Uncategorized

EU AI Act Article 17: The Quality Management System Requirement That Aerospace Suppliers Are Missing

admin

August 2, 2026: the EU AI Act became enforceable for high-risk AI systems and general-purpose AI models. Article 17 of the Act requires providers of high-risk AI systems to establish and document a quality management system. This is not a cybersecurity requirement or a data protection requirement — it is a quality management requirement that uses the same language, the same concepts, and much of the same structure as ISO 9001 and the sector standards built on it.

For aerospace quality managers, there are two distinct questions. The first: does your organization provide high-risk AI systems under the Act’s definition? The second — and the one most organizations are not asking yet: do your suppliers? Annex III of the EU AI Act lists categories of high-risk AI systems. Category 8 — AI used in safety components of products covered by harmonized EU legislation — explicitly covers machinery, aviation, automotive, and defense product categories. AI used in quality inspection, predictive maintenance, automated defect detection, or process control in aerospace production may qualify as a high-risk system under this definition, regardless of whether the organization deploying it considers itself an „AI company.“

1. What prEN 18286 Requires — The QMS Standard for the AI Act

CEN and CENELEC published the first draft AI Act QMS standard — prEN 18286:2025 — for public consultation in late 2025. Compliance Week confirmed in its January 2026 analysis: „This is a landmark step forward for artificial intelligence governance and regulation, and compliance managers should prepare for it to be finalized and published by the end of 2026.“ The CMS Law analysis of prEN 18286 was specific about its integration potential: „The requirements can be built into existing sector quality systems such as medical devices or automotive rather than creating a new standalone QMS, provided those systems are updated to incorporate all of this standard’s controls.“

The standard’s QMS requirements are recognizable to anyone who works with ISO 9001 or AS9100. The VDE April 2026 analysis confirmed the parallel: „The QMS must cover design and development controls, including verification, validation, and change management procedures, particularly for continuously learning systems where predetermined changes must be documented and controlled. It requires the establishment of data governance processes for acquisition, labeling, storage, analysis, and retention.“

The supplier management requirements in prEN 18286 — Clause 9.2, requiring supplier competence assessment, security-by-design evaluation, and vulnerability disclosure procedures — map directly onto IA9100’s sub-tier control requirements and EASA 2023/203’s third-party information security requirements. These are the same organizational requirements appearing in three regulatory frameworks simultaneously.

2. The Supplier Qualification Dimension

The aerospace supplier qualification question created by the EU AI Act is specific: if a supplier uses AI in a quality-critical process — automated dimensional inspection, surface defect detection, material identification, predictive process control — does that AI system qualify as high-risk under Annex III? And if so, does the supplier have a documented QMS consistent with Article 17 and prEN 18286 for that system?

Most aerospace supplier qualification processes do not currently ask this question. Standard AS9100 audits do not systematically assess AI system compliance. Second-party audits focused on production process capability do not typically examine the QMS documentation for automated inspection systems. The gap is structural: aerospace supplier qualification was designed before AI systems became operational in aerospace manufacturing at scale, and it has not been updated to reflect the regulatory requirements that AI deployment now triggers.

3. The „Quality“ Reframing in prEN 18286

One aspect of prEN 18286 that the CMS Law analysis highlighted deserves specific attention: „‚Quality‘ is expressly reframed around regulatory compliance and protection of health, safety and fundamental rights, rather than customer satisfaction.“ This reframing matters for aerospace quality managers because it aligns the AI Act’s QMS concept with the safety-oriented quality management framework that aerospace already operates under. An aerospace QMS built around EN 9100 / IA9100 already frames quality in terms of safety and regulatory compliance — the conceptual alignment with prEN 18286 is strong.

3 Concrete Actions

1. Conduct an AI system inventory for your own organization and your critical suppliers. The inventory should identify all AI systems used in quality-critical processes — inspection, defect detection, process control, predictive maintenance — and assess whether each system potentially qualifies as high-risk under EU AI Act Annex III Category 8. This is a scoping exercise, not a compliance audit, and it can be conducted as part of a standard supplier audit using a structured questionnaire.

