.com
  • IAQG — IA9100 Key Change Summary: Cybersecurity and Quality Culture, iaqg.org

#EUAIAct #AIQualityManagement #HighRiskAI #prEN18286 #AerospaceQuality #SupplierQuality #QualityManagement #SKQC

EASA Cybersecurity Regulation 2023/203: What Part 145 and Part 21 Organizations Must Have in Place Now

EASA Cybersecurity Regulation 2023/203: What Part 145 and Part 21 Organizations Must Have in Place Now

admin

EASA Implementing Regulation 2023/203 — Part IS CA — has been active since January 2023. Its November 2025 amendment extended Information Security Management System (ISMS) requirements beyond formally approved organizations to organizations operating under declaration — broadening the scope to include a significantly larger population of maintenance organizations, design organizations, and aerodrome operators. The sassofia.com May 2026 regulatory update confirmed the scope of this extension: „By amending several foundational regulations (including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014), this act harmonizes information security protocols across the entire aviation value chain.“

For quality managers in Part 145 maintenance organizations and Part 21 production approval holders: if your organization has not implemented a documented ISMS consistent with 2023/203 requirements, you are operating with a regulatory compliance gap that your next competent authority surveillance audit will identify. The requirement is not optional and it is not deferred — it is active.

1. What 2023/203 Actually Requires

The regulation requires aviation organizations to identify and manage information security risks that could impact aviation safety. The key word is „safety-relevant“ — 2023/203 is not an IT security regulation in the conventional sense. It is a safety management regulation that addresses cybersecurity threats as a category of safety risk. The ISMS required under 2023/203 must cover:

Information security risk assessment. Identification of information assets — systems, data, processes — whose compromise could affect the organization’s ability to maintain airworthy products or conduct safe operations. For a Part 145 organization, this includes: maintenance management systems, airworthiness documentation systems, tooling calibration databases, parts traceability systems, and communication systems used for technical data exchange with customers and regulatory authorities.

Risk-proportionate controls. Access controls, authentication requirements, network security, patch management, and backup and recovery procedures proportionate to the identified risks. The regulation does not mandate specific technical standards — it requires a risk-based approach documented in the organization’s Maintenance Organization Exposition or equivalent quality system documentation.

Incident detection and reporting. Procedures for detecting information security events, assessing whether they constitute incidents with safety relevance, and reporting to the competent authority where required. This is the interface between 2023/203 and Regulation 376/2014 on occurrence reporting — a cybersecurity incident that affects airworthiness data integrity is potentially a reportable occurrence.

Supplier and third-party management. Assessment of information security risks arising from third-party access to your information systems — including software vendors with remote access to maintenance systems, cloud service providers hosting quality data, and customers with direct system access for technical data exchange. This is the supply chain dimension of 2023/203 that most organizations have not yet addressed systematically.

2. The Interface with IA9100

IA9100’s cybersecurity integration requirement at Clause 8.1 — mandatory for aerospace quality management systems when the standard publishes — directly overlaps with 2023/203. The IAQG Key Change Summary identifies information security as one of six named areas of substantive change. The audit evidence expected: governance structures, threat assessment covering ERP systems, CAD and quality data storage, remote access infrastructure, and incident response procedures linked to quality records.

An organization that builds its ISMS to satisfy 2023/203 requirements now will have the implementation evidence required for an IA9100 transition audit when that transition begins. The organizations that have not started are facing two parallel implementation requirements — regulatory and standards — in a compressed timeline.

3. What a 2023/203-Compliant ISMS Looks Like in Practice

For a mid-market Part 145 organization, the minimum viable ISMS consistent with 2023/203 requirements covers five documented elements: an information asset inventory identifying all systems and data relevant to maintenance safety, a risk assessment documenting identified threats and their potential safety impact, a control set proportionate to the identified risks with implementation evidence, an incident response procedure with clear escalation and reporting paths, and a supplier/third-party assessment process. None of these elements require ISO 27001 certification — they require documented, implemented, and auditable processes.

3 Concrete Actions

1. If your organization has not conducted an information security risk assessment consistent with 2023/203 requirements, prioritize this before your next competent authority surveillance audit. The risk assessment is the foundation of the ISMS — without it, the other elements cannot be developed coherently. Scope the assessment specifically to safety-relevant information assets: systems whose compromise could affect airworthiness documentation, parts traceability, or maintenance record integrity.

2. Review your Maintenance Organization Exposition or equivalent quality system documentation for cybersecurity content. A reference to „IT security policy managed by the IT department“ is not sufficient for 2023/203 compliance. The MOE must reflect an integrated ISMS with safety-relevant scope, documented risk assessment, and defined incident response procedures linked to the occurrence reporting framework under 376/2014.

3. Extend your supplier qualification process to include information security assessment for suppliers with access to your safety-relevant systems. The assessment does not need to be an ISO 27001 audit — it needs to verify that the supplier has implemented proportionate access controls, has an incident notification process, and understands which data they access qualifies as safety-relevant under 2023/203. This assessment should be documented and retained as part of the supplier qualification record.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • European Commission — Implementing Regulation (EU) 2023/203 Part IS CA: Information Security Requirements, eur-lex.europa.eu
  • European Commission — Delegated Regulation (EU) 2022/1645 Part IS IA: Information Security Requirements, eur-lex.europa.eu
  • sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
  • EASA — AMC and GM to Part-IS.I.OR and Part-IS.D.OR, easa.europa.eu
  • EASA — AMC/GM Acceptable Means of Compliance to Regulation (EU) 2022/1645 and 2023/203, easa.europa.eu
  • IAQG — IA9100 Key Change Summary: Cybersecurity Integration (Clause 8.1), iaqg.org
  • European Parliament and Council — Regulation (EU) 376/2014 on Occurrence Reporting in Civil Aviation, eur-lex.europa.eu

#EASACybersecurity #Part145 #Part21 #ISMS #AviationSafety #QualityManagement #InformationSecurity #IA9100 #SKQC

The EU Regulatory Radar Every Quality Manager in Aerospace and Automotive Needs in Q4 2026

The EU Regulatory Radar Every Quality Manager in Aerospace and Automotive Needs in Q4 2026

admin

August 2, 2026 was a deadline. Under the EU AI Act, the general-purpose AI provisions and the prohibited AI practices framework became fully enforceable. For quality managers in aerospace and automotive, this is one of five active regulatory tracks that require monitoring and action in Q4 2026. The others: EASA cybersecurity regulation 2023/203 and its November 2025 amendment, EU Battery Regulation 2023/1542 enforcement now in active phase, IA9100 publication expected September-October 2026, and REACH Regulation amendments with Q2 2026 substance additions directly affecting aerospace materials. Each of these creates a specific compliance obligation for quality management systems. None of them are isolated.

The pattern is recognizable to anyone who has tracked regulatory development across multiple frameworks: individual regulations that appear to address separate domains — AI safety, aviation cybersecurity, battery sustainability, product quality standards, chemical restrictions — are converging toward a common set of organizational requirements. Documented risk management. Supply chain traceability. Incident reporting. Change notification. Audit-ready documentation. These are quality management requirements, regardless of which regulation generates them.

1. EU AI Act — August 2, 2026: Quality Management System Requirements for High-Risk AI

The EU AI Act’s Article 17 requires providers of high-risk AI systems to establish a documented quality management system. Compliance Week’s January 2026 analysis identified this as a landmark step: „The first EU standard to drive conformity and facilitate enforcement of the EU AI Act has been published in draft.“ The standard — prEN 18286:2025, drafted by CEN and CENELEC — specifies QMS requirements that directly parallel ISO 9001 and sector standards: design and development controls, supplier management, post-market monitoring, incident reporting, and documentation discipline. The CMS Law December 2025 analysis of prEN 18286 was specific: „The requirements can be built into existing sector quality systems such as medical devices or automotive rather than creating a new standalone QMS, provided those systems are updated to incorporate all of this standard’s controls.“

For aerospace and automotive quality managers, the practical question is not whether your organization uses AI — it is whether any AI system in your supply chain or production environment qualifies as high-risk under the Act’s Annex III categories. Annex III includes AI used in safety components of products covered by harmonized EU legislation — which explicitly includes machinery, aviation, automotive, and defense product categories. If your suppliers use AI in quality inspection, predictive maintenance, or process control, those systems may qualify.

