PO Quality Flow-Down Clauses: A Numbered Template
These are 16 numbered purchase order quality clauses a buyer can adapt and cite as "Q1" to "Q16": quality system, right of access, AS9102 first article, special process approval, counterfeit prevention, DFARS specialty metals, record retention, change notification, MRB authority, FOD, sub-tier flow-down, CoC content, CUI and cybersecurity, export control and GIDEP reporting, each cited to its source.
Updated
How to use these clauses
Below are 16 numbered PO quality clauses with model wording you can adapt, each tied to the standard or regulation it comes from. Put the ones that apply on the PO by number, for example "Q1 to Q8, Q12 and Q13 apply", and keep the text in a controlled quality clause document with a revision letter so suppliers can see which version governs.
The model wording is deliberately short. Where your customer flows a longer clause to you, cite it inside the matching clause here rather than paraphrasing it. Our supplier quality clauses page describes what the Boeing, Lockheed Martin, Northrop Grumman, RTX and NASA documents require; this page is the buyer's own set that carries those requirements, and the federal ones, down one tier.
AS9100D clause 8.4.3 is the reason this list exists. It lists the information an organization must communicate to its external providers, and certification bodies such as NSF describe it as the clause where flow-downs live, including right of access. Items that do not apply to a given PO can be excluded, but the exclusion should be justified and recorded.
Clauses Q1 to Q4: precedence, quality system, access and FAI
| No. | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| Q1 | Order of precedence and revision | "Requirements apply at the revision in effect on the PO date. Conflicts are resolved in this order: PO face, these clauses, drawing, specifications. The seller shall ask in writing before proceeding on any conflict." | Prime documents set their own precedence rules; stating yours prevents a supplier picking the convenient reading |
| Q2 | Quality system | "Seller shall maintain a quality management system certified by an accredited registrar listed in IAQG OASIS to AS9100 (manufacturers), AS9120 (distributors) or, where the buyer allows, ISO 9001. Seller shall notify the buyer in writing within [n] business days of any loss, suspension or change of certification or registrar." | AS9100D and AS9120B are the aerospace editions in use; confirm the current revision on SAE. Writing "at the revision in effect" keeps the clause valid through the next IAQG revision |
| Q3 | Right of access | "The buyer, its customers and regulatory or government representatives shall have access to seller and sub-tier facilities, records and product involved in this order. Seller shall include this right in its sub-tier orders and provide reasonable facilities and assistance at no charge." | FAR 52.246-2 (Aug 1996) requires a contractor to provide, and require subcontractors to provide, reasonable facilities and assistance for government inspection at no increase in price |
| Q4 | First article inspection | "Seller shall perform FAI to SAE AS9102 at the revision in effect on the PO date (currently AS9102C), full or partial as the AS9102 triggers require, and submit Forms 1 to 3 with ballooned drawing before or with the first shipment. Seller shall give [n] business days notice before FAI." | Primes add notice and submission rules on top of AS9102; see AS9102 first article inspection |
Clauses Q5 to Q8: special processes, counterfeit, specialty metals and records
| No. | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| Q5 | Special process approval | "Special processes (for example heat treat, plating, anodize, chemical processing, NDT, welding) shall be performed only by sources approved by the buyer or, where invoked, by the end customer for that specification. Process certifications shall identify the processor, specification and revision, and lot." | Special processes cannot be fully verified on the finished part. Nadcap, run by the Performance Review Institute, accredits processors, but a prime's approved list may still govern |
| Q6 | Counterfeit prevention | "Seller shall maintain a counterfeit prevention program to AS5553 (EEE parts), AS6174 (materiel) or AS6081 (distributors) as applicable; buy from the original manufacturer or its authorized sources; provide traceability on request; and quarantine and report suspect parts to the buyer within [n] hours." For DoD electronic parts add: "DFARS 252.246-7007 and 252.246-7008 apply." | DFARS 252.246-7008 (Jan 2023) sets three source tiers and flows to subcontracts for electronic parts or assemblies containing them, including commercial products. 252.246-7007 (Jan 2023) flows to the same subcontracts; its paragraphs (a) to (e) apply only where the prime is subject to Cost Accounting Standards |