2. For suppliers who use AI in quality-critical processes and whose systems may qualify as high-risk: add EU AI Act QMS documentation to your supplier quality agreement requirements. The requirement should specify that the supplier maintains documented design and development controls, post-market monitoring procedures, and incident reporting processes for any high-risk AI system used in the production of your parts. This requirement can be integrated into the existing cybersecurity clause described in the September 17 post in this series.

3. Monitor prEN 18286 publication — expected end of 2026 — and plan to assess your existing QMS against its requirements when the final text publishes. The assessment will likely reveal strong alignment with your existing IA9100 or EN 9100 quality system in most areas, with specific gaps in AI-specific areas (data governance, continuous learning system controls, post-market AI monitoring). Closing those gaps before the first regulatory enforcement actions under the AI Act produces better outcomes than addressing them reactively.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • European Parliament and Council — Regulation (EU) 2024/1689 (EU AI Act), Articles 17 and Annex III, eur-lex.europa.eu
  • CEN/CENELEC — prEN 18286:2025: Quality Management System for EU AI Act Regulatory Purposes (public consultation draft)
  • Compliance Week — First Standard for EU AI Act Targets Quality Management Regime (January 7, 2026), complianceweek.com
  • CMS Law — The First Draft AI Act Standard for Public Consultation: What prEN 18286 Signals (December 12, 2025), cms.law
  • VDE — EU AI Act: Quality Management System (April 10, 2026), vde.com
  • Legal Nodes — EU AI Act 2026 Updates: Compliance Requirements and Business Risks (April 10, 2026), legalnodes.com
  • IAQG — IA9100 Key Change Summary: Cybersecurity and Quality Culture, iaqg.org

#EUAIAct #AIQualityManagement #HighRiskAI #prEN18286 #AerospaceQuality #SupplierQuality #QualityManagement #SKQC

EASA Cybersecurity Regulation 2023/203: What Part 145 and Part 21 Organizations Must Have in Place Now

EASA Cybersecurity Regulation 2023/203: What Part 145 and Part 21 Organizations Must Have in Place Now

admin

EASA Implementing Regulation 2023/203 — Part IS CA — has been active since January 2023. Its November 2025 amendment extended Information Security Management System (ISMS) requirements beyond formally approved organizations to organizations operating under declaration — broadening the scope to include a significantly larger population of maintenance organizations, design organizations, and aerodrome operators. The sassofia.com May 2026 regulatory update confirmed the scope of this extension: „By amending several foundational regulations (including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014), this act harmonizes information security protocols across the entire aviation value chain.“

For quality managers in Part 145 maintenance organizations and Part 21 production approval holders: if your organization has not implemented a documented ISMS consistent with 2023/203 requirements, you are operating with a regulatory compliance gap that your next competent authority surveillance audit will identify. The requirement is not optional and it is not deferred — it is active.

1. What 2023/203 Actually Requires

The regulation requires aviation organizations to identify and manage information security risks that could impact aviation safety. The key word is „safety-relevant“ — 2023/203 is not an IT security regulation in the conventional sense. It is a safety management regulation that addresses cybersecurity threats as a category of safety risk. The ISMS required under 2023/203 must cover:

Information security risk assessment. Identification of information assets — systems, data, processes — whose compromise could affect the organization’s ability to maintain airworthy products or conduct safe operations. For a Part 145 organization, this includes: maintenance management systems, airworthiness documentation systems, tooling calibration databases, parts traceability systems, and communication systems used for technical data exchange with customers and regulatory authorities.

Risk-proportionate controls. Access controls, authentication requirements, network security, patch management, and backup and recovery procedures proportionate to the identified risks. The regulation does not mandate specific technical standards — it requires a risk-based approach documented in the organization’s Maintenance Organization Exposition or equivalent quality system documentation.

Incident detection and reporting. Procedures for detecting information security events, assessing whether they constitute incidents with safety relevance, and reporting to the competent authority where required. This is the interface between 2023/203 and Regulation 376/2014 on occurrence reporting — a cybersecurity incident that affects airworthiness data integrity is potentially a reportable occurrence.

