Many buyers treat a certificate as a promise about parts: an AS9100 shop makes good aerospace parts, an ITAR-certified shop is approved for defense work. Then an AS9100 shop ships a batch with a bore out of tolerance, and the "ITAR certified" claim on a website turns out to describe a registration form, not an audit.
So what does each certification actually prove?
Each one proves one specific thing: that a quality system was audited, that a process meets a set of technical requirements, that a company registered with the government, or that it protects certain information. None of them proves that your part will be right. This guide explains the seven you will see most often on job shop websites, who needs them, how to check each one, and what they leave out.
The seven at a glance
| Certification | What it covers | Who asks for it | How to check |
|---|---|---|---|
| ISO 9001 | Quality management system, any industry | Most industrial buyers | Certificate from an accredited certification body; IAF CertSearch |
| AS9100 | Quality management system for aviation, space and defense | Aerospace and defense primes | IAQG OASIS database |
| ISO 13485 | Quality management system for medical devices | Medical device makers | Certificate from the certification body |
| IATF 16949 | Quality management system for automotive production | Automotive OEMs and tier suppliers | IATF Certificate Validity Check |
| Nadcap | Specific critical processes (heat treating, NDT, welding, chemical processing and more) | Aerospace primes, for special processes | PRI's EANS platform (formerly eAuditNet) and QML |
| ITAR registration | Registration with the State Department to manufacture or export defense articles | Defense programs | Ask for the shop's current DDTC registration |
| CMMC | Protection of DoD contract information on the contractor's systems | DoD contracts involving FCI or CUI | CMMC status in DoD's SPRS, confirmed by the supplier |
ISO 9001: the quality management baseline
ISO 9001 is the general standard for a quality management system: documented processes, control of nonconforming parts, corrective action, calibration, management review. ISO writes the standard but does not certify companies; certificates are issued by independent certification bodies, which in turn are accredited by national accreditation bodies. Accredited certificates can be looked up in IAF CertSearch, the database of the International Accreditation Forum.
A new edition, ISO 9001:2026, was published on 16 September 2026, according to the certification body DQS. Certificates to ISO 9001:2015 remain valid during the transition period, so you will see both editions on certificates for some time.
Who needs it: almost any shop that sells to industrial companies. Many buyers treat it as a minimum.
AS9100: aerospace, space and defense
AS9100 builds on ISO 9001 with requirements for aviation, space and defense, such as configuration management, first article inspection, counterfeit part prevention and product safety. Intertek, a certification body, describes it as the "internationally recognised quality management standard for the aerospace, aviation, space, and defence industries", and notes that supplier qualification in these sectors mandates such a system. Related standards are AS9110 for maintenance organizations and AS9120 for distributors.
How to check: every certified company is listed in OASIS, the Online Aerospace Supplier Information System maintained by the International Aerospace Quality Group (IAQG). Access is free, but you need to register. The record shows the certificate, its scope, the sites covered and whether it is current.
Who needs it: shops that make parts for aerospace and defense primes or their suppliers. In the EveryJobShop index, 770 of 3,768 shops state AS9100 on their own website (see them); confirm each in OASIS before you order.
ISO 13485: medical devices
ISO 13485 is the quality management standard for medical devices, with stronger requirements for risk management, documentation and traceability than ISO 9001. In the US it gained weight in 2026: the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference and took effect on 2 February 2026.
Two details matter for buyers. The FDA states that it "will not require certificates of conformance to ISO 13485 and will not issue certificates", and that a certificate "will not exempt a manufacturer from an FDA inspection". So a supplier's ISO 13485 certificate is evidence of a system, not a regulatory approval.
Who needs it: medical device makers, and the contract manufacturers and component suppliers they choose to require it of.
IATF 16949: automotive
IATF 16949 is the automotive quality management standard, built on ISO 9001 and supplemented by customer-specific requirements from each automaker. Certificates are issued by IATF-recognized certification bodies under strict rules; according to the IATF, the current Rules 6th Edition took effect on 1 January 2025, and a revision of the standard itself started in October 2024. The same site offers an IATF Certificate Validity Check.
Who needs it: suppliers of production parts to automakers and their tier 1 and tier 2 suppliers. It is rarely required for prototypes, tooling or non-automotive work.
Nadcap: critical processes in aerospace
Nadcap is different from the standards above: it accredits processes, not whole companies. According to PRI, the Performance Review Institute that administers it, Nadcap is an industry-managed program founded in 1990 by aerospace manufacturers, with 24 accreditation programs covering processes such as heat treating, nondestructive testing, welding, chemical processing, additive manufacturing and composites. Suppliers go through one standardized audit that multiple OEMs accept.
How to check: PRI names its EANS platform, formerly eAuditNet, as the system of record for accreditation certificates and the Qualified Manufacturers List (QML). Check that the accreditation covers the exact process (for example, a specific NDT method) at the site that will do your work.
Who needs it: suppliers performing critical processes for aerospace primes that require it. A machine shop may not hold Nadcap itself and instead send heat treating or anodizing to a Nadcap-accredited processor; ask who does each special process.
ITAR registration: a registration, not a certification
The International Traffic in Arms Regulations control defense articles and technical data on the US Munitions List. Under 22 CFR 122.1, "any person who engages in the United States in the business of manufacturing or exporting" defense articles must register with the State Department's Directorate of Defense Trade Controls (DDTC). The same section says plainly: "Registration does not confer any export rights or privileges." Registration is renewed every year, and the fee for a new registrant is $3,000 per year.