2. EASA Cybersecurity — 2022/1645 and 2023/203: Now Fully Active

The EASA cybersecurity framework — Regulation 2022/1645 (Part IS IA) and Regulation 2023/203 (Part IS CA) — is the aerospace-sector implementation of aviation cybersecurity requirements. The November 2025 amendment to 2023/203 extended Information Security Management System (ISMS) requirements to organizations operating under declaration rather than formal approval — bringing a broader range of maintenance organizations, aerodrome operators, and design organizations within scope. The sassofia.com May 2026 regulatory update confirmed: this amendment „harmonizes information security protocols across the entire aviation value chain“ by amending multiple foundational regulations including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014.

For Part 145 maintenance organizations and Part 21 production approval holders: an ISMS is not optional. The IA9100 cybersecurity integration requirement — one of six named areas in the IAQG Key Change Summary — aligns with the EASA framework. Building an ISMS that satisfies both EASA 2023/203 and IA9100’s Clause 8.1 cybersecurity requirement produces a single integrated system rather than two parallel compliance programmes.

3. REACH 2026 — Active Substance Additions Affecting Aerospace Materials

REACH Regulation 1907/2006 received amendment 2026/0859 in Q2 2026 — the addition of 2,4-Dinitrotoluol to the substances of very high concern list. Your Excel-based regulatory monitoring records this as requiring notification to procurement and design teams to prevent use in new designs. The pattern of REACH additions continues: authorization list updates, SVHC candidate list additions, and restriction proposals under evaluation for substances used in aerospace adhesives, coatings, and composite processing materials. For quality managers, REACH compliance is an approved material list maintenance issue — every SVHC addition potentially affects existing process approvals and requires systematic review of current material specifications.

4. EU Battery Regulation 2023/1542 — Enforcement Phase Active

The carbon footprint declaration requirement for industrial batteries above 2 kWh has been active since February 18, 2026. The Digital Battery Passport becomes mandatory February 18, 2027. For aerospace and automotive quality managers, this regulation matters beyond direct battery manufacturing: any product containing industrial batteries above 2 kWh capacity — ground support equipment, avionics test benches, hybrid powertrain components, manufacturing facility energy storage — is in scope. The nine-month window before the DBP deadline is the implementation window that remains.

5. IA9100 — Publication This Quarter

ISO 9001:2026 is expected September-October 2026. IA9100 follows in alignment. The six named change areas are confirmed and stable in the IAQG Key Change Summary. Gap analysis conducted now — before the final text publishes — will be accurate to within 90-95% of final requirements. Organizations that wait for the published text are starting their preparation 3-6 months later than those who started from the Key Change Summary.

3 Concrete Actions

1. Build a cross-regulatory compliance matrix for your quality management system. Map each active regulation — EU AI Act, EASA 2023/203, REACH, EU Battery Regulation, IA9100 — against your existing QMS processes. Where the same process (supplier evaluation, change notification, incident reporting, document control) appears in multiple regulatory frameworks, you have an opportunity to build a single integrated process that satisfies all of them simultaneously. This is more efficient than building separate compliance programmes for each regulation.

2. Add regulatory monitoring to your standard supplier audit agenda. For each critical supplier, the Q4 audit should verify: ISMS status consistent with EASA 2023/203 for aviation suppliers, AI Act high-risk system inventory for suppliers using AI in quality-critical processes, REACH SVHC status for all materials on approved material lists, and EU Battery Regulation carbon footprint declaration status for battery-containing products. These are not separate compliance checks — they are standard supplier qualification verification against current regulatory requirements.

3. Contact your certification body this quarter about IA9100 transition planning. Request their specific transition audit timeline, early adoption options, and whether combined surveillance/transition audits are available for your certification cycle. The organizations that engage their certification bodies in Q4 2026 will have better transition planning visibility than those who wait for 2027.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • Compliance Week — First Standard for EU AI Act Targets Quality Management Regime (January 7, 2026), complianceweek.com
  • CMS Law — prEN 18286: What the First Draft AI Act Standard Signals for Quality Management (December 12, 2025), cms.law
  • VDE — EU AI Act: Quality Management System Requirements (April 10, 2026), vde.com
  • sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
  • European Parliament and Council — Regulation (EU) 2023/203 Part IS CA, as amended November 2025, eur-lex.europa.eu
  • European Parliament and Council — Regulation (EU) 2022/1645 Part IS IA, eur-lex.europa.eu
  • European Parliament and Council — Regulation (EU) 2023/1542 on Batteries and Waste Batteries, eur-lex.europa.eu
  • IAQG — IA9100 Key Change Summary (November 2023), iaqg.org
  • REACH Regulation (EU) 2026/0859 — Amendment adding 2,4-Dinitrotoluol, eur-lex.europa.eu

#RegulatoryCompliance #QualityManagement #EUAIAct #EASA #REACH #EUBatteryRegulation #IA9100 #AerospaceQuality #SKQC

H1 2026 Review: What Quality Managers Should Address Before the Summer Slowdown

H1 2026 Review: What Quality Managers Should Address Before the Summer Slowdown

admin

The summer period in aerospace and automotive manufacturing is operationally deceptive. Production volumes often decrease. Engineering teams partially disperse. The quality workload does not decrease — and the reduced staffing levels that accompany summer schedules create specific risk windows that a structured H1 review can help anticipate and manage before they produce Q3 and Q4 problems.

A H1 quality review is not a bureaucratic exercise. It is a structured look at the data that H1 generated — supplier performance trends, open corrective action status, audit finding patterns, certification timeline implications — and a decision about what requires active management before the end of the calendar year. The organizations that conduct it consistently make better Q3 and Q4 resource allocation decisions than those that do not. This post covers five reviews that produce the most value in the shortest time.

1. Open Corrective Actions: The Backlog That Accumulates Quietly

How many corrective actions from H1 2026 are past their agreed closure date? How many were closed without documented effectiveness verification? These two numbers tell you more about the operational state of your supplier quality programme than any certification status check.

Corrective action backlog grows during periods of high production activity because the urgency that opened the SCAR fades when the immediate production pressure resolves. The supplier’s quality team moves to the next problem. The customer’s supplier quality engineer moves to the next program. The SCAR sits open until the next audit surfaces it as a finding — at which point it has often been open for six to nine months, the production context relevant to the root cause analysis has changed, and effective investigation has become significantly more difficult.

AMREPinspect’s December 2025 analysis documented the technical parallel: a process that shows Cpk 1.67 short-term but Ppk 1.11 long-term demonstrates instability over time. The same dynamic applies to corrective action programmes: an organization that closes SCARs on time but has a 30%+ recurrence rate for the same failure mode categories is demonstrating that its corrective action process is producing documentation, not sustained improvement.

A H1 review that produces a clear list of open SCARs, organized by age and by supplier risk tier, gives the supplier quality team specific targets for Q3 follow-up. The list should distinguish between SCARs that are appropriately open — effectiveness verification is pending per the agreed timeline — and SCARs that are open because they have been deprioritized. The second category is the risk. The first category is the process working correctly.

2. Supplier Performance Trends: What the H1 Data Is Telling You

Monthly supplier scorecards capture snapshots. H1 trend analysis captures direction — and direction is a leading indicator of where Q3 and Q4 production risk is building before it materializes as a line stop or customer complaint.

A supplier whose on-time delivery performance dropped from 97% in January to 91% in June is telling you something about their internal capacity and process stability that a June scorecard alone does not communicate. The trend may reflect the titanium sourcing constraints documented in the June post of this series, the rare earth export control impacts on electronic component availability, or the workforce competency challenges flagged in EASA EPAS 2026. Each of those root causes has different quality implications and different appropriate responses.

A supplier whose quality metrics are stable but whose delivery performance is declining should trigger a conversation about what is constraining their throughput. Material delays create schedule pressure that consistently correlates with quality shortcuts. Equipment availability issues managed through overtime create fatigue-related quality risk — exactly the human factors dimension that IA9100 will require in root cause analysis. Staffing reductions that place experienced personnel across multiple processes simultaneously create competency dilution in quality-critical roles.

The H1 trend analysis should identify the three suppliers with the most negative trend direction — regardless of their current absolute performance level. These are the suppliers that warrant proactive engagement in Q3 before their trend translates into production impact in Q4.

3. Audit Programme Status: Completion and Finding Pattern Analysis

Were all planned H1 audits completed? If not, assess the risk of each gap explicitly — a planned audit that did not happen for a supplier with no recent performance issues is a different risk profile than a planned audit that did not happen for a supplier with two open SCARs and declining delivery performance.

