Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AAP-03
NATO's own tasking authorities, working groups and custodians, and the Allied and partner nations that ratify or approve the standards this process produces, not commercial suppliers
AAP-03 is NATO's internal directive setting out how NATO standardization documents get proposed, developed, ratified or approved, promulgated and reviewed. It creates no direct obligation for a supplier.
AAP-03 is NATO's own directive for how NATO standardization documents get made. It is not a technical requirement a company implements; it is the process description behind every STANAG, STANREC, AAP, AQAP and AEP in this catalogue, setting out how each one is proposed, developed, ratified or approved, promulgated, put to use, and eventually reviewed or cancelled. It is Edition K, Version 3, promulgated in June 2026, and it names its own audience plainly: tasking authorities, delegated tasking authorities, working groups, custodians, Allied nations, partner nations and NATO bodies. A supplier or contractor is never named, because none of this reaches one directly.
The directive is explicit about its own readership: it "establishes procedures for tasking authorities (TAs), delegated tasking authorities (DTAs), their subordinate working groups (WGs), custodians, Allies, partner nations, NATO bodies, and anyone involved with producing, maintaining and managing NATO standardization documents." Every one of those is part of NATO's own governance structure or a member or partner nation acting through it. There is no supplier role, no acquirer role and no contract mechanism defined anywhere in the document. That is a genuine difference from most of the standards in this catalogue: a STANAG or an AQAP eventually reaches a company through a contract clause, but AAP-03 governs the machinery that writes those documents, one level removed from any commercial relationship.
NATO runs standardization through seven phases. Requirements are identified either top-down, from a high-level directive such as a NATO summit priority, or bottom-up, from a standardization proposal any interested party can submit once a gap is found. Allies then validate the need and turn it into an approved standardization task that specifies the solution, the covering document, the working group and the custodian. The working group develops the actual document, working through a strict order of preference: adopt a suitable non-NATO standard first, then modify an existing NATO standard, then look for a civil body to co-develop one, and only then write something entirely new.
A STANAG then goes through ratification by Allied nations, who respond with one of six positions ranging from full agreement to "not participating." A STANREC goes through a lighter approval process by consensus instead, because it recommends rather than commits. Administrative publications that deal purely with internal process, including AAP-03 itself, need no covering document at all and are approved directly by the sponsoring committee's silence procedure. Once promulgated, Allies and NATO bodies report their implementation status through NATO's electronic reporting tool, and every document comes up for review at least every five years, where it can be retained, amended, revised into a new edition, cancelled, or handed over to a civil standards body.
Most Allied standards are wrapped in a covering document: a STANAG where nations commit to implement it, or a STANREC where they are only invited to. AAP-03 explains this distinction in detail, but the directive does not carry either covering document itself. Administrative publications that deal primarily with internal process are the one exception the directive names, and they are approved by silence procedure among the sponsoring NATO committee instead. That is worth knowing if you are trying to work out a document's status from the catalogue: not every AAP has been "ratified" in the STANAG sense, and asking whether it has is the wrong question for this kind of document.
A recurring theme of the directive is that NATO would rather adopt an existing standard than write a new one. Tasking authorities are directed to adopt and refer to suitable non-NATO standards to the maximum extent, preferring civil standards to defence standards where a suitable one exists, and NATO can co-develop a standard jointly with a civil standards body under a formal agreement rather than writing it alone. Where content from a non-NATO standard is reproduced, that only happens with the copyright holder's permission and proper attribution. This is why several documents in this catalogue are ISO, IEC or other civil standards under a NATO cover rather than NATO originals.
AAP-03 is published by the NATO Standardization Office and, like every NATO standardization document, it carries no charge. The Standardization Document Database is the authoritative source, and national standardization authorities can also supply a copy. We credit NATO for the catalogue and neither sell nor host a copy ourselves.
AAP-03 is a policy and process document, not a requirement set, so there is nothing here for a company to implement directly, in the same way there is nothing to implement directly against a NATO policy statement. Its value to a reader is context: understanding why a specific STANAG or AQAP your contract cites carries the edition letter, version number and ratification status it does, and why one document sits under a covering agreement while another does not.
Where ComplyTrain actually helps is with the documents this process produces, once your contract or a customer's quality clause names one of them: holding the procedures, training records, internal audits and corrective-action evidence an assessor for that specific standard will ask to see, kept current and ready to hand over. That work sits entirely with the AAP, AQAP or STANAG your contract invokes, not with AAP-03 itself.
What we do not do: we do not track NATO's own ratification, approval or review status for any document, and we cannot tell you which standard your particular contract invokes or which tier applies to it - that is set by the acquirer and the contract's quality clause, never by us. The standards explorer shows what else sits in the catalogue alongside AAP-03, and we are glad to talk through where a specific document's status leaves your obligations.
Tell us how you need to work with AAP-03 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No, not directly. AAP-03 governs how NATO itself produces, ratifies and reviews standardization documents; it names tasking authorities, working groups, custodians and Allied nations as its audience, never a supplier or contractor. A company's obligations come from the specific STANAG, AQAP or AEP that a contract invokes, not from this directive.
A STANAG is the agreement by which Allied nations commit to implement a standard. A STANREC is the lighter version: nations are only invited to follow it, with no ratification commitment. An AAP, Allied Administrative Publication, is the document type this catalogue holds many of, including AAP-03 itself; some AAPs are wrapped in a STANAG or STANREC, and purely administrative ones like this directive carry neither.
No. The AQAPs (Allied Quality Assurance Publications) are technical publications that set out quality requirements a supplier's contract can invoke. AAP-03 is one level up: it is the directive that governs how documents like the AQAPs get written, ratified, promulgated and reviewed in the first place, not a quality requirement itself.
The directive itself explains the exception: Allied Administrative Publications that deal primarily with administrative functions do not require a covering document, and are approved instead by the sponsoring NATO committee's silence procedure. AAP-03 is exactly that kind of publication.
This page describes Edition K, Version 3, promulgated in June 2026, which supersedes Edition K, Version 2 and updates references to match AAP-32's own newest edition. NATO standardization documents, including this one, are due for review at least every five years.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.