| Q7 | Specialty metals | "DFARS 252.225-7009 paragraphs (a) through (c) and (e)(2) apply. Seller shall provide evidence of compliant melt or production source on the certification." | The clause (Jan 2023) must be inserted, without alteration except to identify the parties, in subcontracts for items containing specialty metals, including commercial products; see DFARS specialty metals |
| Q8 | Record retention | "Seller shall retain quality records for this order, including certifications, inspection and test data, FAI, nonconformance and corrective action records, for [n] years after final payment, and shall not destroy them without written buyer approval. Records shall be retrievable on request." | FAR 4.703(a) sets a general three years after final payment for contractor records; primes often require longer, counted from different start dates; see records, change control and FOD |
Clauses Q9 to Q12: change, nonconformance, FOD and sub-tiers
| No. | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| Q9 | Change notification | "Seller shall notify the buyer in writing and obtain approval before changing the design, material source, special process source, manufacturing location, key process or sub-tier for product on this order. Notice is also required for changes in ownership or management that affect the quality system." | Most process and source changes trigger a partial or new FAI under AS9102, so you need to know before product ships |
| Q10 | Nonconformance and MRB authority | "Seller has no material review authority unless the buyer delegates it in writing. Use-as-is and repair dispositions require written buyer approval before shipment. Seller shall notify the buyer within [n] business days of discovering nonconforming product already delivered." | Prime clauses limit supplier MRB authority and put deadlines on escape notices; see corrective action and SCAR |
| Q11 | Foreign object prevention | "Seller shall maintain a FOD prevention program meeting the intent of NAS412, or AS9146 where the buyer specifies it, and flow it to sub-tiers where debris can be entrapped. Delivery certifies that product and packaging are free of foreign objects." | AIA released a revised NAS412 on August 31, 2023; SAE AS9146 (issued April 2017, reaffirmed September 8, 2022) sets FOD program requirements |
| Q12 | Sub-tier flow-down | "Seller shall flow the applicable requirements of this PO, including these clauses and the drawing and specification revisions, to every sub-tier supplier, and remains responsible for sub-tier conformance." | AS9100D 8.4.3 requires flow-down; several federal clauses require their own flow-down in exact words, so list them by number |
Clauses Q13 to Q16: certificate, CUI, export and GIDEP
| No. | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| Q13 | Certificate of conformance | "Each shipment shall include a CoC stating: PO and line; part number and revision; quantity; lot, heat or serial numbers; specifications met with revisions; any approved deviations by number; and the name, title and signature of an authorized seller representative." | A CoC that cannot be traced to the PO line and lot is a common receiving reject; see certificate of conformance |
| Q14 | CUI and cybersecurity | "Where this order involves covered defense information, DFARS 252.204-7012 applies without alteration except to identify the parties. Where it involves FCI or CUI, DFARS 252.204-7021 applies and seller shall hold a current CMMC status at the level stated on the PO and keep its SPRS affirmation current." | 7012 (May 2024): report cyber incidents to DoD within 72 hours and give the prime the DoD incident report number. 7021 (Nov 2025): verify the sub's CMMC status before award. Details below |
| Q15 | Export control | "Technical data and hardware on this order may be controlled under the ITAR or the EAR as marked. Seller shall comply with both, shall not release controlled data to foreign persons or sub-tiers without authorization, and shall include this requirement in all sub-tier orders." For DoD work add: "DFARS 252.225-7048 applies." | DFARS 252.225-7048 (June 2013) requires compliance with the ITAR and EAR and must be included in all subcontracts |
| Q16 | Reporting nonconforming items | "Where FAR 52.246-26 is in the prime contract and applies to this order, it is incorporated. Seller shall notify the buyer promptly of counterfeit, suspect counterfeit or major or critical nonconformances." | FAR 52.246-26 (Aug 2024) requires GIDEP reports within 60 days and flows to subcontracts for higher-level-quality items, critical items and, on DoD contracts above the simplified acquisition threshold, electronic parts; it does not flow to commercial products |
Clause Q14 in detail: DFARS 7012 and CMMC status
As of October 2026, DFARS 252.204-7012 and NIST SP 800-171 still apply to subcontractors handling covered defense information, CMMC Phase 1 self-assessments are in effect, and Phase 2 certification requirements are suspended. Write Q14 so it follows whatever level the contract states rather than a fixed phase.