Supplier and third-party management. Assessment of information security risks arising from third-party access to your information systems — including software vendors with remote access to maintenance systems, cloud service providers hosting quality data, and customers with direct system access for technical data exchange. This is the supply chain dimension of 2023/203 that most organizations have not yet addressed systematically.

2. The Interface with IA9100

IA9100’s cybersecurity integration requirement at Clause 8.1 — mandatory for aerospace quality management systems when the standard publishes — directly overlaps with 2023/203. The IAQG Key Change Summary identifies information security as one of six named areas of substantive change. The audit evidence expected: governance structures, threat assessment covering ERP systems, CAD and quality data storage, remote access infrastructure, and incident response procedures linked to quality records.

An organization that builds its ISMS to satisfy 2023/203 requirements now will have the implementation evidence required for an IA9100 transition audit when that transition begins. The organizations that have not started are facing two parallel implementation requirements — regulatory and standards — in a compressed timeline.

3. What a 2023/203-Compliant ISMS Looks Like in Practice

For a mid-market Part 145 organization, the minimum viable ISMS consistent with 2023/203 requirements covers five documented elements: an information asset inventory identifying all systems and data relevant to maintenance safety, a risk assessment documenting identified threats and their potential safety impact, a control set proportionate to the identified risks with implementation evidence, an incident response procedure with clear escalation and reporting paths, and a supplier/third-party assessment process. None of these elements require ISO 27001 certification — they require documented, implemented, and auditable processes.

3 Concrete Actions

1. If your organization has not conducted an information security risk assessment consistent with 2023/203 requirements, prioritize this before your next competent authority surveillance audit. The risk assessment is the foundation of the ISMS — without it, the other elements cannot be developed coherently. Scope the assessment specifically to safety-relevant information assets: systems whose compromise could affect airworthiness documentation, parts traceability, or maintenance record integrity.

2. Review your Maintenance Organization Exposition or equivalent quality system documentation for cybersecurity content. A reference to „IT security policy managed by the IT department“ is not sufficient for 2023/203 compliance. The MOE must reflect an integrated ISMS with safety-relevant scope, documented risk assessment, and defined incident response procedures linked to the occurrence reporting framework under 376/2014.

3. Extend your supplier qualification process to include information security assessment for suppliers with access to your safety-relevant systems. The assessment does not need to be an ISO 27001 audit — it needs to verify that the supplier has implemented proportionate access controls, has an incident notification process, and understands which data they access qualifies as safety-relevant under 2023/203. This assessment should be documented and retained as part of the supplier qualification record.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • European Commission — Implementing Regulation (EU) 2023/203 Part IS CA: Information Security Requirements, eur-lex.europa.eu
  • European Commission — Delegated Regulation (EU) 2022/1645 Part IS IA: Information Security Requirements, eur-lex.europa.eu
  • sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
  • EASA — AMC and GM to Part-IS.I.OR and Part-IS.D.OR, easa.europa.eu
  • EASA — AMC/GM Acceptable Means of Compliance to Regulation (EU) 2022/1645 and 2023/203, easa.europa.eu
  • IAQG — IA9100 Key Change Summary: Cybersecurity Integration (Clause 8.1), iaqg.org
  • European Parliament and Council — Regulation (EU) 376/2014 on Occurrence Reporting in Civil Aviation, eur-lex.europa.eu

#EASACybersecurity #Part145 #Part21 #ISMS #AviationSafety #QualityManagement #InformationSecurity #IA9100 #SKQC

The EU Regulatory Radar Every Quality Manager in Aerospace and Automotive Needs in Q4 2026

The EU Regulatory Radar Every Quality Manager in Aerospace and Automotive Needs in Q4 2026

admin

August 2, 2026 was a deadline. Under the EU AI Act, the general-purpose AI provisions and the prohibited AI practices framework became fully enforceable. For quality managers in aerospace and automotive, this is one of five active regulatory tracks that require monitoring and action in Q4 2026. The others: EASA cybersecurity regulation 2023/203 and its November 2025 amendment, EU Battery Regulation 2023/1542 enforcement now in active phase, IA9100 publication expected September-October 2026, and REACH Regulation amendments with Q2 2026 substance additions directly affecting aerospace materials. Each of these creates a specific compliance obligation for quality management systems. None of them are isolated.

