St. Louis, Missouri
ISO 9001 consulting for St. Louis manufacturers.
Missouri has a regulation that requires a quality management system built to a published standard, and names ISO first among the routes. Most consultants here have never read it.
We work in the Kansas City metro. Engagements here run remotely, with on-site visits at the points where being in the building changes the outcome — gap analysis, internal audit, and the certification audits themselves. We do not maintain an office in this market and would rather say so than imply otherwise.
A state rule that names the standard
Most of what drives ISO 9001 in a given market is customer pressure. Occasionally a regulator writes the requirement down, and when that happens it is worth knowing the exact words.
Missouri rule 19 CSR 100-1.100(4)(D), effective 30 July 2023, says this: “Licensees shall implement a quality management system using a published standard, such as those offered by International Organization for Standardization, ASTM International, Cannabis Safety and Quality, or Foundation of Cannabis Unified Standards, within one (1) year of the date the facility receives department approval to operate.”
Read it carefully, because the precision matters in both directions. The quality management system is mandatory, on a one-year clock from operating approval, and it must be built to a published standard applicable to the facility type. But ISO is one of four named families, not the only route — so anyone telling you Missouri requires ISO 9001 has overstated it, and we are not going to.
What we will say is that ISO is the first named option, it is the one with an established certification infrastructure, and for a facility that also sells or supplies outside this sector it is the only one of the four that means anything to a non-cannabis customer.
Industry in St. Louis
- Missouri Division of Cannabis Regulation 19 CSR 100-1.100(4)(D) requires licensed facilities to implement a QMS using a published standard within a year of approval to operate, naming ISO among four families
- Licensed testing facilities 19 CSR 100-1.110 requires ISO/IEC 17025 accreditation from an ILAC-recognised body, with penalties reaching $1,000 per day
- Next NGA West $1.75 billion and 97 acres in north St. Louis, opened 26 September 2025 — a supply chain governed by CMMC and NIST SP 800-171, not ISO 27001, and Phase 2 of CMMC was suspended in July 2026
- Boeing Defense, Berkeley The region's defining manufacturer and an AS9100 supply chain. We do not offer AS9100, and we would rather say so before the first call than after the third
- 39 North and the plant science cluster Real and substantial, and we could not verify a documented ISO requirement attached to it. Named as context, not as a hook
The testing laboratory rule has teeth, and a number attached
The companion rule is sharper. 19 CSR 100-1.110 requires licensed testing facilities to hold ISO/IEC 17025 accreditation from an internationally recognised accreditation body, within one year of operating approval, with a scope covering all required testing, maintained for the life of the certification.
The penalty for non-compliance is stated: fines of up to $1,000 per day, plus suspension of testing until the facility is re-approved.
That is a materially different conversation from a customer preference. And it is worth noting the wording carefully, because it is the distinction most consultants get wrong: laboratories are accredited to ISO/IEC 17025, never certified, and accreditation is granted method by method on a scope document. A laboratory can hold a current accreditation and still be outside scope for a specific required test. See ISO/IEC 17025.
One honesty note: this is a statewide Missouri requirement rather than a St. Louis one. It applies equally in our home market in Kansas City. We are not going to dress a state rule up as a local secret.
The biggest manufacturing story in this region is one we cannot help with
We would rather say this plainly than have you discover it after a proposal.
Boeing Defense is the dominant manufacturing employer in this region — more than 18,000 people, the F-47 next-generation fighter contract won in March 2025, and a defence headquarters returning to greater St. Louis, announced in February 2026. It is the first thing anyone writing about St. Louis manufacturing reaches for.
Aerospace and defence supplier flow-down runs through AS9100, and we do not offer AS9100 consulting. Nor Nadcap. If your customer is naming either, you need a different firm.
What we do here is the general quality management system underneath — and for a shop that serves both defence and commercial customers, which describes a great many St. Louis suppliers, that half is squarely what we build.
And the second-biggest story is one where the requirement is not ISO at all
Next NGA West opened on 26 September 2025 — a $1.75 billion, 97-acre intelligence campus with a 700,000 square foot office building at Jefferson and Cass Avenues in north St. Louis. It is the largest federal investment in the city in living memory, and it comes with a supply chain.
The security requirement attached to that supply chain is CMMC, and CMMC is not ISO 27001. Level 1 is the fifteen requirements in FAR 52.204-21. Level 2 is the 110 requirements of NIST SP 800-171 Revision 2. No ISO standard is named as acceptable anywhere in it. The acquisition rule took effect on 10 November 2025, and requirements flow down to subcontractors.
There is a further wrinkle that most pages have not caught up with. On 13 July 2026 the Department of Defense suspended CMMC Phase 2 — the third-party assessment phase — and opened a sixty-day review, stating that the programme imposes significant and often prohibitive burdens on the defence industrial base. Phase 1 self-assessment obligations remain in force.