What registration means for you: the shop has registered as a manufacturer of defense articles and has accepted the obligations that come with it, such as controlling access to technical data. Releasing ITAR technical data to a foreign person, even inside the US, is an export under 22 CFR 120.50. What it does not mean: an audit of the shop's quality or of how well it controls data.
How to check: ask the shop for its current DDTC registration and its expiration date before you send controlled drawings, and ask how it restricts access to controlled data. In the EveryJobShop index, 716 shops state ITAR registration or defense work on their own website (see them).
CMMC: protecting defense information
The Cybersecurity Maturity Model Certification checks that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their own systems. It is set out in 32 CFR part 170, and the DoD CIO's CMMC pages describe the program. The levels:
| Level | Information | Requirements | Assessment |
|---|---|---|---|
| Level 1 | FCI | The basic safeguarding requirements of FAR 52.204-21 | Annual self-assessment, results in DoD's Supplier Performance Risk System (SPRS) |
| Level 2 | CUI | NIST SP 800-171 | Self-assessment, or certification by an authorized third-party assessor (C3PAO), every three years with annual affirmation |
| Level 3 | CUI on the most sensitive programs | Additional requirements | Assessment by DoD's DIBCAC |
Timing: the DFARS rule that puts CMMC into contracts took effect on 10 November 2025, starting Phase 1, in which solicitations can require Level 1 or Level 2 self-assessments. Under 32 CFR 170.3, Phase 2, with Level 2 third-party certification as a condition of award, was to begin one year after Phase 1, on 10 November 2026. On 13 July 2026 the Pentagon suspended Phase 2 and launched a review of the program. The Phase 1 self-assessment requirements remain in force; check the current status before you rely on a CMMC level in a contract.
How to check: ask the supplier for its CMMC status (level, self or C3PAO), the status date, and confirmation that it is posted in SPRS. If your contract flows down a CMMC requirement, your subcontractors need the level that matches the information they handle.
What no certificate guarantees
- That your part will be right. Certificates audit systems and processes. Your drawing, your inspection requirements and the first article decide part quality.
- That it covers your work. Every certificate has a scope and a list of sites. A certificate for "design and manufacture of machined components" at one plant does not cover welding at another.
- That it is current. Certificates expire, get suspended or are withdrawn. Check the date, and check again for long programs.
- That a website claim is true. Anyone can put a logo on a page. Check the registrar or the government database, not the website.
- That the shop can do your specific job. An AS9100 shop without a 5-axis machine is still the wrong shop for a 5-axis part.
How to verify a certification in five minutes
- Ask the shop for a copy of the certificate, or the registration or status record for ITAR and CMMC.
- Check the issuer: an accredited certification body for ISO standards, PRI for Nadcap, DDTC for ITAR, SPRS status for CMMC.
- Look it up in the database: IAF CertSearch for ISO 9001, OASIS for AS9100, the IATF validity check for IATF 16949, EANS (formerly eAuditNet) for Nadcap.
- Read the scope and the site address. They must match the work and the plant.
- Check the expiration date, and put it in your supplier file.
For what to put in the RFQ itself, see our guide on what to send for a machine shop quote.
Find certified shops on EveryJobShop
EveryJobShop is a free index of 3,768 US job shops in 50 states and 1,877 cities. You can filter by certification: ISO 9001, AS9100 and ITAR, combined with process and state. Certifications in the index are counted only when the company's own website names them, as of 15 October 2026; we have not checked them with registrars, so verify before you order. When you have a shortlist, send one RFQ to up to 30 shops and state the certifications you require.
Questions people ask
- Is there such a thing as ITAR certification?
- No. ITAR compliance is based on registration with the State Department's Directorate of Defense Trade Controls (DDTC), which manufacturers and exporters of defense articles are required to do. The regulation states that registration does not confer any export rights or privileges, and it is not an audit of the shop's quality.
- Does ISO 9001 mean the parts will be good?
- No. It means the shop has a documented quality management system that a certification body has audited. That makes problems more likely to be caught and corrected, but it does not certify any particular part. Your drawing, your inspection requirements and the shop's capability decide part quality.
- How do I check whether a shop is really AS9100 certified?
- Look it up in OASIS, the database run by the International Aerospace Quality Group (IAQG), which lists suppliers certified to the 9100 series. Access is free but requires registration. Check that the certificate is current and that its scope and site cover the work you are buying.
- Do I need a Nadcap-accredited supplier?
- Only if your customer or its specification requires it, which is common in aerospace for special processes such as heat treating, nondestructive testing, welding and chemical processing. Nadcap accredits specific processes at a specific site, so check that the accreditation covers the process on your part.
- What is the difference between AS9100 and Nadcap?
- AS9100 certifies a company's whole quality management system for aviation, space and defense. Nadcap accredits individual critical processes, such as heat treating or NDT, against detailed technical requirements set by the aerospace primes. Many aerospace suppliers need both.
- Which shops need CMMC?
- Defense contractors and subcontractors whose DoD contracts involve Federal Contract Information or Controlled Unclassified Information on their own systems. Since November 2025, DoD solicitations can require a CMMC self-assessment (Phase 1). Phase 2, with third-party Level 2 assessments, was suspended on July 13, 2026 while the Pentagon reviews the program.