The pattern is recognizable to anyone who has tracked regulatory development across multiple frameworks: individual regulations that appear to address separate domains — AI safety, aviation cybersecurity, battery sustainability, product quality standards, chemical restrictions — are converging toward a common set of organizational requirements. Documented risk management. Supply chain traceability. Incident reporting. Change notification. Audit-ready documentation. These are quality management requirements, regardless of which regulation generates them.

1. EU AI Act — August 2, 2026: Quality Management System Requirements for High-Risk AI

The EU AI Act’s Article 17 requires providers of high-risk AI systems to establish a documented quality management system. Compliance Week’s January 2026 analysis identified this as a landmark step: „The first EU standard to drive conformity and facilitate enforcement of the EU AI Act has been published in draft.“ The standard — prEN 18286:2025, drafted by CEN and CENELEC — specifies QMS requirements that directly parallel ISO 9001 and sector standards: design and development controls, supplier management, post-market monitoring, incident reporting, and documentation discipline. The CMS Law December 2025 analysis of prEN 18286 was specific: „The requirements can be built into existing sector quality systems such as medical devices or automotive rather than creating a new standalone QMS, provided those systems are updated to incorporate all of this standard’s controls.“

For aerospace and automotive quality managers, the practical question is not whether your organization uses AI — it is whether any AI system in your supply chain or production environment qualifies as high-risk under the Act’s Annex III categories. Annex III includes AI used in safety components of products covered by harmonized EU legislation — which explicitly includes machinery, aviation, automotive, and defense product categories. If your suppliers use AI in quality inspection, predictive maintenance, or process control, those systems may qualify.

2. EASA Cybersecurity — 2022/1645 and 2023/203: Now Fully Active

The EASA cybersecurity framework — Regulation 2022/1645 (Part IS IA) and Regulation 2023/203 (Part IS CA) — is the aerospace-sector implementation of aviation cybersecurity requirements. The November 2025 amendment to 2023/203 extended Information Security Management System (ISMS) requirements to organizations operating under declaration rather than formal approval — bringing a broader range of maintenance organizations, aerodrome operators, and design organizations within scope. The sassofia.com May 2026 regulatory update confirmed: this amendment „harmonizes information security protocols across the entire aviation value chain“ by amending multiple foundational regulations including 1178/2011, 748/2012, 965/2012, 139/2014, and 1321/2014.

For Part 145 maintenance organizations and Part 21 production approval holders: an ISMS is not optional. The IA9100 cybersecurity integration requirement — one of six named areas in the IAQG Key Change Summary — aligns with the EASA framework. Building an ISMS that satisfies both EASA 2023/203 and IA9100’s Clause 8.1 cybersecurity requirement produces a single integrated system rather than two parallel compliance programmes.

3. REACH 2026 — Active Substance Additions Affecting Aerospace Materials

REACH Regulation 1907/2006 received amendment 2026/0859 in Q2 2026 — the addition of 2,4-Dinitrotoluol to the substances of very high concern list. Your Excel-based regulatory monitoring records this as requiring notification to procurement and design teams to prevent use in new designs. The pattern of REACH additions continues: authorization list updates, SVHC candidate list additions, and restriction proposals under evaluation for substances used in aerospace adhesives, coatings, and composite processing materials. For quality managers, REACH compliance is an approved material list maintenance issue — every SVHC addition potentially affects existing process approvals and requires systematic review of current material specifications.

4. EU Battery Regulation 2023/1542 — Enforcement Phase Active

The carbon footprint declaration requirement for industrial batteries above 2 kWh has been active since February 18, 2026. The Digital Battery Passport becomes mandatory February 18, 2027. For aerospace and automotive quality managers, this regulation matters beyond direct battery manufacturing: any product containing industrial batteries above 2 kWh capacity — ground support equipment, avionics test benches, hybrid powertrain components, manufacturing facility energy storage — is in scope. The nine-month window before the DBP deadline is the implementation window that remains.