For audits that were completed, examine finding patterns across the supplier base. Findings that cluster in the same category across multiple suppliers in the same period often indicate industry-wide conditions rather than supplier-specific failures. IAQG’s OASIS Insights platform — launched April 1, 2025 — now provides AI-generated benchmarking and quantitative performance scores for certified suppliers following each audit. The IAQG’s dual-track approach to standards revision, reported by Quality Magazine in May 2026, means that finding patterns from H1 2026 may reflect emerging IA9100 transition gaps that can be addressed through targeted communication more efficiently than through five individual corrective action cycles.

4. IA9100 Transition Readiness

IA9100 is expected to publish in late 2026. For organizations currently certified to EN 9100:2018 or AS9100 Rev D, the H1 review is the right point to assess where the gap analysis stands and what the transition timeline looks like given your certification body’s planning horizon.

BSI Group confirmed in its published IA9100 guidance that the 9104 series standards — covering the audit scheme — have already completed writing and approval, are being translated into seven languages, and will be ready in late 2025 with a published transition timeline expected by end of 2026. Your certification body should have equivalent planning visibility. If they cannot articulate a transition roadmap, that is a signal worth acting on before the transition window opens.

The four substantive IA9100 additions — cybersecurity integration, human factors root cause analysis, APQP mandatory linkage, and sub-tier controls — each require process development, not just document updates. If none of these areas have been addressed in H1, the H2 plan needs to include specific milestones with accountable owners. Organizations that started IA9100 preparation in 2025 or early 2026 will have significantly smoother transitions than those starting in late 2026 — because the former will be implementing established processes during their transition audit, while the latter will be designing and implementing them simultaneously.

5. Customer Audit Findings: Where H2 Will Begin

If your organization received customer audit findings in H1, the H2 audit will begin exactly where the last one ended. Customer auditors retain notes from previous visits and will specifically revisit findings that were closed with corrective action commitments. The effectiveness of those commitments — measured through process data, not through updated procedures — will be the primary focus of the first hour of the next audit.

A H1 review that includes systematic examination of H1 customer audit findings, the corrective actions committed, and the evidence of effectiveness provides two outputs: confirmation that commitments are being met, and early identification of corrective actions that are behind schedule or lacking the measurement data that constitutes effectiveness evidence. Identifying that gap in August is significantly better than discovering it during the next audit in October or November.

3 Concrete Actions

1. Produce a H1 corrective action status report by supplier, organized by age of open SCAR and by supplier risk tier. Communicate the status to each supplier with open SCARs — specifically identifying which SCARs require closure or effectiveness verification evidence before the end of Q3. This communication creates accountability without requiring a scheduled audit, and it surfaces suppliers who have lost visibility of open corrective actions in their own systems.

2. Run a six-month trend analysis on your top 20 supplier performance metrics — quality, delivery, and responsiveness to SCAR requests. Identify the three suppliers with the most negative trend direction regardless of current absolute performance level. Schedule a proactive review call with each of those suppliers in August or September — before their trend translates into production impact. The conversation is significantly easier before a disruption than after one.

3. Schedule your IA9100 gap assessment for September or October 2026 if it has not been conducted. The gap assessment conducted against the IAQG Key Change Summary and coordination draft materials will be accurate enough to define your preparation priorities. Waiting for the final published standard means starting your gap assessment 6-9 months later than competitors who started earlier — and entering the transition audit with less implementation evidence than organizations that prepared proactively.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • IAQG — OASIS Insights: AI-Generated Benchmarking for 9100-Series Certified Suppliers (launched April 1, 2025), iaqg.org
  • Quality Magazine — Driving Change in Aerospace Quality Management: IAQG Dual-Track Approach (May 2026), qualitymag.com
  • BSI Group — Embracing Changes to IAQG Aerospace Standards: 9104 Series Translation and Transition Timeline, bsigroup.com
  • IAQG — IA9100 Key Change Summary: Six Named Areas of Substantive Change, iaqg.org
  • AMREPinspect — Ppk vs Cpk: Cpk 1.67 Short-Term vs Ppk 1.11 Long-Term (December 27, 2025), amrepinspect.com
  • EASA — European Plan for Aviation Safety (EPAS) 2026 Addendum: Workforce Competency Priority, easa.europa.eu
  • QT9 Software — IA9100 Transition: Two-Year vs Three-Year Window Analysis (October 23, 2025), qt9software.com
  • Assent Risk Management — AS9100 is Becoming IA9100: Transition Planning Guidance (March 17, 2026), assentriskmanagement.co.uk

#QualityManagement #SupplierQuality #AuditManagement #CorrectiveAction #IA9100 #H1Review #QualityManager #OASIS #SKQC

Sarasota Aviation Hub 2026: What Regional Growth Means for Supplier Quality in Florida

Sarasota Aviation Hub 2026: What Regional Growth Means for Supplier Quality in Florida

admin

Florida is not typically the first state named in aerospace industry analysis. That framing is changing. Stratview Research identified over 500 MRO players in the United States — Florida holds a disproportionate share of that base. The state hosts one of the most geographically diverse and operationally active aviation ecosystems in the country, running from Naval Air Station Jacksonville and the dense defense supplier network in the northeast, through the Orlando-Kissimmee corridor where Lockheed Martin, L3Harris, and Northrop Grumman have established significant presence, to Miami, which anchors one of the largest commercial MRO concentrations in the Western Hemisphere. Market Research Future valued the U.S. Aircraft MRO market at USD 10.82 billion in 2025, projecting growth to USD 16.79 billion by 2034 at a CAGR of 5.0%.

The Sarasota-Bradenton-Venice MSA sits near the center of this geography, with access to both commercial airports (SRQ and TPA) and a concentration of general aviation activity that supports a growing base of FBOs, Part 145 repair stations, and specialized component manufacturers. For quality managers operating in this ecosystem — whether as local suppliers, as European OEMs qualifying Florida-based vendors, or as MRO operators managing Part 145 quality systems — the regional growth creates specific quality management challenges that are worth addressing before they produce qualification gaps or quality escapes.

1. The Florida Aviation Ecosystem: What the Structure Looks Like

Four distinct geographic clusters define Florida’s aviation footprint:

Northeast Florida — Jacksonville defense and naval aviation hub. Naval Air Station Jacksonville drives significant MRO activity for naval aircraft platforms, with a supplier network extending across Clay, Duval, and St. Johns counties. The defense orientation means AQAP 2110 and DCMA oversight are relevant to suppliers in this corridor — a different quality management context than commercial Part 145 work.

Central Florida — Defense technology and space manufacturing cluster. The Orlando-Kissimmee corridor and the Space Coast (Brevard County) host Lockheed Martin’s Orlando-area facilities, L3Harris Technologies, Northrop Grumman, and hundreds of tier-two and tier-three suppliers. The Kennedy Space Center and Cape Canaveral launch infrastructure drives additional quality requirements for space-rated components and manufacturing processes. AS9100 and AQAP 2110 are both active in this market.

South Florida — Commercial aviation MRO concentration. Miami International Airport hosts several of the largest commercial MRO operations in the Western Hemisphere. Line maintenance, heavy maintenance checks, engine MRO, and component repair represent a significant Part 145 activity base. The global nature of Miami’s aviation hub means that FAA, EASA, and multiple international regulatory frameworks are relevant to MRO operators in this corridor.

Southwest Florida — The Sarasota-Bradenton growth corridor. The SRQ and TPA airports anchor a growing base of general aviation, business aviation, and commercial aviation support activity. The proximity to the defense and commercial aviation clusters in both central Florida and Miami positions the Sarasota-Bradenton area as a realistic location for suppliers serving multiple market segments simultaneously.

2. The Quality Infrastructure Gap in Regional Growth

Regional aviation ecosystem growth attracts new entrants — companies previously operating in adjacent sectors (automotive manufacturing, industrial maintenance, electronics assembly) that are moving into aviation because the market opportunity is visible and the geographic access is established. Fortune Business Insights noted that North America dominated the aircraft component MRO market with 30.70% market share in 2025, with inspection technology advances and growing demand for specialized services driving the market. These new entrants frequently bring capable manufacturing and maintenance operations. They do not always bring the quality infrastructure required for regulated aviation work.

The gap is structural, not motivational. Part 145 repair station quality requirements, Part 21G production approval quality requirements, and AS9100 / EN 9100 supplier quality requirements assume a baseline of quality management maturity that takes time and investment to develop. The specific aerospace requirements — configuration management to AS9100 Section 8.1.2, First Article Inspection to AS9102, CoC format and content standards, key characteristics controls, airworthiness documentation — require specific knowledge and documented processes that automotive or industrial quality experience does not automatically provide.