The current 252.204-7012 text, dated May 2024, defines rapid reporting as within 72 hours of discovery, applies the NIST SP 800-171 version in effect when the solicitation was issued unless the contracting officer authorizes otherwise, and requires the clause to flow unaltered to subcontracts for operationally critical support or involving covered defense information. A subcontractor reports incidents to DoD and passes the incident report number to the next tier up.
DFARS 252.204-7021, dated November 2025, must be included in subcontracts that will process, store or transmit FCI or CUI, excluding commercially available off-the-shelf items. Before award, the prime must confirm the subcontractor has a current CMMC certificate or status at the right level, and the subcontractor must complete its SPRS affirmation before award and then annually.
| Item | Status as of October 2026 |
|---|---|
| CMMC Phase 1 (Level 1 and Level 2 self-assessments) | In effect since the DFARS rule took effect November 10, 2025 |
| CMMC Phase 2 (Level 2 third-party certification) | Was due November 10, 2026; suspended by a July 13, 2026 memorandum, with later phases on hold |
| CMMC Reform Task Force | Set up July 13, 2026 for a 60-day review; check the DoD CIO CMMC page for its outcome |
| DFARS 252.204-7012 | Unchanged and still in contracts |
| Existing contracts with Phase 2 terms | Remain until changed by contract modification, according to law firm summaries of the memorandum |
Because the status may change after this page is written, confirm the current wording of both clauses on acquisition.gov and the CMMC status with your contracts team before issuing a PO. Our supplier-side page on CMMC levels and cost covers what the levels mean for a shop.
Which clauses to put on which PO
Not every clause belongs on every order. A short rule set keeps POs accurate and keeps suppliers from pricing in requirements you do not need.
| Purchase | Typical clauses | Notes |
|---|---|---|
| Machined or fabricated part, commercial or NASA end use | Q1 to Q5, Q8 to Q13, Q15 | Add the NASA project's quality requirements where flowed |
| Machined part on a DoD contract containing titanium or alloy steel | Q1 to Q5, Q7 to Q13, Q15, plus Q14 if the drawing is CUI | Q7 only if 252.225-7009 is in your contract |
| Electronic parts or assemblies containing them, DoD | Q1, Q2, Q6, Q8 to Q10, Q12 to Q16 | Check whether 252.246-7007 applies at your tier |
| Purchase from a distributor | Q1, Q2 (AS9120), Q6, Q8, Q9, Q13, Q15 | See buying from AS9120 distributors |
| Outside special process only | Q1, Q2, Q5, Q8 to Q10, Q13 | Name the specification, revision and approval reference |
Put the same clause numbers on the RFQ so suppliers price them; field G4 of our aerospace RFQ template is where they go.
How to adapt this template
Start from what your customer flows to you, then add what your own quality system needs. Practical steps:
- List every clause in your prime contract and customer quality document that requires flow-down, by number and revision.
- Map each one to Q1 to Q16. Where a federal clause must flow "without alteration", reference it by number rather than rewording it.
- Fill the bracketed periods, such as notice days and retention years, with values at least as strict as the ones you owe your customer.
- Publish the set as a controlled document with a revision letter and date, and cite that revision on every PO.
- Review it whenever a customer document, an SAE standard or a DFARS clause changes, and at least once a year.
This is a template, not legal advice. Federal clause applicability depends on contract type, dollar value and what is purchased. Have your own contracts, export compliance and quality teams review and approve the final wording before use.