5. IA9100 — Publication This Quarter

ISO 9001:2026 is expected September-October 2026. IA9100 follows in alignment. The six named change areas are confirmed and stable in the IAQG Key Change Summary. Gap analysis conducted now — before the final text publishes — will be accurate to within 90-95% of final requirements. Organizations that wait for the published text are starting their preparation 3-6 months later than those who started from the Key Change Summary.

3 Concrete Actions

1. Build a cross-regulatory compliance matrix for your quality management system. Map each active regulation — EU AI Act, EASA 2023/203, REACH, EU Battery Regulation, IA9100 — against your existing QMS processes. Where the same process (supplier evaluation, change notification, incident reporting, document control) appears in multiple regulatory frameworks, you have an opportunity to build a single integrated process that satisfies all of them simultaneously. This is more efficient than building separate compliance programmes for each regulation.

2. Add regulatory monitoring to your standard supplier audit agenda. For each critical supplier, the Q4 audit should verify: ISMS status consistent with EASA 2023/203 for aviation suppliers, AI Act high-risk system inventory for suppliers using AI in quality-critical processes, REACH SVHC status for all materials on approved material lists, and EU Battery Regulation carbon footprint declaration status for battery-containing products. These are not separate compliance checks — they are standard supplier qualification verification against current regulatory requirements.

3. Contact your certification body this quarter about IA9100 transition planning. Request their specific transition audit timeline, early adoption options, and whether combined surveillance/transition audits are available for your certification cycle. The organizations that engage their certification bodies in Q4 2026 will have better transition planning visibility than those who wait for 2027.

👉 Request a Technical Consultation → www.skqc.org

Sources

  • Compliance Week — First Standard for EU AI Act Targets Quality Management Regime (January 7, 2026), complianceweek.com
  • CMS Law — prEN 18286: What the First Draft AI Act Standard Signals for Quality Management (December 12, 2025), cms.law
  • VDE — EU AI Act: Quality Management System Requirements (April 10, 2026), vde.com
  • sassofia.com — EASA Part 145 Regulatory Update May 2026, sassofia.com
  • European Parliament and Council — Regulation (EU) 2023/203 Part IS CA, as amended November 2025, eur-lex.europa.eu
  • European Parliament and Council — Regulation (EU) 2022/1645 Part IS IA, eur-lex.europa.eu
  • European Parliament and Council — Regulation (EU) 2023/1542 on Batteries and Waste Batteries, eur-lex.europa.eu
  • IAQG — IA9100 Key Change Summary (November 2023), iaqg.org
  • REACH Regulation (EU) 2026/0859 — Amendment adding 2,4-Dinitrotoluol, eur-lex.europa.eu

#RegulatoryCompliance #QualityManagement #EUAIAct #EASA #REACH #EUBatteryRegulation #IA9100 #AerospaceQuality #SKQC

EBACE 2026: Business Aviation Is Growing. Is Its Quality Infrastructure Keeping Up?

EBACE 2026: Business Aviation Is Growing. Is Its Quality Infrastructure Keeping Up?

admin

From May 27 to 29, 2026, Geneva will host EBACE — the European Business Aviation Convention & Exhibition — the premier annual gathering for business aviation operators, manufacturers, and service providers in Europe. After a transitional 2025 edition, the 2026 show returns to Geneva’s Palexpo with a full static display at Geneva Airport, bringing together the full spectrum of business aviation: OEMs, operators, MRO providers, avionics suppliers, and regulatory stakeholders.

The themes dominating the agenda: sustainability, fleet modernization, regulation, and digitalization.

These are important conversations. But from a Quality Management perspective, there is one topic that does not make it onto most conference agendas — and it should: the structural readiness of business aviation’s quality and supplier management framework to handle the growth the industry is currently experiencing.