EASA EPAS 2026 identified workforce competency as a systemic safety risk, with the addendum to Volume I stating that „addressing the shortage of competent aviation personnel is a priority topic for the Member States.“ The same challenge is present in the U.S. market: the qualified aviation quality engineering workforce is not growing as fast as the aviation supplier and MRO base is growing. Organizations are placing personnel in quality-critical roles who are capable and motivated but are learning the aviation quality requirements on the job rather than entering with established aviation quality experience. This is the condition EASA flagged as a potential long-term safety risk — and it is visible on shop floors across the Florida aviation ecosystem today.

3. What This Means for European OEMs Qualifying Florida Suppliers

European OEMs qualifying Florida-based suppliers face the structural gaps described in the earlier post in this series on U.S. market qualification. The additional dimension specific to Florida is the diversity of the market: a supplier in the Sarasota-Bradenton area may simultaneously serve commercial aviation Part 145 customers, general aviation OEMs, defense program requirements under DCMA oversight, and space program requirements under NASA or USAF quality frameworks. Each of those programs has different documentation, traceability, and audit requirements.

The qualification question for a European OEM is not just whether the supplier has an AS9100 certificate — it is whether the supplier’s quality system is calibrated to your specific program’s requirements, and whether the people executing the quality-critical steps in your program have the right background for that specific work. Those questions require process audit, not certificate verification.

4. The Local Presence Advantage

SK Quality Consulting is based in Sarasota. I work in this market, know the regional supplier landscape, and conduct supplier audits and quality oversight across the Florida aviation ecosystem without requiring transatlantic travel or cross-time-zone scheduling coordination.

For European companies with Florida-based suppliers: a process audit conducted by a local representative with experience in both EN 9100 / EASA requirements and U.S. manufacturing operations produces faster qualification decisions, more responsive corrective action management, and supplier relationships that develop more productively than those managed exclusively through transatlantic coordination. For Florida-based suppliers entering European aerospace customer relationships: working with a consultant who understands both sides of the qualification process helps avoid the documentation, process, and communication gaps that consistently surface in first-time transatlantic supplier relationships.

3 Concrete Actions

1. For European OEMs with Florida-based suppliers: conduct a first article process audit — not a document review — before qualifying any new Florida supplier for safety-critical or quality-critical parts. The audit should specifically examine whether the aviation-specific quality processes (FAI to AS9102, CoC format and content, key characteristics control, airworthiness documentation) are implemented in production and executed by personnel with relevant aviation quality background, not just documented in procedures.

2. For Florida-based suppliers entering aviation qualification for the first time: invest in a gap analysis against the specific customer quality requirements before the first formal qualification audit. European aerospace customers typically have quality requirements — in areas of traceability depth, CoC content standards, and corrective action response format — that go significantly beyond AS9100 minimum requirements. Understanding those gaps before the qualification audit allows you to close them proactively rather than manage them as qualification findings.

3. For MRO operators in the Sarasota-Bradenton and southwest Florida market: if you are placing personnel in quality-critical roles (inspection, release authorization, corrective action management) who are developing their aviation quality knowledge, consider structured competency development beyond standard training courses. Mentoring from experienced aviation quality practitioners and on-site coaching during actual quality events build competency more effectively than classroom training alone — and they build the practitioner judgment that EASA EPAS 2026 identifies as the missing element in the current workforce challenge.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • Stratview Research — Aircraft MRO Market: Over 500 MRO Players in the USA, stratviewresearch.com
  • Fortune Business Insights — Aircraft Component MRO Market Size, Share and Growth 2025-2034 (North America 30.70% share), fortunebusinessinsights.com
  • Market Research Future — US Aircraft MRO Market Size, USD 10.82B (2025) to USD 16.79B (2034) at CAGR 5.0% (June 2025), marketresearchfuture.com
  • EASA — European Plan for Aviation Safety (EPAS) 2026 Addendum: Workforce Competency Strategic Priority, easa.europa.eu
  • AS9100 Rev D / EN 9100:2018 — Section 8.1.2: Configuration Management
  • SAE AS9102 — First Article Inspection Requirement
  • IAQG — IA9100 Key Change Summary: Sub-Tier Supplier Controls, iaqg.org

#SarasotaAviation #FloridaAviation #AviationQuality #MROQuality #SupplierQuality #SarasotaBusiness #TampaBay #Jacksonville #Miami #SKQC

Inspection vs. Process Control: The Fundamental Quality Debate That Still Gets Decided Wrong

Inspection vs. Process Control: The Fundamental Quality Debate That Still Gets Decided Wrong

admin

W. Edwards Deming articulated it in 1950: you cannot inspect quality into a product. The statement has been quoted at every quality conference for 75 years. It is cited in the opening paragraphs of quality management textbooks, referenced in ISO 9001 training materials, and repeated by quality professionals who then return to their organizations and invest primarily in inspection infrastructure.

The gap between knowing this principle and acting on it is one of the most persistent contradictions in industrial quality management. After 26 years working in aerospace, automotive, and composite manufacturing quality, I want to examine why the gap persists — and what the organizations that have actually closed it did differently.

1. Why Inspection Persists as the Primary Quality Response

The persistence of inspection-dominated quality systems is not irrational. It is a response to real organizational pressures that consistently outweigh the theoretical argument for prevention.

Inspection is visible and attributable. You can see the inspection department. You can count the inspectors. You can measure the defect detection rate and present it in a management review. When something goes wrong, you can point to the inspection system and ask why it did not catch the problem — and that question has a defensible answer. In organizations where quality budget decisions are made by leadership without manufacturing process experience, the inspection investment looks like quality assurance. The prevention investment looks like overhead.

Process control is invisible when it works. The investment in SPC, process FMEA, control plan maintenance, and operator competency produces an absence of defects — which is difficult to budget for, harder to defend in a cost reduction review, and essentially invisible to anyone who is not tracking the baseline from which improvement was achieved. The 1factory quality academy documented this challenge explicitly: in many organizations, Cpk and Ppk data exists at the manufacturing level but is not systematically used for process control decision-making at the management level.

Detection addresses yesterday’s problem immediately. When a customer calls with a quality failure, the first response is containment — find the affected parts, sort them, prevent further shipment. This is correct and necessary. The problem is that the urgency of the containment response consumes the resources and attention that should go to root cause analysis and process correction. The detection infrastructure deployed for containment remains in place because removing it creates visible risk before the process improvement that should replace it has been implemented and validated.

2. The Cost Structure Evidence

Armand Feigenbaum’s quality cost model — developed in the 1950s and validated across hundreds of industry applications since — establishes that defect prevention costs are typically 10-50 times lower than defect correction costs at the point of field failure, and 3-10 times lower than internal detection and rework costs. Feigenbaum identified four cost categories: prevention (process control, training, FMEA), appraisal (inspection, testing), internal failure (scrap, rework), and external failure (warranty, recall, liability).

In aerospace, the consequence structure makes the asymmetry more extreme than in most industries. The Datalyzer published analysis noted that „a Cpk of 4.00 — using only 25% of the spec width — resulted in 75% fewer warranty complaints“ for one automotive transmission manufacturer. The 1factory quality academy referenced the same case study. In aerospace, the consequence of a nonconformance that reaches an assembled aircraft — a fleet-wide inspection, a potential airworthiness directive, the reputational consequence of a safety event — makes the prevention investment argument overwhelming. Yet inspection-dominated quality systems persist throughout the aerospace supply base.

Paradygm’s analysis of IA9100 Clause 9.2 is relevant here: the new requirement elevates reviewing performance indicators from a note to a mandatory requirement during internal audits, „ensuring objective evaluation of QMS effectiveness.“ The shift from inspection-dominated to prevention-based quality is a Clause 9.2 auditable requirement under IA9100 — not just a management philosophy.

3. What Organizations That Have Made the Shift Did Differently

They quantified the cost of their current detection-based approach. Not in theory — in actual numbers. Total quality cost as a percentage of revenue: internal failure costs (rework, scrap, re-inspection), external failure costs (warranty, field service, customer concessions), and appraisal costs (inspection labour, testing equipment, incoming inspection). Industry benchmarks suggest that organizations with inspection-dominated quality systems typically have total quality costs of 10-20% of revenue. Organizations with mature prevention-based systems typically have total quality costs below 5%. The difference between those numbers, applied to your revenue, is the financial case for prevention investment.

They linked process control investment to specific failure modes. Rather than making a general argument for SPC and FMEA, they identified the three to five failure modes that were producing the most quality cost — not the most frequent failures, but the most costly — developed process control interventions targeted specifically at those failure modes, and measured the cost reduction achieved. The initial process control investment was narrow and measurable. It created organizational confidence in the approach before broader investment was requested.

