Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP
Defence suppliers and sub-suppliers whose contract or tender cites an AQAP.
AQAP is NATO's family of Allied Quality Assurance Publications: the quality requirements a defence contract can place on a supplier. Which one applies depends on what you deliver and how complex the contract is, and the acquisition authority decides, not you.
AQAP stands for Allied Quality Assurance Publication. It is not one standard but a family of them, published by NATO and invoked by a contract. When a tender or a purchase order cites an AQAP, that publication's requirements become a condition of the work.
The number after the letters tells you which requirement set applies. AQAP 2110 is the one most suppliers meet first, but a software deliverable, a complex aviation programme, or a contract that only covers final inspection each pull in a different publication.
You do not choose. The acquisition authority selects the AQAP based on the quality risk it has identified and the complexity of the contract item, then writes it into the contract. Germany's BAAINBw states the selection rule in those terms, and other NATO nations' quality authorities work the same way.
In practice: if you design and produce, expect AQAP 2110. If the work is complex aviation or space, expect AQAP 2310. If the deliverable contains software, expect AQAP 2210 on top of whichever of those applies. If the contract asks for a quality plan as a deliverable, that is AQAP 2105. Requirements also flow down, so a prime holding an AQAP will pass the relevant parts to its sub-suppliers, and a sub-supplier's gap becomes the prime's nonconformity.
If a template, a supplier manual or an old tender still cites AQAP 2120 or AQAP 2130, it is out of date. AQAP 2110 Edition D, promulgated by the NATO Standardization Office on 24 June 2016, superseded AQAP 2110 Edition 3, AQAP 2120 Edition 3 and AQAP 2130 Edition 3. The transition period ended on 21 September 2018.
The production requirements that used to sit in AQAP 2120 and the inspection and test requirements from AQAP 2130 are now inside AQAP 2110. Check what the contract in front of you actually cites before building a quality system around a publication that no longer exists.
AQAP 2110 contains the requirements of ISO 9001 and adds NATO's on top. AQAP 2310 does the same with EN 9100, the aerospace quality standard. So the management system you would build for ISO 9001 is the foundation in both cases, and the AQAP work is the delta: configuration management, government quality assurance, risk to contract performance, and the evidence a defence customer expects to be able to reach.
Whichever publication your contract cites, the shape of the work is the same: an ISO 9001-structured quality system underneath, and the AQAP additions managed on top of it. ComplyTrain gives you both in one place:
ComplyTrain holds no AQAP qualification and does not need one: it is the system you run your own AQAP program in and hold the evidence for. Conformance is between you and your customer's quality authority.
Tell us how you need to work with AQAP and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Allied Quality Assurance Publication. AQAPs are NATO's quality assurance requirements for defence contracts. They are a family of publications rather than a single standard, and the one that applies to you is the one your contract cites.
The acquisition authority decides, based on the quality risk and the complexity of the item, and writes it into the contract. As a rule of thumb: AQAP 2110 for design and production, AQAP 2310 for complex aviation and space work, AQAP 2210 on top of either when software is involved, AQAP 2131 where final inspection and test is what is being assured, and AQAP 2105 when a deliverable quality plan is required. Read the contract rather than a supplier manual.
No. There is no AQAP certificate issued by a certification body. AQAP conformance is assured through Government Quality Assurance, where the customer nation's quality authority verifies your quality system and the specific contract, including at your premises and your sub-suppliers'. An ISO 9001 certificate normally evidences the management system underneath, and the AQAP additions are demonstrated to the customer.
They were superseded. AQAP 2110 Edition D, promulgated on 24 June 2016, replaced AQAP 2110 Edition 3, AQAP 2120 Edition 3 and AQAP 2130 Edition 3, with a transition period that ended on 21 September 2018. The production requirements from 2120 and the inspection and test requirements from 2130 now sit inside AQAP 2110. A document still citing them is out of date.
No, but the two are closely related. AQAP 2110 contains the requirements of ISO 9001 supplemented by additional NATO requirements, and AQAP 2310 does the same with EN 9100. An ISO 9001-grade quality management system is the foundation; the AQAP adds configuration management, government quality assurance, risk to contract performance and the customer's right of access on top of it.
Implementation
The publication is chosen for you. What you control is how quickly you can show it is met.
Read the contract or tender itself, not a supplier manual that may predate 2018. A reference to AQAP 2120 or AQAP 2130 means AQAP 2110 Edition D in practice.
AQAP 2110 contains the ISO 9001 requirements and AQAP 2310 contains EN 9100's. Whichever applies, the system underneath carries most of the weight.
Configuration management, risk to contract performance, the deliverable quality plan where AQAP 2105 is cited, and the software requirements where AQAP 2210 is applied on top.
Keep the quality records the customer's authority will come to verify, and be able to produce them for your sub-suppliers as well as for yourself.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansThe primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.