The Numbers: Business Aviation Is Not a Niche Anymore

Business aviation is frequently treated as the premium edge of the industry — relevant, but contained. The data tells a different story.

The global business aviation fleet exceeded 23,000 active aircraft in 2025. North America accounts for roughly 66% of operations, but Europe is growing — business aviation movements in the EU increased by 11% between 2022 and 2025, with the UK, France, Germany, and Switzerland as the top four markets. The MRO segment for business aviation is projected to reach $17.8 billion globally by 2028.

These are not niche numbers. They represent a significant and growing industrial base that is subject to the same regulatory framework — EASA Part-21, Part-145, Part-M — as commercial aviation, but often with significantly leaner internal quality organizations.

The Quality Gap in Business Aviation

Here is what 26 years across aviation quality management consistently show: business aviation operators and their Tier-2 suppliers frequently operate at a lower level of QMS maturity than their commercial aviation counterparts — not because of a lack of intent, but because of structural differences in how the sector is organized.

Three specific gaps are worth naming:

1. Supplier qualification depth. In commercial aviation programs, Tier-1 suppliers are typically required to maintain EN9100-certified QMS and undergo regular second-party audits from OEMs. In business aviation, the smaller scale of programs means that supplier qualification often relies on first-party declarations and AS9120 distributor approvals rather than process audits. When fleet sizes are small and components are sourced from a fragmented network of specialized suppliers, the traceability and conformance assurance can be significantly weaker than the regulatory minimum suggests.

2. MRO quality oversight at Part-145 organizations. Business aviation MRO is heavily fragmented. Many operators use multiple Part-145 approved maintenance organizations across different geographies, which creates a coordination challenge for continuing airworthiness management. The question of who owns the quality oversight of the full MRO network — not just individual approval certificates, but the integrated quality performance — is frequently unanswered in smaller operator organizations.

3. Competency in quality-critical positions. EASA’s EPAS 2026 has formally identified workforce competency as a systemic safety risk across aviation. In business aviation, where quality management is often a secondary responsibility of an existing engineering or operations role rather than a dedicated function, this risk is disproportionately concentrated. A Part-145 approval certificate tells you an organization has met a minimum standard. It does not tell you whether the person responsible for quality decisions has been trained for the complexity of decisions they are currently making.

What EBACE 2026 Signals for the Sector

The return of EBACE to a full-scale format in 2026 reflects a sector that has largely recovered from the disruption of 2020-2022 and is now in active expansion. Fleet orders are up. Fractional ownership programs are growing. SAF mandates under ReFuelEU Aviation are creating new compliance requirements for operators. And the regulatory environment — both EASA and FAA — is tightening its oversight of business aviation MRO and continuing airworthiness.

This is the context in which quality infrastructure needs to be assessed. Growth without quality systems that scale proportionally is not sustainable. It is a risk accumulation cycle — one that typically becomes visible only when an AD is issued, an audit finding escalates, or a safety event occurs.

The question for any business aviation organization heading into H2/2026 is not whether your current quality system is compliant. It is whether it is designed to remain compliant as your operation scales.

3 Concrete Actions for Business Aviation Quality Teams

→ Audit your Part-145 network — not just the approvals, the performance. Compile the last 12 months of findings from all MRO organizations you use. Are the same finding categories recurring? Is corrective action closure timely? If you cannot answer these questions with data, your oversight system is not functioning as intended.

→ Review your supplier qualification records for completeness and recency. If any supplier in your critical parts network has not been subject to a second-party assessment in the last 24 months, that is a gap. AS9120 distribution approval is not a substitute for process audit where the component is safety-critical

→ Define who owns quality decisions in your organization — in writing. Not the approval certificate holder. The person who is actually making daily quality-relevant decisions about airworthiness, supplier performance, and non-conformance disposition. Is that person trained, empowered, and connected to your QMS? If the answer requires more than one sentence to explain, it is worth examining more carefully.

The Bigger Picture

EBACE 2026 will generate significant industry conversation about the future of business aviation — new aircraft, new fuels, new digital tools. Those conversations matter. But the quality infrastructure that underpins the safe operation of 23,000+ business aircraft deserves equal attention — not as a compliance exercise, but as a structural enabler of the growth the sector is pursuing.

