KEY TAKEAWAYS

✓
A CoC is a supplier’s formal declaration that parts meet all specified requirements — it is not a substitute for inspection data unless your contract explicitly allows it.

✓
Aerospace and defense programs governed by AS9100 or customer flow-down requirements almost always mandate a CoC with every shipment.

✓
A valid CoC must reference the specific revision of the drawing, purchase order number, material spec, and quantity — vague CoCs are non-conforming documents.

✓
A CoC and a material certification (mill cert) are different documents — know which one your application requires, and when you need both.

✓
If your supplier cannot produce a traceable, signed CoC on demand, that is a supply chain risk that needs to be addressed before parts go into production.

A Certificate of Conformance (CoC) — sometimes called a Certificate of Compliance — is a formal written declaration from a manufacturer or supplier stating that the delivered product meets all specified requirements. It is a legally significant document. The supplier is asserting, on record, that the parts conform to the drawing, specification, purchase order, and any applicable standards referenced in the contract. It is not a quality report. It is not inspection data. It is a declaration of conformity backed by the supplier’s quality system.

The CoC travels with the shipment and becomes part of the traceability record for that lot of parts. In regulated industries — aerospace, defense, medical — these documents are retained for years and are subject to review during customer audits, regulatory inspections, and first article reviews. A missing or incomplete CoC can trigger a non-conformance report against your supplier and, depending on your contractual flow-downs, may make the entire lot unacceptable until the document is corrected or replaced.

Understanding the CoC as a documented declaration rather than a quality record is critical. It shifts the burden of proof. If parts later fail and you have a CoC on file, you have a documented trail. If you accepted parts without one, your ability to pursue corrective action is significantly weakened.

A CoC is not proof of quality — it is proof of claimed conformance. Always understand what inspection data backs it up.

Not all CoCs are created equal. A vague or incomplete CoC is a non-conforming document and provides little legal or contractual protection. At minimum, a properly written CoC should include:

• Purchase order number and line item reference
• Part number and revision level — the exact drawing revision the parts were made to
• Quantity shipped and unit of measure
• Material specification — alloy, temper, and applicable ASTM, AMS, or UNS designations where relevant
• Process specifications — surface treatment, heat treat spec, finish callouts, etc.
• Statement of conformance — an explicit declaration that the parts meet all requirements of the referenced documents
• Authorized signature — name, title, and date from an authorized representative of the supplier’s quality organization
• Lot or batch number for traceability

Some customers add requirements beyond this baseline — serial number traceability, first article report references, or reference to specific test reports. Always check your contract and any customer-imposed flow-down requirements before assuming a standard CoC format is sufficient. In AS9100-governed supply chains, the requirements are more prescriptive and are typically spelled out in the purchase order quality clauses.

WARNING: A CoC that says only ‘parts meet all requirements’ with no document references is functionally worthless. Require specificity.

These two documents are frequently confused, and conflating them creates real problems in regulated supply chains. A Certificate of Conformance is issued by the manufacturer or job shop — it covers the finished part and confirms conformance to drawing, tolerances, processes, and purchase order requirements. A material certification (often called a mill cert or material test report) is issued by the raw material producer — it documents the actual chemistry, mechanical properties, and heat/lot number of the raw stock.

Both documents serve different purposes and are often required together. An aerospace machined component, for example, might require: a mill cert from the aluminum supplier confirming AMS 2770 heat treat compliance and actual yield/tensile values, plus a CoC from the machine shop confirming that the finished part was machined to Rev D of the drawing, in the specified material, with the correct surface finish and dimensional tolerances. One document does not replace the other.

A third document — the First Article Inspection Report (FAIR) — is sometimes confused with a CoC as well. The FAIR is a comprehensive dimensional and material review performed on production-representative parts, typically at the start of a new program or after significant process changes. It provides the objective evidence that the CoC is based on. For ongoing production runs, the FAIR is on file; the CoC is issued with each shipment.

The short answer: any time your customer, contract, or quality plan requires one. But in practice, knowing when to expect a CoC — and when to demand one — is a procurement competency that directly affects program risk. Here are the situations where a CoC is essentially non-negotiable:

• Aerospace and defense programs — AS9100 and NADCAP-governed supply chains require documented conformance at every tier. If your prime contract has flow-down clauses, those requirements cascade to your suppliers.
• Medical device components — ISO 13485 quality systems and FDA regulatory requirements create similar mandates for traceability and documented conformance.
• Government and military procurement — DFARS and MIL-SPEC contracts frequently call out CoC requirements explicitly.
• Safety-critical applications — Any part where failure creates a risk to life or significant property damage should travel with a CoC regardless of whether the contract explicitly requires it.
• Customer flow-downs — If your customer’s purchase order references specific quality clauses, read them carefully. They almost always include CoC requirements.

Even for commercial work where no specific requirement exists, requesting a CoC is a reasonable expectation and a sign of a mature supplier. A supplier who pushes back on providing a basic CoC is a supplier worth scrutinizing.