They changed what first-line supervisors were accountable for. Process control requires supervisors to respond to control chart signals, stop processes drifting toward specification limits, and escalate conditions the process control system is detecting. That behavior requires supervisors measured on process stability indicators, not only on output volume and on-time delivery. Without changing the supervisor accountability structure — which is a management design decision, not a training outcome — process control documentation exists but is not acted on. This is Deming’s Point 12 („Remove barriers that rob people of pride of workmanship“) and Point 7 („Institute leadership“) in operational form.

3 Concrete Actions

1. Calculate your organization’s total quality cost — internal failure, external failure, and appraisal — as a percentage of revenue. If you have not done this calculation, it is worth doing before your next quality budget cycle. The calculation does not require specialist software — it requires cost accounting access and a half-day of time. The number it produces is the financial argument for prevention investment that resonates with leadership who think in financial terms rather than quality management terms.

2. Identify your top three failure modes by cost — not by frequency — and design process control interventions specifically for those failure modes. Frequency and cost are not the same measure. A failure mode that occurs rarely but produces significant scrap, rework, or customer impact may be a better target for process control investment than a failure mode that is frequent but cheap to address. The Feigenbaum model predicts that shifting investment from appraisal to prevention for your highest-cost failure modes will produce a measurable reduction in total quality cost within 12-18 months.

3. Review your first-line supervisor performance metrics. If supervisors are measured on output volume, on-time delivery, and labor efficiency — but not on process stability indicators, first-time quality rate, or SPC out-of-control response time — your process control system will never be fully implemented regardless of how good the technical documentation is. The accountability structure drives behavior. The behavior determines quality outcomes. Changing the accountability structure is the highest-leverage action available to organizations that want to shift from inspection-dominated to prevention-based quality systems.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • Deming, W.E. — Out of the Crisis (1986), MIT Press. 14 Points for Management: foundational reference for prevention-based quality thinking.
  • Feigenbaum, A.V. — Total Quality Control (1951/1983), McGraw-Hill. Quality cost model: prevention, appraisal, internal failure, external failure.
  • 1factory — A Guide to Process Capability (Cp, Cpk) and Process Performance (Pp, Ppk): 75% Fewer Warranty Complaints Case Study, 1factory.com
  • Datalyzer — Process Capabilities Explained: Cp, Cpk, Pp and Ppk (August 20, 2025), datalyzer.com
  • Paradygm — IA9100 Clause 9.2: Performance Indicators Now Mandatory in Internal Audits, paradygm.co
  • AIAG — Statistical Process Control (SPC) Reference Manual, 2nd Edition. Automotive Industry Action Group.
  • ISO 9001:2015 — Section 9.1: Monitoring, Measurement, Analysis and Evaluation
  • EN 9100:2018 / AS9100 Rev D — Section 9.1: Monitoring, Measurement, Analysis and Evaluation

#QualityManagement #ProcessControl #Manufacturing #SPC #InspectionVsPrevention #Deming #Feigenbaum #SupplierQuality #SKQC

AQAP 2110 vs. EN 9100: Defence Quality Requirements and What They Mean for Dual-Use Suppliers

AQAP 2110 vs. EN 9100: Defence Quality Requirements and What They Mean for Dual-Use Suppliers

admin

Global military expenditure reached USD 2,887 billion in 2025 — an increase of 2.9% in real terms over 2024 and the 11th consecutive year of increases, according to SIPRI’s April 27, 2026 publication on world military expenditure trends. Europe was the main driver, with spending rising 14% to USD 864 billion. According to NATO Secretary General Rutte’s annual report on March 26, 2026, European allies and Canada collectively invested USD 574 billion in defence in 2025 — a 20% real increase from 2024 — while the United States contributed USD 838 billion, bringing total NATO allied defence spend to over USD 1.4 trillion. For the first time, all 32 NATO member states met or exceeded the 2% GDP target. The NATO Hague Summit in June 2025 committed members to a new 5% of GDP target by 2035.

Germany was the largest military spender among European NATO members, with expenditure growing 24% year-on-year to USD 114 billion — exceeding 2% of GDP for the first time since 1990. Spain’s military spending jumped 50% to USD 40.2 billion. The supply base that has historically served civil aerospace is being actively recruited to qualify for defence programs, and that qualification carries quality management requirements that go significantly beyond EN 9100.

1. The Common Foundation and Where It Ends

AQAP 2110 — NATO Allied Quality Assurance Publication 2110, Edition 4 — is the NATO standardization agreement governing quality assurance requirements for design, development, and production in the defence context. Like EN 9100 / AS9100, it is built on ISO 9001. Like EN 9100, it requires documented quality management systems, risk-based thinking, configuration management, and supplier oversight. An organization certified to EN 9100 has a significant head start on AQAP 2110 compliance. But the gap is not in the quality system requirements themselves — it is in the oversight model, the documentation depth, and the consequence structure that applies when findings are identified.

2. Three Structural Differences That Matter

Government Quality Assurance

AQAP 2110 includes provisions for Government Quality Assurance — direct oversight by a national defence quality authority. In the United States: DCMA (Defense Contract Management Agency), which conducts approximately 1.8 million oversight actions per year across the U.S. defence industrial base. In Germany: BAAINBw (Federal Office of Bundeswehr Equipment, Information Technology and In-Service Support). In the United Kingdom: DSTL. In France: DGA.

GQA is not a customer audit. It is regulatory oversight with independent authority and independent consequence. A GQA representative can issue findings that affect contract status, payment authorization, and — in extreme cases — suspension of approval to supply. They operate under their own authority derived from the contract and from NATO STANAG requirements. For organizations that have only experienced commercial customer audits, GQA oversight is a qualitatively different engagement. The records need to be complete, retrievable, and self-explanatory without a quality manager present to provide context — because the GQA representative may arrive without advance notice.

Configuration Management Documentation Depth

Defence programs operate on longer product lifecycles than most civil aerospace programs — 30-50 years is not uncommon for major platform programs. The Eurofighter Typhoon entered service in 2003 and is expected to operate into the 2040s. The configuration management requirements reflect this: the expectation is that the delivered product is traceable to its design baseline with full documentation of every authorized change, and that this traceability can be demonstrated years or decades after delivery.

For suppliers transitioning from civil to defence qualification, the configuration management gap is frequently underestimated. A civil aerospace configuration management system adequate for a 20-year product lifecycle — with OEM support periods that define record retention requirements — may be structurally inadequate for a 40-year defence lifecycle requirement. The differences are not in the principle but in the depth, the retention period, and the format requirements for configuration status accounting records.

Key Characteristics and Critical Safety Items

The identification, control, and traceability of Key Characteristics and Critical Safety Items in AQAP 2110 programs is more explicit and more auditable than the equivalent requirements in EN 9100. KCs must be identified in design documentation, flowed down to production planning, verified through First Article Inspection, controlled through SPC or equivalent process controls in production, and traceable through the product record to the specific serial number of every delivered item.

A GQA auditor reviewing KC controls will ask to see the specific measurement data for each KC on each delivered item — not a summary of process capability, but the individual measurement values that demonstrate the specific parts delivered conform to KC requirements. This requires a product record structure that links KCs to individual serial numbers with specific measurement data. Most EN 9100 quality systems generate process capability summaries. Defence programs require individual part traceability. Bridging that gap requires a deliberate change to the production record structure, not just an update to the quality plan.

3. Export Control Integration

Defence programs involve Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) in the U.S. context, and equivalent export control frameworks in European member states — BAFA oversight in Germany, DGA export authorization in France, ECJU in the UK. Suppliers qualifying for defence programs need to understand which of their products and technical data are controlled, implement access controls for controlled technical data, and comply with end-use verification requirements when exporting controlled items or technical data.

Quality Magazine’s January 2026 analysis of the IA9100/IATF 16949/CMMC convergence noted explicitly: „Begin updating supplier quality agreements to anticipate cyber and export-control clauses.“ For suppliers pursuing dual civil/defence qualification, export control compliance is a current qualification requirement — not future planning. The integration of export control processes into the QMS is a requirement that GQA auditors will assess against documented procedures, training records, and access control evidence.

3 Concrete Actions

1. Before pursuing AQAP 2110 qualification, conduct a gap analysis specifically against the three areas described above: GQA preparation and record management practices, configuration management depth and retention period against a 30-50 year lifecycle requirement, and KC/CSI traceability to individual delivered serial numbers with specific measurement data. These gaps are not visible in a standard EN 9100 gap analysis because the EN 9100 requirements, while related, do not require the same depth. Use AQAP 2110 Edition 4 as your reference, not your existing EN 9100 gap analysis.