Quality is not the handbrake on business aviation expansion. It is the foundation that makes expansion sustainable.

Is your business aviation quality framework built to scale with your operation? Request a Technical Consultation → skqc.org

Sources:

  1. EBACE 2026 Official: https://ebace.aero
  2. Aviation Events Calendar 2026: https://flyingassist.com/aviation-expos-trade-shows-conferences-2026/
  3. EASA EPAS 2026 (Workforce Competency): https://www.easa.europa.eu/en/document-library/general-publications/european-plan-aviation-safety-epas-2026
  4. EASA ReFuelEU Aviation: https://www.easa.europa.eu/en/domains/environment/refueleu-aviation-digital-reporting-tool

technisches Diagramm eines Avionik-Systems

🛠️ Is Your Quality System Flight-Ready?

admin

In the world of MRO (Maintenance, Repair, and Overhaul), there is no room for „good enough.“ Every component, every CoC (Certificate of Conformity), and every manual must be 100% compliant.

The Challenge: Many companies struggle with the transition from production quality to maintenance quality (Part 145). The requirements for documentation and traceability are immense.

The SKQC Solution: We don’t just audit; we evaluate your internal systems to find bottlenecks before the official authority does.

  • ✅ Gap Analysis: Where do you stand compared to EASA/FAA requirements?
  • ✅ Process Stability: Ensuring that „Intern & Extern“ quality levels are identical.

Is your documentation ready for the next level? Let’s perform a system health check. [Link skqc.org]

#MRO #AviationMaintenance #QualityAudit #Part145 #SKQC #ZDF #AerospaceSafety

SRQ Aviation

Vendor quality training: from firefighting to structured supplier audits

admin

Many vendor quality and supplier quality teams operate in constant firefighting mode. They jump from one issue to the next – blocked parts, late deliveries, missing certificates – with very little time to work on root causes.

The turning point usually comes when the team builds real vendor quality skills: planning audits, asking the right questions on‑site, analysing performance data, and following up findings in a consistent way.

In an aviation context, this is even more important. EASA Part 21G/145, EN9100 or EN9120 do not only ask for procedures – they expect that people understand how to apply them when they are at a vendor’s site or reviewing vendor documentation.

Effective vendor quality training should help your team to:

  • Move from generic checklists to risk‑based audit programmes focused on what really matters.
  • Translate regulatory and standard requirements into simple, practical questions for suppliers.
  • Document findings in a way that supports follow‑up, corrective action, and future audits.

I support organisations by designing and delivering tailored vendor quality training – from remote sessions on audit basics up to hands‑on coaching during real supplier audits in aviation and other industries.

If you want your team to spend less time in reactive firefighting and more time on structured supplier improvement, feel free to reach out via skqc.org or contact me here on LinkedIn.

Standards vs Laws

Standards vs. Laws in Technical Documentation: Expert Insights

admin

Navigating the complex world of Technical Documentation often leads to a fundamental question: What is the actual difference between a standard (Norm) and a law (Gesetz)?

In a recent, highly insightful interview, industry expert Dieter Gust clarified these nuances. At SK Quality Consulting (SKQC), we believe that understanding these differences is the foundation for any robust compliance strategy.

Key Takeaways from the Expert Discussion:

  • The „Presumption of Conformity“: While standards are technically voluntary, following harmonized European standards provides a „presumption of conformity“ with the law. This is your strongest legal shield.
  • Standards as the „State of the Art“: Laws define that a product must be safe; standards define how to achieve and document that safety according to the current state of technology.
  • Liability Protection: Correct application of standards is not just a „nice-to-have“—it is a critical component in mitigating liability risks for manufacturers.

Why this matters for your business: Compliance is not about checking boxes; it’s about strategic safety. By aligning your documentation with the right standards, you ensure global market access and legal peace of mind.

Inspired by the original interview with Dieter Gust (in German).

