Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AAP-20
NATO bodies, Agencies, Groups of Nations and Nations managing a defence programme through its life cycle
NATO's generic, tailorable framework for managing a defence programme through decision-gated stages, from a capability gap to retirement.
AAP-20, the NATO Programme Management Framework, is also known as the NATO Life Cycle Model. AAP stands for Allied Administrative Publication, and this one is generic and tailorable: it sets out how a NATO, multinational or national defence acquisition programme moves from an identified capability gap to a fielded system, and eventually to that system's retirement. Nations record their agreement to use it in STANAG 4728, and the current Edition C, Version 1 (October 2015) superseded Edition 2.
AAP-20 is written for the customer side of a programme, not for a supplier. It addresses NATO bodies, Agencies, Groups of Nations and Nation(s) who own a programme and are accountable for delivering the capability it is meant to produce. Industry executes the resulting contracts, but the document is explicit that accountability for the programme never transfers to industry, however much of the day-to-day product life cycle work industry actually carries. A supplier encounters AAP-20 only when a tender, contract, or Programme Memorandum of Understanding (MOU) invokes its structure, and from that point the supplier's own deliverables, reviews and configuration milestones are timed to the customer's stage-gate decisions rather than to the supplier's own project plan.
The framework divides a programme into seven stages: Pre-Concept, Concept, Development, Production, Utilisation, Support and Retirement.
Pre-Concept identifies and documents stakeholder requirements and high-level risk. Concept, split into a Study Phase and a Programme Establishment Phase, evaluates alternative technical concepts, including a market survey of off-the-shelf options, and produces preliminary system requirements plus initial Configuration Management, Integrated Logistics Support (ILS) and Obsolescence Management plans. Development fully validates the selected technical solution through detailed engineering and prototyping. Production manufactures and tests the system and runs acceptance tests. Utilisation is where the fielded system is operated, monitored, and has anomalies and failures recorded and resolved. Support runs the logistics, maintenance and support services that keep it operating. Retirement, in a Disengagement Phase followed by a Liquidation Phase, withdraws the system from service and disposes of it against an approved Programme Liquidation Strategy, addressing safety, security and environmental requirements along the way.
Each stage ends with a decision gate and needs a Programme MOU or Stage Approval Document before the next stage can begin. A modification or upgrade made to a system already in Utilisation or Support runs its own miniature version of this same sequence, from a Pre-Concept-style needs assessment through to production of the modification kit, rather than being handled as an informal change.
AAP-20 describes no accreditation scheme, no certifying body and no external assessor. What decides whether a programme moves forward is a decision gate: a point in the life cycle where past work is checked as mature and validated, future work is agreed, and the outcome, proceed, continue, revert to an earlier stage, hold, or terminate, is documented. That decision is made by the customer, not by a third party, and it can send a programme backward to a preceding stage as a normal outcome, not a failure.
A supplier's deliverables are reviewed against the entry and exit criteria the customer has set for a given gate. Where the document does use the word "certification," it is about the product, an item's safety or environmental certification, or software certified before it is incorporated into a system, never about an organisation being "AAP-20 certified." No such credential exists.
Where the standard stage sequence would be too slow for an urgent operational requirement, AAP-20 describes Accelerated Fielding: fast tracking (compressing or cutting steps and documentation), multi-stage decisions (obtaining approval for more than one stage at once), increased use of off-the-shelf products, and technology insertion into systems already in service. Each comes with its own named risks, from unforeseen performance problems to lost resources from a wrong compressed decision, and none of them lowers the underlying obligation; they change its timing and packaging.
AAP-20 says plainly that it should be used together with AAP-48, which defines the System Life Cycle Management processes that actually populate AAP-20's stage structure with activities. AAP-20 supplies the skeleton of stages, gates and criteria; AAP-48 supplies what fills it. Beyond that companion document, AAP-20 requires no prior capability or management system: it is a framework to plan a programme within, not a bar to clear first.
The document also keeps a distinction easy to miss: the System-of-Interest itself is tracked separately from "enabling systems," simulators, ground equipment, tools, spare parts, that support the system through its life without performing its operational function. Both have to reach maturity for the programme to succeed, but AAP-20 does not treat them as one thing.
NATO publishes AAP-20 through the NATO Standardization Document Database at no charge. ComplyTrain does not sell it or host a copy; the NSDD listing for AAP-20 is the source.
AAP-20 is a programme-management framework, not a quality-management standard a company implements internally, so there is no product mapping to claim here. The actual work it describes, running decision gates, drafting Programme MOUs and Stage Approval Documents, maintaining Configuration Management and ILS plans, tracking obsolescence, conducting After Action Reviews, happens in the day-to-day running of a programme, not in software.
What a supplier delivering into an AAP-20-governed programme needs is disciplined document control: version-controlled procedures for configuration management and logistics support, training records for the people running them, a defensible audit trail of what was delivered against which stage's entry and exit criteria, and traceable records of corrective actions and lessons learned. ComplyTrain supports that kind of work generally, as an auditable quality management system: controlled documents, training records, internal audits, and corrective-action tracking that a customer can inspect at any stage gate.
ComplyTrain does not chair a programme's decision gates, judge whether a stage's exit criteria are met, or stand in for the customer's own accountability for the programme. Those calls stay with the NATO body, Nation, or group of Nations that owns it. If your organisation needs to evidence its part of an AAP-20-governed programme, talk to us about how the documentation and training side of that fits together, and see the standards explorer for what sits alongside AAP-20 in your programme.
Tell us how you need to work with AAP-20 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AAP-20 describes no accreditation scheme and no certifying body; a programme progresses through internal decision gates run by its customer (NATO, a Nation, or a group of Nations), not through a third-party audit. Nobody and no organisation can be "AAP-20 certified."
AAP-20 itself says it is a guide intended to complement, not replace, national acquisition policies, and nations record their agreement to use it through STANAG 4728. Whether it binds a particular supplier depends on whether a specific tender, contract, or Programme MOU requires deliverables to follow its stage structure, not on the document existing.
AAP-20 defines the skeleton, the stages, decision gates, and entry and exit criteria that structure a programme. AAP-48 defines the System Life Cycle Management processes that fill that skeleton with actual activities and tasks. AAP-20 says explicitly that it should be used together with AAP-48, not instead of it.
Yes. AAP-20's own system concept describes a solution realised "by hardware, software, or services," and its Development Stage description specifically addresses software validation and certification before incorporation into a system.
Accelerated Fielding is AAP-20's set of adjustments, fast tracking, multi-stage decisions, off-the-shelf procurement, and technology insertion, for meeting an urgent operational need faster than the standard stage sequence allows. It carries its own named risks, such as reduced testing or an immature design reaching production, and does not remove the underlying stage-gate obligation.
NATO publishes it free of charge through the NATO Standardization Document Database. ComplyTrain does not sell or host copies of NATO documents.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.