2. Engage your national defence quality authority early in the qualification process. In Germany, BAAINBw provides supplier engagement mechanisms for organizations entering the defence supply base. In the U.S., DCMA has pre-award survey processes. The Atlantic Council’s April 2026 NATO Defence Spending Tracker confirmed that all NATO members are now increasing defence procurement — meaning national defence quality authorities are under growing demand. Engaging early gives you access to guidance and expectations that reading the standard alone cannot provide.

3. Review your export control compliance programme against the requirements for defence suppliers specifically. If your current EAR/ITAR or national equivalent compliance is limited to a classification list maintained by your legal department with no QMS integration, you have a gap that will be identified in the first GQA audit of your document control processes. The standard requirement: documented procedures for controlled technical data access management, training records demonstrating personnel awareness, and access control evidence for controlled information systems. Export control compliance for defence suppliers is a QMS requirement — not only a legal one.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • SIPRI — Trends in World Military Expenditure 2025 (April 27, 2026), sipri.org
  • SIPRI — Global Military Spending Rise Continues as European and Asian Expenditures Surge (April 27, 2026), sipri.org
  • NATO — Secretary General Rutte Annual Report (March 26, 2026): All 32 Members Exceed 2% GDP, nato.int
  • Atlantic Council — NATO Defence Spending Tracker (last updated April 9, 2026), atlanticcouncil.org
  • CNBC — Europe’s Rearmament Push Drives Global Military Spending (April 27, 2026), cnbc.com
  • The Global Statistics — NATO Budget by Country Statistics 2026 (April 13, 2026), theglobalstatistics.com
  • Quality Magazine — ISO 9001 in 2026: How AS9100 (IA9100), IATF 16949, NIST and CMMC Fit Together (January 8, 2026), qualitymag.com
  • AQAP 2110 — NATO Allied Quality Assurance Publication 2110, Edition 4
  • NATO STANAG 4107 — Mutual Acceptance of Government Quality Assurance

#AQAP2110 #EN9100 #DefenceQuality #AerospaceQuality #SupplierQuality #NATO #DCMA #BAAINBw #SIPRI #SKQC

Quality Management in the Solar Industry: Lessons From 26 Years in Aerospace and Automotive

Quality Management in the Solar Industry: Lessons From 26 Years in Aerospace and Automotive

admin

The solar industry is approximately 20 years behind aerospace in quality infrastructure. That is not a criticism — it is a structural observation rooted in how the two industries were regulated and funded in their formative decades. Aerospace has had airworthiness regulation driving quality discipline since the 1950s: you could not sell a component to a commercial aircraft manufacturer without demonstrating process control to a regulatory standard. Solar PV manufacturing was driven by cost-per-watt reduction and volume deployment. The optimization function was economic, not safety-driven. Different forces, different outcomes.

The data makes the gap visible. Kiwa PVEL’s 2025 PV Module Reliability Scorecard — the industry’s most comprehensive independent reliability testing programme, now in its 11th edition — reported that 83% of module manufacturers and 59% of bills of materials tested had at least one test failure. This is up from 66% of manufacturers and 41% of BOMs in the 2024 Scorecard. The trend line across five annual scorecards is consistently worsening, not improving. IEA confirmed in its Global Energy Review 2026 that 698 GWp of solar PV was added globally in 2025 — the largest single-year expansion of any electricity generation technology in recorded history — bringing cumulative installed capacity to approximately 2,974 GW.

The solar industry is installing at unprecedented speed. It is qualifying products at insufficient depth. That gap accrues over a 25-year performance guarantee horizon, not a 12-month warranty period.

1. The Quality Infrastructure Gap Is Getting Worse, Not Better

The Kiwa PVEL 2025 Scorecard failure data is specific. Visual inspection major defects accounted for 60% of all failures. Power degradation failures accounted for 21%. Module breakage during Mechanical Stress Sequence testing rose sharply — from a BOM-level failure rate of 7% in 2023 and 2024 to significantly higher levels in 2025, with 40% of manufacturers experiencing at least one MSS failure. Junction box failures appeared in all six consecutive scorecards: 11% of manufacturers had covers falling off, 8% had loose cables or exposed wires, 8% had bypass diode failures.

Kiwa PVEL identified the proximate cause in its 2025 analysis: rapid innovation in cell technology (TOPCon replacing PERC, HJT emerging) combined with aggressive cost reduction is producing new product designs released to production before reliability validation is complete. In July 2025, the Chinese Ministry of Industry and Information Technology convened leading solar manufacturers — including LONGi, JA Solar, Trina, and Tongwei — explicitly urging them to end „disorderly low-price competition“ and improve product quality. The Chinese government identified product quality deterioration as a direct consequence of price competition that had driven module prices to approximately USD 0.10/Watt — a 45% reduction year-on-year. Following the meeting, polysilicon prices climbed nearly 30% from June lows.

NREL has explicitly noted that IEC 61215 is designed to identify early failures in the first 5-10 years — insufficient for assessing long-term risk or establishing field performance degradation over a 25-year service life. The standard itself acknowledges its limitation. The industry has been slower to act on it.

2. The Methods That Transfer Directly

Advanced Product Quality Planning (APQP)

APQP is the automotive manufacturing industry’s framework for ensuring that product design, process design, and quality planning are completed before production begins. Quality Magazine noted in its June 2025 IA9100 analysis that „customers — particularly primes like Boeing, Airbus, and Lockheed Martin — are increasingly demanding APQP evidence during contract award and oversight activities.“ Under IA9100:2026, APQP and PPAP become officially required tools supported by IA9145 guidance.

The core APQP discipline: you do not release a product to full production volume until you have validated that the production process — not the prototype process — can consistently produce product that meets specification. For solar manufacturing, the equivalent APQP would require that before any new cell technology is released to high-volume production, the manufacturer demonstrates process capability for all critical characteristics across multiple production lots, equipment performance stability at the production throughput target, BOM qualification for all new component inputs, and reliability testing results sufficient to predict long-term field performance with defined confidence.

This does not happen systematically in the solar industry today. The Kiwa PVEL Scorecard trend line — consistently worsening failure rates — is the measurable consequence.

Control Plans and Process FMEA

A control plan defines, for each step in the production process, what characteristics are being controlled, how they are measured, the measurement frequency, and the response plan when a measurement falls outside the control limits. In automotive production of safety-critical components, control plans are mandatory PPAP deliverables audited by customer quality teams as standard qualification activity.

In solar module production, the equivalent — a documented process control plan covering lamination cure temperature, encapsulant application uniformity, junction box sealing integrity, and final module electrical parameters — is present at some manufacturers and absent at many others. Its absence does not prevent IEC 61215 certification. It does predict the failure modes appearing in the Kiwa PVEL Scorecard. Process FMEA on lamination and junction box assembly processes, using AIAG-VDA FMEA methodology, would identify these failure modes before they appear in field data. The failure modes are not new — they have appeared in six consecutive annual reliability reports. What is missing is the systematic process-level analysis that should have addressed them.

Supplier Quality Agreements with Process Audit Requirements

In automotive and aerospace, supplier qualification requires a process audit — not just incoming test data and type approval. The question is whether the supplier’s process is stable enough to consistently produce material within specification across production lots, across equipment generations, and across operator changes. In solar manufacturing, cell, encapsulant, backsheet, and junction box suppliers are frequently qualified on the basis of type approval and incoming test data. The junction box pottant cure failures that persist across six Kiwa PVEL Scorecards are the predictable outcome of this gap.

3 Concrete Actions

1. For utility-scale solar developers and asset owners: build process audit rights into your module procurement agreements as a standard contractual requirement. The right to audit the lamination process, junction box assembly, and incoming material qualification is the minimum condition for making a credible 25-year performance claim. This requirement is absent from IEC 61215 and IEC 61730 — it will not exist unless you specify it contractually and enforce it.

2. For module manufacturers seeking to differentiate on quality: commission a process FMEA on your lamination and junction box assembly processes using AIAG-VDA FMEA methodology. The failure modes appearing in six consecutive Kiwa PVEL Scorecards are your starting point — they are documented, industry-visible, and addressable. The output is a control plan that addresses those failure modes at the process level rather than the output inspection level.