Have your clauses flowed down for you
When you request a quote, attach your quality clauses or tell us which of Q1 to Q16 apply. We flow them to the suppliers we match by number and revision, check the certs and FAI against them before delivery, and ship every order with a certificate of conformance plus the other documents your request requires. A person replies within 1 business day. If your order carries CUI or export-controlled data, read confidentiality and controlled programs first; that data never moves through the website.
Send the job. A person replies within 1 business day.
Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.
We have it.
Reference . A person replies within 1 business day. Watch for our email from [email protected].
Questions
What are PO quality flow-down clauses?
They are the quality requirements a buyer attaches to a purchase order so the supplier, and the supplier's own suppliers, meet the same rules the buyer owes its customer. Typical clauses cover the quality system, right of access, first article inspection, special process approval, counterfeit prevention, record retention, change notification, nonconformance authority and federal clauses such as DFARS specialty metals or cybersecurity. AS9100D clause 8.4.3 is the requirement that drives them.
Can I reword a DFARS clause when I flow it down?
Usually not. Several clauses say how they must flow. DFARS 252.225-7009 says paragraphs (a) through (c) and (e)(2) go into subcontracts without alteration except to identify the parties, and DFARS 252.204-7012 must be included unaltered except to identify the parties. The safe practice is to cite the clause by number and date in your PO and keep your own explanatory wording separate.
Is CMMC required for my suppliers right now?
As of October 2026, CMMC Phase 1 self-assessment requirements are in effect, and Phase 2 third-party certification was suspended on July 13, 2026 pending a reform review. Where your contract includes DFARS 252.204-7021, you must still flow it to subcontracts handling FCI or CUI and confirm the subcontractor's CMMC status before award. DFARS 252.204-7012 still applies. Check the DoD CIO page and your contract before relying on any date.
How long should suppliers keep quality records?
There is no single number. FAR 4.703(a) sets a general three years after final payment for contractor records, but prime quality clauses often require longer periods, such as seven or ten years, and start the clock at different events. Set your PO clause to at least the longest period you owe any customer for that product, and require written approval before records are destroyed.
Should a supplier have material review board authority?
Not unless you delegate it in writing. A typical clause says the supplier may scrap or rework to drawing on its own, but any use-as-is or repair disposition needs the buyer's written approval before shipment, because those dispositions accept product that does not meet the drawing. Many prime clauses impose the same limit on you, so your sub-tier clause should be at least as strict.
Do counterfeit prevention clauses apply to mechanical parts and raw material?
The DFARS counterfeit clauses 252.246-7007 and 252.246-7008 are written for electronic parts. Prime quality clauses and SAE AS6174, which covers materiel generally, extend authorized sourcing and traceability expectations to other items, including fasteners and raw material. A buyer clause that requires purchase from the original manufacturer or its authorized sources, traceability on request and quarantine of suspect items covers both cases.
Related
Sources
- NSF, Clarifying AS9100 8.4.3 and flow-downs to external providers
- Acquisition.gov, FAR 52.246-2 Inspection of Supplies, Fixed-Price (Aug 1996)
- Acquisition.gov, FAR 4.703 Policy (contractor records retention)
- Acquisition.gov, DFARS 252.246-7007 Contractor Counterfeit Electronic Part Detection and Avoidance System (Jan 2023)
- Acquisition.gov, DFARS 252.246-7008 Sources of Electronic Parts (Jan 2023)
- Acquisition.gov, DFARS 252.225-7009 Restriction on Acquisition of Certain Articles Containing Specialty Metals (Jan 2023)
- Acquisition.gov, DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024)
- Acquisition.gov, DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025)
- Crowell and Moring, Department of War suspends CMMC Phase II requirements, launches 60-day reform review (July 2026)
- Acquisition.gov, DFARS 252.225-7048 Export-Controlled Items (June 2013)
- Acquisition.gov, FAR 52.246-26 Reporting Nonconforming Items (Aug 2024)
- AIA, revised NAS412 Foreign Object Damage/Foreign Object Debris Prevention released August 31, 2023
Ready to
source it?
A person replies within 1 business day. NDA first.
Request a quote