Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AOP-4497
A HEM design authority developing a new hand-emplaced munition, and the safety approving authority of the developing nation that reviews and certifies the design
AOP-4497 sets NATO's general design principles and safety criteria for hand-emplaced munitions; a national safety approving authority, not an accredited body, certifies each design's compliance.
AOP-4497 is the NATO Allied Ordnance Publication that provides "general design principles and specific safety criteria applicable to Hand-Emplaced Munitions (HEMs) throughout their life cycles". This is Edition A, Version 1, promulgated September 2020, and the document names no earlier edition it supersedes. It is written for the design authority responsible for developing a HEM, who demonstrates compliance "to the satisfaction of the safety approving authority of the developing nation" through tests, analyses, or both, and for that safety approving authority itself - the document's own term for it is the NSAA - which reviews the evidence and certifies the design.
AOP-4497 carries no force of its own. NATO nations commit to it through the STANAG 4497 agreement, and the AOP's own aim clause makes its requirements "applicable to new design and development of all HEMs ... subject to national ratification instructions". A company meets it because a national HEM programme, and the contract or design-authority requirement behind it, calls for compliance with this AOP, not because the document binds by itself.
The document defines a HEM as "a munition that is manually emplaced at, or hand-thrown to, a point of intended function, and that requires user action both to begin its operation and to achieve safe separation", giving some mines, grenades, and pyrotechnic devices as examples. Its own exclusions clause carves a defined list out of that scope: nuclear weapon systems and their associated training aids, hand-held flares and signals, pyrotechnic countermeasure devices, demolition materiel (covered instead by STANAG 2818), networked munitions, and any HEM that the national safety authority agrees does not present enough hazard to need a safety system.
AOP-4497's general design requirements chapter sets a discipline rather than a checklist: it requires "a system safety program based on the requirements of AOP-15" to run through a HEM's development, feeding a series of hazard analyses into the evidence an NSAA later reviews. Within that same chapter it names, at subject level, the design considerations a HEM must address: fail-safe design, survivability under credible service conditions, electromagnetic and electrical environments, compatibility of materials, design for demilitarisation and disposal (against STANAG 4518), human factors engineering, and design for quality control and inspection during manufacture (against AQAP-2110). What each of those considerations requires in detail is not something this page reproduces.
A further chapter sets specific safety design requirements for a HEM's safety and arming system, organised under named subject headings: safety features, arming or firing-control delay, HEM setting, stored energy, electrical firing energy dissipation, self-destruction, sterilisation and de-arming, anti-tamper features, explosive ordnance disposal compatibility, explosive materials, the use of interrupted and non-interrupted explosive trains, electrical initiators and electro-explosive devices, arming and initiation, safety-critical computing systems, and assembly. AOP-4497 also carries a dedicated annex of additional requirements for mine fuzing systems specifically, covering matters such as the passage of friendly forces, approaching a mine, field maintenance, recovery, re-deployment, and end-of-deployed-life self-destruction or sterilisation.
This page names what those sections of AOP-4497 cover; it does not describe what they require. That is a deliberate choice given what the requirements govern, not an oversight: a company with a legitimate need to see them obtains AOP-4497 from NATO directly (see "Standards it references" below), and works from it alongside the design authority and safety approving authority the document itself names.
AOP-4497 creates no certification for a company. Compliance is judged and certified for a specific HEM design, not for a supplier's management system, and the assessor is a national authority rather than an accredited or notified body. The document states that this assessment "shall be a judgment made by the safety approving authority of the developing nation based upon consideration of the results of all analysis and testing results," drawing on developmental testing, subassembly testing, and tests run for reasons other than safety, such as performance and reliability data.
"Designs shall be certified by the NSAA for compliance with this AOP," and a new design, a safety-affecting modification to an approved design, or a new application of a previously approved design must be presented to the NSAA with supporting evidence for safety evaluation and certification. Where a design falls short of one or more requirements but the NSAA still certifies it as safe and suitable for service, the NSAA must record the non-compliance and its rationale, and that record "shall be made available to other NATO nations justifiably requiring this information." This is a national authority's surveillance of a specific product, not an accredited third party certifying an organisation, and passing an NSAA's review does not make a supplier "AOP-4497 certified".
NATO's Standardization Document Database is the authoritative source for AOP-4497. NATO's documents are free of charge; we credit NATO for the catalogue and neither sell nor host a copy ourselves.
The work AOP-4497 describes - a system safety program, a series of hazard analyses, a documented rationale for any tailoring, and the evidence trail an NSAA reviews before certifying a design - happens in engineering and safety-assessment work, not in software.
ComplyTrain gives a HEM programme a controlled place to hold that evidence trail: the System Safety Program Plan and its revisions, the hazard log and how each entry was closed, the STANAG-by-STANAG rationale behind any design tailoring or deviation, the training records for the people running the analyses, and the audit trail behind a design an NSAA has certified with a documented non-compliance. That is the same document-control and audit-trail discipline ComplyTrain supports for any technical standard's evidence, not a mapping to AOP-4497's own design criteria.
What ComplyTrain does not do: it does not design a HEM's safety and arming system, run a hazard analysis, or decide whether a design meets AOP-4497's requirements or is safe and suitable for service. Those judgements belong to the design authority's engineers and the developing nation's safety approving authority.
Which tier of assessment a given programme needs is set by the contract and the customer's quality clause, not by us. See what else sits alongside AOP-4497 in the standards explorer, and talk to us about the documentation trail behind a HEM safety program.
Tell us how you need to work with AOP-4497 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
AOP-4497 does not bind on its own account: NATO nations agree to apply it through the STANAG 4497 agreement, and its own aim clause makes the requirements "applicable to new design and development of all HEMs ... subject to national ratification instructions." A nation that has ratified STANAG 4497 applies AOP-4497 through its own acquisition and safety-approval arrangements, so whether it applies to a given programme is a question for that programme's contract, not for AOP-4497 in isolation.
It certifies a design, not a supplier. "Designs shall be certified by the NSAA for compliance with this AOP," where the NSAA is the safety approving authority of the developing nation - a national authority reviewing evidence for a specific munition, not an accredited body auditing an organisation's management system. Passing an NSAA's review does not make a supplier "AOP-4497 certified".
AOP-4497 defines it as "a munition that is manually emplaced at, or hand-thrown to, a point of intended function, and that requires user action both to begin its operation and to achieve safe separation," giving some mines, grenades, and pyrotechnic devices as examples. A defined list of munitions is excluded, including nuclear weapon systems, hand-held flares and signals, pyrotechnic countermeasure devices, demolition materiel (covered by STANAG 2818), and networked munitions.
AOP-4497 sits beneath AOP-15's wider safety and suitability process: it requires "a system safety program based on the requirements of AOP-15" to run through a HEM's development, and its own preliminary hazard analysis method comes from AOP-15. AOP-15 sets the overall assessment process; AOP-4497 supplies the design safety requirements specific to hand-emplaced munitions that feed into it.
No. AOP-4497's detailed design requirements govern exactly that kind of function, which is why this page names the subject areas the document covers rather than the requirements themselves. A company with a legitimate need to see them should obtain AOP-4497 from NATO directly.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.