3. For solar project financiers and insurance underwriters evaluating module quality risk: request Kiwa PVEL PQP test data for the specific BOM being specified in the project — not the manufacturer’s Top Performer designation. Kiwa PVEL explicitly cautions buyers not to use the scorecard as a shopping list. Top Performer status means the manufacturer had at least one BOM that achieved top performance in a given test category. It does not mean every BOM from that manufacturer performs equivalently. The specific BOM test data is the relevant risk information.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • IEA — Global Energy Review 2026: Technology Solar PV and Wind (May 2026), iea.org
  • Kiwa PVEL — 2025 PV Module Reliability Scorecard, 11th Edition (June 2025), pvel.com
  • Kiwa PVEL Scorecard — Failures in Testing: Visual, MSS, HSS, Junction Box (scorecard.pvel.com)
  • TaiYang News — Test Failures Surge in Kiwa PVEL’s 2025 Module Reliability Scorecard (June 2025), taiyangnews.com
  • NREL — IEC 61215 Qualification Tests vs Outdoor Performance, nrel.gov
  • Quality Magazine — A Deeper Dive into Aero Quality: APQP Evidence Demanded by Boeing, Airbus, Lockheed Martin (June 2025), qualitymag.com
  • Cavendish Scott — IA9100: APQP and PPAP Officially Required Tools (October 2025), cavendishscott.com
  • AIAG-VDA — FMEA Handbook, 1st Edition (2019). Automotive Industry Action Group.
  • IEC 61215 — Terrestrial Photovoltaic (PV) Modules: Design Qualification and Type Approval
  • IEC 61730 — Photovoltaic (PV) Module Safety Qualification

#SolarQuality #RenewableEnergy #QualityManagement #ProcessControl #SupplierAudit #PVManufacturing #APQP #KiwaPVEL #SKQC

Additive Manufacturing Quality in Aerospace: What AS9100 Does Not Yet Cover

Additive Manufacturing Quality in Aerospace: What AS9100 Does Not Yet Cover

admin

Metal additive manufacturing — laser powder bed fusion, directed energy deposition, binder jetting — is transitioning from aerospace R&D programs into production qualification. The technology is in production. The global additive manufacturing market in aerospace was valued at USD 3.1 billion in 2023 and is projected to reach USD 6.5 billion by 2028, according to MarketsandMarkets. The FAA issued a Special Conditions notice in 2023 specifically addressing LPBF titanium structural components for commercial aircraft. The U.S. Air Force has awarded multiple production contracts for AM components. The quality management framework has not kept pace.

AS9100 Rev D and EN 9100:2018 were developed around conventional manufacturing: machining, forming, casting, joining, composite layup. The process control concepts embedded in those standards map cleanly onto processes where the part is built incrementally through identifiable manufacturing steps and is accessible for measurement at multiple stages. Additive manufacturing produces a part in a single continuous process. The „in-process inspection“ is largely replaced by process parameter monitoring. The final part surface conceals the internal build quality. And the relationship between process parameters and mechanical properties is governed by a process specification that may be proprietary to the machine manufacturer, validated for a specific alloy and machine configuration, and not transferable without revalidation.

1. Where AS9100 and EN 9100 Are Insufficient for AM

Feedstock Powder Qualification

Feedstock qualification in laser powder bed fusion is not equivalent to raw material qualification for conventional processes. The requirements are more stringent and the failure modes are different. Particle size distribution affects powder flowability and packing density in the build chamber, which affects local porosity in the finished part. Morphology — the shape regularity of individual powder particles — affects melting behavior and solidification microstructure. Moisture content affects the protective gas atmosphere and can produce oxide inclusions. Satellite formation — small particles attached to larger ones — affects powder flow and can cause local defects.

None of these characteristics is captured by a standard raw material certificate for an alloy specification. SAE International’s AMS7000-series specifications for LPBF processing — including AMS7003 (Ti-6Al-4V) and AMS7004 (Ti-6Al-4V ELI) — address process-specific powder requirements that go significantly beyond alloy composition certification. A material certificate confirming that the powder meets the chemical composition requirements of AMS 4999 does not confirm that the powder is processable in a specific LPBF machine to produce parts with the required mechanical properties.

AS9100 Section 8.4 requires verification that externally provided processes meet requirements. It does not define what the requirements should be for AM feedstock, because those requirements did not exist in standardized form when AS9100 Rev D was written in 2016. Organizations doing this correctly have developed internal specifications that reference AMS7000-series requirements and include powder lot testing protocols beyond what the standard requires.

Build Parameter Validation and Change Control

The approved process in additive manufacturing is the build parameter set: laser power, scan speed, layer thickness, hatch spacing, atmosphere control, pre-heat temperature, and post-processing specifications (HIP, heat treatment, surface finishing). Changes to any of these parameters are effectively a process change requiring revalidation.

In machining, a change from one cutting insert specification to an equivalent is a minor change validatable through dimensional measurement. In LPBF, a change in laser power by 5% can alter porosity content, grain structure, and fatigue properties in ways that are not visible in dimensional inspection and may not appear in standard tensile testing — but will manifest in fatigue life at operational stress levels. ASTM Committee F42 on Additive Manufacturing Technologies has been developing process and material standards specifically to address this challenge, including ASTM F3001 (Ti-6Al-4V LPBF) and the F42 process qualification framework.

The AS9100 Rev D requirement for process change notification exists. The standard does not define the re-qualification evidence required specifically for AM parameter changes, because that evidence requirement is technology-specific in a way that the general language of the standard cannot capture. IA9100 is expected to strengthen digitalization and data integrity requirements — which will push AM suppliers toward more structured build parameter documentation — but AM-specific change control requirements will remain in supplemental specifications for the foreseeable future.

Non-Destructive Evaluation for Internal Build Quality

Conventional NDT methods — ultrasonic inspection, radiographic testing, eddy current — apply to AM parts with significant limitations. The internal geometry of AM parts — complex internal channels, lattice structures, thin walls — creates inspection access challenges that do not exist in solid machined parts. The anisotropic microstructure produced by directional solidification in LPBF creates signal interpretation challenges for ultrasonic inspection that require technique development specific to the material-process-part geometry combination.

X-ray computed tomography is the most capable inspection method for AM parts, capable of characterizing internal porosity, detecting lack-of-fusion defects, and measuring internal feature dimensions inaccessible to conventional probing. The FAA’s guidance on AM part approval under the Part 21 type certification framework specifically references CT as a validation tool for internal geometry conformance. However, CT inspection is time and cost intensive, and it is not established as a standard production inspection method in most aerospace supply chains. The accept/reject criteria for defect types and sizes, and the relationship between inspection findings and fatigue life, require engineering judgment and material characterization data that most AM suppliers in the mid-market do not yet have at the depth required for flight-critical component production.

2. What the Industry Is Doing to Address the Gap

Three parallel standardization tracks are active:

SAE International has published the AMS7000-series for LPBF processing of specific alloys, providing process-specific material specifications that go beyond alloy composition. ASTM Committee F42 has published more than 40 standards addressing AM materials, processes, and testing, with the F3001 family covering titanium LPBF specifically. The FAA has published guidance material (Issue Paper and Special Conditions) for AM part approval under Part 21 type certification, establishing a regulatory pathway that did not exist five years ago.

These documents are necessary and valuable. They are also newer than the qualification programmes of the AM suppliers currently working in aerospace production, and they do not yet represent a complete, harmonized framework that an AS9100 auditor can audit against with the rigor applicable to conventional manufacturing processes.

3 Concrete Actions

1. If you are qualifying an AM supplier for aerospace production parts: develop an additive manufacturing quality requirements supplement to your standard supplier quality requirements. The supplement must specifically address: feedstock powder qualification requirements referenced to AMS7000-series or equivalent (not just alloy specification compliance), build parameter documentation and change control requirements with re-qualification trigger criteria, post-process traceability (HIP cycle, heat treatment, surface finishing documentation linked to specific build serial numbers), and inspection method requirements with specific accept/reject criteria for defect types. Do not rely on your standard supplier quality agreement — it was not written for AM.

2. For AM suppliers seeking aerospace qualification: invest in developing your own internal AM process specifications before your first qualification audit. The aerospace customer will ask to see your feedstock specification, your build parameter control procedure, and your change management process for parameter modifications. If those documents do not exist, the qualification audit will identify their absence as a major finding. If they exist but reference only the machine manufacturer’s general operating guidelines without process-specific validation data, they will be assessed as inadequate for production qualification of safety-critical parts.