Source: This article was inspired by an interview with Dieter Gust. You can find the original German discussion on LinkedIn here: [Interview]

What the SRQ aviation ecosystem teaches us about vendor quality

What the SRQ aviation ecosystem teaches us about vendor quality

admin

The Sarasota (SRQ) and Tampa Bay area is becoming a visible aviation hub. Many OEMs, MROs, FBOs, airport services, logistics providers, and specialist suppliers operate in a small radius.

Because of this concentration, vendor quality is not only about global sourcing. It is also about how well local partners work together every day. This includes maintenance slots, spare parts, documentation, logistics, and line support.

When you look at a regional cluster like SRQ, three vendor quality lessons become very clear:

  • First, strong local partnerships can reduce lead times and risk, but only if quality expectations and communication are transparent.
  • Second, even long‑term local suppliers need structured performance reviews and, when needed, formal audits. Personal relationships alone are not enough.
  • Third, airport infrastructure, MROs, FBOs, and logistics providers are part of your wider vendor landscape. They should be managed with the same discipline as component manufacturers.

However, these ideas only work if they are embedded in a simple and consistent vendor quality process. Clear criteria, regular reviews, and a mature way of handling issues and improvements stay essential, whether a vendor is across town or on another continent.

With SK Quality Consulting, I help organisations map their vendor landscape, define realistic quality requirements, and build a vendor management approach that works in the real world – for both international suppliers and local SRQ‑based partners.

If you are active in the SRQ or Tampa aviation ecosystem and want to strengthen your vendor quality, feel free to connect with me on LinkedIn or visit .skqc.org.

Vendor quality in aviation: more than a purchasing checkbox

Vendor quality in aviation: more than a purchasing checkbox

admin

In aviation, vendor quality is never “just purchasing”. It is a core part of how you protect airworthiness and customer trust.

Too often, organisations still treat ISO 9001 or EN9100 requirements as paperwork instead of as a practical framework to select, monitor and develop their vendors.

From my experience in supplier quality and as Certifying Staff in a Part 21G production environment, the real value of a QMS appears when you connect the clauses to daily vendor decisions – audits, approval, escalation and, if necessary, phased exit.​

For aviation OEMs and maintenance providers, three simple questions make a big difference:

  • Do we have a clear, risk‑based process to approve and re‑approve vendors (not just a one‑time questionnaire)?
  • Do we systematically link vendor performance (quality escapes, documentation, on‑time delivery) to our internal risk register and audit plan?
  • Do we treat distributors and brokers with the same process discipline as direct manufacturers, especially regarding EN9120 and traceability?

If you recognise gaps here, it is not about blaming Purchasing. It is about building a joint vendor quality approach between Quality, Engineering and Supply Management – one that is simple enough to use and strong enough to satisfy ISO, EN and customer‑specific requirements.

At SK Quality Consulting, I support organisations that want to turn “vendor management” into a living part of their aviation QMS – from practical audit checklists to aligned procedures for vendor approval, monitoring and escalation.​

If this is relevant for your organisation, feel free to reach out via skqc.org or connect with me here on LinkedIn.

Supplier Development

Why Supplier Development Beats Firefighting

admin

Most companies react to supplier issues.
Very few develop their suppliers.

Firefighting feels productive.
Supplier Development creates results.

At SKQC, we focus on:
– root cause, not symptoms
– on-site capability, not spreadsheets
– sustainable improvement, not short-term fixes

Strong suppliers don’t happen by chance.
They are built.

——————————————————————————————————————-

Die meisten Unternehmen reagieren auf Lieferantenprobleme.
Nur wenige entwickeln ihre Lieferanten systematisch weiter.

Feuerwehraktionen fühlen sich produktiv an.
Supplier Development schafft echte Ergebnisse.

Bei SKQC liegt der Fokus auf Ursachen statt Symptomen, auf realer Umsetzungsfähigkeit statt Excel-Folien und auf nachhaltiger Verbesserung statt kurzfristiger Korrekturen.

Starke Lieferanten entstehen nicht zufällig.
Sie werden aufgebaut.