If your parts go into an assembly that will eventually reach an AS9100 or aerospace prime, you almost certainly need a CoC — even if your own purchase order doesn’t call it out explicitly.

AS9100 Rev D — the quality management standard for aviation, space, and defense — places specific obligations on organizations regarding documented information and product conformance. Section 8.4 (Control of Externally Provided Processes, Products and Services) requires that organizations ensure externally provided products conform to specified requirements and that appropriate documentation accompanies those products. A CoC is a direct mechanism for meeting this requirement at each supplier tier.

ISO 9001:2015, while less prescriptive than AS9100, requires organizations to control externally provided products and to retain documented information demonstrating conformity. A CoC is one of the primary tools used to satisfy this requirement. The key difference is that ISO 9001 gives organizations more flexibility in how they implement this — AS9100 tightens the screws considerably, particularly for flight-critical components.

Working with a certified partner network matters here. When Nimble Manufacturing sources parts through its AS9100 and ISO 9001-certified partner network, CoC requirements are embedded in purchase order quality clauses from day one — not bolted on after the fact. That means the documentation package travels with every order, the supplier’s quality system has been vetted, and the traceability chain is intact when you need it for an audit or customer review.

For programs subject to International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR), the CoC takes on additional significance. Beyond confirming dimensional and material conformance, documentation for ITAR-controlled hardware must support a complete chain of custody. Any supplier in the chain must be ITAR-registered, and that registration status should be confirmed and documented before any controlled technical data or hardware changes hands.

A CoC for ITAR-controlled parts should reference the applicable ECCN (Export Control Classification Number) or USML category where relevant, and the supplier should be able to demonstrate that the work was performed by U.S. persons in a controlled facility. This is not just a documentation best practice — non-compliance with ITAR carries significant civil and criminal penalties for both the supplier and the buying organization.

In practice, this means your CoC review process for defense and space hardware needs to include a check that the issuing facility is currently ITAR-registered — not just that they were registered at some point in the past. Registration must be current and renewed annually with the Directorate of Defense Trade Controls (DDTC). Nimble’s partner network is ITAR-registered, and that status is maintained as a condition of participation — not a checkbox checked once and forgotten.

ITAR registration must be current at the time of manufacture and shipment. A lapsed registration invalidates the supplier’s authority to handle controlled hardware, regardless of past compliance history.

Procurement teams and quality engineers see the same CoC failures repeatedly. Knowing the common failure modes helps you write better purchase order requirements and catch problems before they become non-conformances. The most frequent issues include:

• Missing revision level — The CoC references a part number but not the drawing revision. If there have been multiple revisions, this creates ambiguity about which requirements were met.
• Unsigned or undated documents — A CoC without an authorized signature and date has no legal standing. Require name, title, and date explicitly in your PO quality clauses.
• Vague conformance language — Phrases like ‘parts are good’ or ‘meets customer requirements’ without referencing specific documents are not acceptable conformance statements.
• No material traceability — For metallic parts especially, the CoC should reference the material heat or lot number and the applicable specification (AMS, ASTM, etc.).
• Process omissions — If the drawing calls out a surface treatment, plating, or heat treat, the CoC must confirm those processes were performed to the specified standard. Omitting process callouts is a common gap.
• Wrong quantity — The quantity on the CoC must match the packing list and the physical shipment. Mismatches create receiving inspection failures and audit findings.

The fix is straightforward: write explicit CoC requirements into every purchase order quality clause, and train your receiving inspection team to verify CoC content before accepting a shipment.

The best time to establish CoC requirements is at the purchase order stage — not after parts arrive. Your PO quality clauses should spell out exactly what the CoC must contain, reference the applicable quality standards (AS9100, ISO 9001, customer-specific quality requirements), and identify who is authorized to sign. If you have customer-imposed flow-downs, those clauses should cascade directly into your supplier POs, word for word where possible.

For complex assemblies or multi-operation jobs — machining plus heat treat plus coating, for example — consider requiring a CoC at each major process step, not just at final shipment. This builds a layered documentation trail that is far easier to defend during an audit than a single end-of-line document. It also catches problems earlier: a heat treat CoC that flags a temperature deviation is more useful before the part is plated and shipped than after.

If you are sourcing custom machined parts, sheet metal fabrications, or other precision components and need a reliable documentation package with every order, Nimble’s certified partner network builds CoC requirements into every quote and order by default. Free DFM review and CMM inspection are included, and the documentation package — CoC, material certs, and inspection reports where required — is part of the deliverable, not an afterthought. Clear documentation requirements from day one prevent the surprises that slow programs down.

Rule of thumb: if the part could ever end up in an audited supply chain, require a CoC. The cost of generating the document is trivial. The cost of reconstructing traceability after the fact is not.

READY TO SOURCE?

Table of Contents

Related Services

Get a Quote in 24h

Upload your drawing and get a detailed quote with free DFM review.