3. For quality managers with existing AM suppliers: verify whether your current supplier qualification was conducted under AM-specific requirements or under your standard supplier quality process. Most early AM qualifications in aerospace were conducted under standard processes because the AM-specific requirements — SAE AMS7000 series, ASTM F42 process standards, FAA AM guidance — had not yet been developed or were not incorporated into supplier qualification criteria. A qualification audit that did not examine feedstock qualification depth, build parameter change control, and AM-specific NDE methodology is incomplete by current standards and warrants a targeted re-audit of those specific areas.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • MarketsandMarkets — Additive Manufacturing in Aerospace and Defense Market: USD 3.1B (2023) to USD 6.5B (2028)
  • SAE International — AMS7003: Titanium Alloy Powder, Ti-6Al-4V, for Additive Manufacturing
  • SAE International — AMS7000 Series: Laser Powder Bed Fusion Process Specifications
  • ASTM International — F3001: Standard Specification for Additive Manufacturing Titanium-6 Aluminum-4 Vanadium (Ti-6Al-4V) with Powder Bed Fusion
  • ASTM Committee F42 — Standard Specifications and Practices for Additive Manufacturing, astm.org
  • FAA — Special Conditions: Laser Powder Bed Fusion Titanium Structural Components (2023)
  • FAA Advisory Circular on Additive Manufacturing Part Approval under Part 21 Type Certification
  • AS9100 Rev D / EN 9100:2018 — Section 8.4: Control of Externally Provided Processes and Section 8.5: Production and Service Provision

#AdditiveManufacturing #AerospaceQuality #AS9100 #QualityManagement #LPBF #MetalAM #SupplierQuality #SAE #ASTM #SKQC

Non-Conformance Management: Why Most 8D Reports Fail to Prevent Recurrence

Non-Conformance Management: Why Most 8D Reports Fail to Prevent Recurrence

admin

In over 26 years of supplier quality work, I have reviewed several thousand 8D reports. A significant proportion were well-structured, clearly written, and factually correct about the technical root cause. A smaller proportion actually prevented recurrence. The gap between those two groups is not a documentation quality problem. It is a structural issue in how corrective action processes are designed and managed — and IA9100 is about to make that structural issue a formal audit criterion.

The 8D methodology is sound. Applied correctly, it is one of the most effective problem-solving frameworks in manufacturing quality. The problem is that it is frequently applied in a way that optimizes for closing the customer complaint rather than eliminating the failure mode — and those are not the same objective.

1. Root Cause at the Wrong Level

Most 8D reports identify the technical root cause correctly. The machine was miscalibrated. The operator used the wrong revision of the setup sheet. The material was out of specification. The measurement system was not capable of detecting the defect at the inspection frequency specified in the control plan.

What they rarely identify is the systemic root cause — why the miscalibration was not detected before production ran, why the wrong revision was accessible on the shop floor, why out-of-specification material entered the production process, why the measurement system deficiency was not identified during PPAP or subsequent SPC monitoring.

Technical root cause without systemic root cause produces a corrective action that addresses one instance of the problem, not the conditions that produced it. The machine is recalibrated. The correct revision is reinstated. The out-of-specification material lot is rejected. None of these actions addresses why the system that should have prevented the failure did not prevent it.

The 5 Why technique is the standard tool for reaching systemic root cause. In practice, it is frequently stopped at the first or second Why. „Why did the machine miscalibrate?“ often has a technical answer. „Why did the calibration schedule not prevent this from reaching production?“ often has a systemic answer that implicates the calibration management process, the maintenance priority system, or the staffing level in the calibration department. IA9100’s human factors RCA requirement will add a third dimension: „Why did the operator continue production without escalating when the process parameter drifted?“ — which often has an organizational answer about time pressure, escalation culture, and shift supervisor accountability.

2. Corrective Actions Without Effectiveness Verification

D7 — prevent recurrence — is the most important step in the 8D. It is also the step most frequently completed with a training record and a procedure update. Neither of those actions verifies that the root cause condition has been eliminated.

Training records confirm attendance. They do not confirm understanding, retention, or behavioral change. A procedure update confirms that the documented process was revised. It does not confirm that production personnel know about the revision or are following it. A procedure update without controlled distribution, operator briefing, and verification of implementation is documentation that the organization knows what they should do — not evidence that they are doing it.

The AIAG PPAP Reference Manual establishes that initial process capability studies require measurement data demonstrating the process can perform to specification. The same principle applies to corrective action effectiveness — the evidence of effectiveness is measurement data showing the process now performs differently from how it performed when the failure occurred. Not a statement that the corrective action was implemented. Not a procedure update acknowledgment. Measurement data that shows the effect of the corrective action on the process output.

AMREPinspect’s December 2025 analysis of Cpk versus Ppk made the relevant technical point: „Cpk of 1.67 short-term but Ppk of 1.11 long-term indicates instability.“ The same logic applies to corrective action effectiveness: a process that measures correctly in the week after corrective action implementation but drifts back within three months did not have an effective corrective action — it had a temporary improvement. Effectiveness verification at 90 days, using measurement data, is the standard that separates sustained improvement from temporary compliance.

3. Lessons Learned That Stay in the Report

The most valuable output of a corrective action process is the transfer of learning to similar processes and similar parts where the same failure mode could occur but has not yet produced a customer complaint. This almost never happens systematically.

The knowledge produced by a well-executed 8D lives in the 8D report, which lives in a folder, which is opened at the next customer audit and otherwise not referenced. The technician who executed the repair and learned from the failure returns to production. The organizational system does not capture or transfer that learning.

Quality Magazine’s May 2026 analysis of the IAQG’s direction under IA9100 noted that the standard is moving toward a „dual-track approach“ for continuous improvement that includes both corrective action and systemic learning. The organization-level expectation is that audit findings and nonconformance data actively inform strategic decision-making — not just close individual problem cycles. Implementing a lessons learned extension step in your corrective action process is preparation for that expectation.

4. The Audit Lens: Questions That Reveal Corrective Action Process Maturity

When reviewing a supplier’s 8D history during a second party audit, the questions that reveal corrective action process maturity are not about the quality of individual reports. They are about the system:

What is the recurrence rate for failure modes that have had closed 8D reports in the last two years? If the recurrence rate is above 20%, the corrective action process is not preventing recurrence systematically. What evidence is required before a corrective action is considered closed — a procedure update, or measurement data? What is the process for applying lessons learned to adjacent processes and part families?

A supplier who can answer these questions with specific procedures and data is operating a mature corrective action process. A supplier who answers with „our quality manager reviews all 8D reports before closure“ is operating a document approval process, not a corrective action process.

3 Concrete Actions

1. Add a systemic root cause requirement to your supplier corrective action process. Require that the 8D response address not only the technical root cause (what failed) but also the specific system failure that allowed the technical root cause to produce a nonconformance (why the existing controls did not prevent or detect the failure). A SCAR response that does not address the system level is incomplete regardless of technical accuracy. This closes 80% of the gap between corrective actions that look good on paper and corrective actions that actually prevent recurrence.

2. Establish a mandatory effectiveness verification step with specific evidence requirements. The evidence standard: measurement data from at least 25 production units produced after corrective action implementation, showing the characteristic in question is within specification and demonstrating process capability improvement from the pre-corrective-action baseline. No data, no closure. This is the same standard the AIAG PPAP process applies to initial qualification — it should apply to re-qualification after a quality failure as well.

3. Implement a lessons learned extension step in your corrective action process. Require the 8D team to identify at least two adjacent processes or part families where the same failure mode could occur, evaluate whether the corrective action applies to those areas, and document the result. If the corrective action applies, document that it was implemented. If it does not apply, document why. This step converts individual corrective actions into systematic process improvement and will satisfy the IA9100 expectation for systemic learning from nonconformances before the standard publishes.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • AIAG — Production Part Approval Process (PPAP) Reference Manual, 4th Edition. Automotive Industry Action Group.
  • AIAG — Advanced Product Quality Planning (APQP) Reference Manual. Automotive Industry Action Group.
  • AMREPinspect — Ppk vs Cpk: Understand Process Capability with Clear Formulas and Examples (December 27, 2025), amrepinspect.com
  • Quality Magazine — Driving Change in Aerospace Quality Management (May 2026), qualitymag.com
  • IAQG — IA9100 Key Change Summary: Human Factors in Root Cause Analysis, iaqg.org
  • QT9 Software — IA9100 is Coming: Key Updates for Aerospace and Defense (October 23, 2025), qt9software.com
  • Paradygm — IA9100 Clause 10.3: Continual Improvement — Periodic QMS Maturity Assessment Now Mandatory, paradygm.co
  • EN 9100:2018 / AS9100 Rev D — Section 10.2: Nonconformity and Corrective Action

#8DReport #NonConformance #QualityManagement #CorrectiveAction #SupplierQuality #ProcessImprovement #IA9100 #SKQC