So a consultant selling ISO 27001 as your route into the NGA supply chain is wrong twice: wrong about which framework applies, and out of date on the framework that does.
What is actually being built, and who regulates you
Two food manufacturing investments in four months, both verifiable and both in the metro. Winland Foods announced $38.5 million and 25 new jobs on East Marceau Street in the city of St. Louis in April 2026, expanding pasta production. Bertagni 1882, the Italian filled-pasta maker, announced $36.4 million and 150 jobs for its first United States facility, in St. Charles, in August 2026.
The metro has 2,220 manufacturing establishments, 1,993 of them with fewer than 100 employees (US Census County Business Patterns, 2023).
On the regulatory side, an unusual situation worth getting right. Missouri has no OSHA-approved State Plan, so private-sector workplaces here fall under federal OSHA. The metro also straddles into Illinois — and Illinois' State Plan covers public employees only. So private employers on both sides of this river are under federal OSHA, which is not true of most multi-state metros and is the sort of thing a template gets wrong.
How we work with companies here
We are based in the Kansas City metro, which puts St. Louis at the other end of the same state and a straightforward drive. On-site work here is a normal working assumption rather than a budget line.
For a licensee working to the one-year clock in 19 CSR 100-1.100, that matters — the gap analysis and the first internal audit are far more useful done in the building than over a call.
The consultant who scopes the engagement does the work. No handoff to a junior implementer after the sale.
What an engagement covers
- Quality management system to a published standard What 19 CSR 100-1.100(4)(D) actually requires: a QMS built to a published standard applicable to your facility type, within one year of operating approval. We build the ISO 9001 route — see ISO 9001.
- ISO/IEC 17025 for testing facilities The accreditation 19 CSR 100-1.110 requires, with the scope covering every required test. Laboratories are accredited, not certified, and the scope is what an assessor reads.
- ISO 9001 system build For manufacturers outside the licensed sector: a quality management system designed around your processes rather than a template with your logo on it.
- Gap analysis and roadmap Two to four weeks, fixed scope and price, with a clear go or no-go before real money is committed.
- Internal audit and management review Auditor-grade internal audits and a facilitated management review producing recorded decisions.
- Compliance obligations register Built on federal OSHA for both sides of this metro, because neither Missouri nor Illinois covers private-sector workplaces — see ISO 45001.
- ISO 9001:2026 readiness The revision is scheduled for 16 September 2026. We build the changes in now so your transition is an update rather than a rebuild — see what changed in ISO 9001:2026.
Questions we get from companies in this market
Does Missouri require ISO 9001?
Not exactly, and the precision matters. Rule 19 CSR 100-1.100(4)(D) requires licensed marijuana facilities to implement a quality management system using a published standard within one year of operating approval, and names ISO first among four families — ISO, ASTM International, Cannabis Safety and Quality, and the Foundation of Cannabis Unified Standards. So the quality management system is mandatory and ISO is a named route, but it is not the only one. Anyone telling you Missouri requires ISO 9001 has overstated the rule. What we would add is that ISO is the only one of the four that means anything to a customer outside the sector.
What happens if a testing facility misses the 17025 deadline?
Rule 19 CSR 100-1.110 requires ISO/IEC 17025 accreditation from an internationally recognised body within one year of operating approval, with the scope covering all required testing. The stated penalty for non-compliance is fines of up to $1,000 per day, plus suspension of testing until the facility is re-approved. That is unusually specific for this kind of rule, and it is the reason laboratory work here runs on a real clock.
We supply Boeing. Can you help?
Only with the general quality management system underneath. Aerospace and defence flow-down runs through AS9100, and we do not offer AS9100 or Nadcap consulting. We say that here rather than after a discovery call. A great many St. Louis shops serve both defence and commercial customers, and the commercial half is squarely what we build — but if AS9100 is what your customer names, you need a different firm.
Is ISO 27001 the way into the NGA supply chain?
No. The requirement is CMMC, which is built on federal standards rather than ISO ones — Level 1 is the fifteen requirements of FAR 52.204-21 and Level 2 is the 110 requirements of NIST SP 800-171 Revision 2. No ISO standard is named as acceptable anywhere in the framework. Worth knowing too that the Department of Defense suspended CMMC Phase 2 in July 2026 pending a sixty-day review, while Phase 1 self-assessment obligations remain in force. Anyone selling ISO 27001 as the NGA on-ramp is wrong on both counts.
Which OSHA applies to us here?
Federal, on both sides of the river, which is unusual for a two-state metro. Missouri has no OSHA-approved State Plan at all. Illinois has one, but it covers state and local government workers only. So a private manufacturer in St. Charles and a private manufacturer in Belleville are both under federal OSHA. A compliance obligations register that assumes a state programme on either side will be wrong.
What will certification cost?
Audit days are set from the number of people inside your certification scope against a published table, then adjusted for factors including system maturity and single-site operation. Our certification cost breakdown reproduces the table so you can check any quote you are given rather than take the number on trust.