Risk management with ISO 31000: a starter framework
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.
AQAP
AQAP: the NATO Allied Quality Assurance Publications
Defence suppliers and sub-suppliers whose contract or tender cites an AQAP.
AQAP is NATO's family of Allied Quality Assurance Publications: the quality requirements a defence contract can place on a supplier. Which one applies depends on what you deliver and how complex the contract is, and the acquisition authority decides, not you.
What it is
What AQAP stands for
AQAP stands for Allied Quality Assurance Publication. It is not one standard but a family of them, published by NATO and invoked by a contract. When a tender or a purchase order cites an AQAP, that publication's requirements become a condition of the work.
The number after the letters tells you which requirement set applies. AQAP 2110 is the one most suppliers meet first, but a software deliverable, a complex aviation programme, or a contract that only covers final inspection each pull in a different publication.
The publications you are most likely to meet
- AQAP 2110 - NATO Quality Assurance Requirements for Design, Development and Production. It contains the requirements of ISO 9001 supplemented by additional NATO requirements, and it is the default where a supplier both designs and builds.
- AQAP 2131 - NATO Quality Assurance Requirements for Final Inspection and Test. It defines the procedures that apply to final inspection and test, where the customer's confidence rests on the finished item rather than on the whole development process.
- AQAP 2210 - NATO Supplementary Software Quality Assurance Requirements. It is applied on top of AQAP 2110 or AQAP 2310 when what you deliver contains software.
- AQAP 2310 - NATO Quality Management System Requirements for Aviation, Space and Defence Suppliers. It contains the requirements of EN 9100 supplemented by additional NATO requirements, and is aimed at particularly complex aviation, space and defence work.
- AQAP 2105 - NATO Requirements for Deliverable Quality Plans. This is the contract-specific quality plan you produce and hand over, usually as a contractual deliverable in its own right.
- AQAP 2070 - NATO Mutual Government Quality Assurance Process. It governs how one nation's quality authority carries out assurance on behalf of another, so it shapes who comes to verify you rather than what you have to do.
- AQAP 2000 - NATO Policy on an Integrated Systems Approach to Quality through the Life Cycle. The policy the rest of the series sits under.
Which one applies to you
You do not choose. The acquisition authority selects the AQAP based on the quality risk it has identified and the complexity of the contract item, then writes it into the contract. Germany's BAAINBw states the selection rule in those terms, and other NATO nations' quality authorities work the same way.
In practice: if you design and produce, expect AQAP 2110. If the work is complex aviation or space, expect AQAP 2310. If the deliverable contains software, expect AQAP 2210 on top of whichever of those applies. If the contract asks for a quality plan as a deliverable, that is AQAP 2105. Requirements also flow down, so a prime holding an AQAP will pass the relevant parts to its sub-suppliers, and a sub-supplier's gap becomes the prime's nonconformity.
AQAP 2120 and AQAP 2130 were withdrawn
If a template, a supplier manual or an old tender still cites AQAP 2120 or AQAP 2130, it is out of date. AQAP 2110 Edition D, promulgated by the NATO Standardization Office on 24 June 2016, superseded AQAP 2110 Edition 3, AQAP 2120 Edition 3 and AQAP 2130 Edition 3. The transition period ended on 21 September 2018.
The production requirements that used to sit in AQAP 2120 and the inspection and test requirements from AQAP 2130 are now inside AQAP 2110. Check what the contract in front of you actually cites before building a quality system around a publication that no longer exists.
How AQAP relates to ISO 9001 and EN 9100
AQAP 2110 contains the requirements of ISO 9001 and adds NATO's on top. AQAP 2310 does the same with EN 9100, the aerospace quality standard. So the management system you would build for ISO 9001 is the foundation in both cases, and the AQAP work is the delta: configuration management, government quality assurance, risk to contract performance, and the evidence a defence customer expects to be able to reach.
How we help
How ComplyTrain helps you meet an AQAP
Whichever publication your contract cites, the shape of the work is the same: an ISO 9001-structured quality system underneath, and the AQAP additions managed on top of it. ComplyTrain gives you both in one place:
- The ISO 9001-structured QMS at the base - Quality Management
- The AQAP and contract requirements captured as a tracked set and traced to the evidence that meets them - Requirements Management
- Configuration and controlled documents with full revision history and sign-off, including a deliverable quality plan where AQAP 2105 is cited - Document Control
- Risk to contract performance managed as a living register - Risk Management
- Competence and training records for the people named on the contract - Training Management
ComplyTrain holds no AQAP qualification and does not need one: it is the system you run your own AQAP program in and hold the evidence for. Conformance is between you and your customer's quality authority.
Request access to this standard
Tell us how you need to work with AQAP and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Questions
What does AQAP stand for?
Allied Quality Assurance Publication. AQAPs are NATO's quality assurance requirements for defence contracts. They are a family of publications rather than a single standard, and the one that applies to you is the one your contract cites.
Which AQAP applies to my contract?
The acquisition authority decides, based on the quality risk and the complexity of the item, and writes it into the contract. As a rule of thumb: AQAP 2110 for design and production, AQAP 2310 for complex aviation and space work, AQAP 2210 on top of either when software is involved, AQAP 2131 where final inspection and test is what is being assured, and AQAP 2105 when a deliverable quality plan is required. Read the contract rather than a supplier manual.
Can a company be AQAP certified?
It depends on the country, and it never replaces the contract. NATO itself issues no AQAP certificate. Since April 2025, AQAP-2030 lets each nation's quality assurance authority choose one of three routes: no AQAP certification, accredited third-party certification through the national accreditation body, or a second-party assessment by the authority itself. Denmark has taken the accredited route: DANAK accredits certification bodies for AQAP 2110, always together with ISO 9001:2015.
Two things hold wherever a certificate exists. For accredited certification, AQAP-2030 makes an accredited ISO 9001 or AS 9100 certificate a prerequisite, and it tells acquisition teams not to use AQAP certification to choose between suppliers, because it is not available to all of them. And Government Quality Assurance still applies to each contract: the customer nation's quality authority verifies your quality system and the specific contract, including at your premises and your sub-suppliers'.
What happened to AQAP 2120 and AQAP 2130?
They were superseded. AQAP 2110 Edition D, promulgated on 24 June 2016, replaced AQAP 2110 Edition 3, AQAP 2120 Edition 3 and AQAP 2130 Edition 3, with a transition period that ended on 21 September 2018. The production requirements from 2120 and the inspection and test requirements from 2130 now sit inside AQAP 2110. A document still citing them is out of date.
Is AQAP the same as ISO 9001?
No, but the two are closely related. AQAP 2110 contains the requirements of ISO 9001 supplemented by additional NATO requirements, and AQAP 2310 does the same with EN 9100. An ISO 9001-grade quality management system is the foundation; the AQAP adds configuration management, government quality assurance, risk to contract performance and the customer's right of access on top of it.
We already have ISO 9001. What does AQAP 2110 add?
AQAP 2110 takes your ISO 9001:2015 system as its base and adds NATO-specific requirements for the contract: a management representative for Government Quality Assurance matters who reports directly to top management; risk management from contract review onwards, to ISO 31000 principles, with a Risk Management Plan the GQAR or acquirer can reject; a Quality Plan due before work starts, with a compliance matrix showing how each contractual requirement is met; configuration management to ACMP-2100; and requirements flowed down to the external providers you rely on. AQAP 2110 sets out each of them.
A defence tender names an AQAP. How do we prepare?
Read the tender and the contract rather than a summary: they say which AQAP applies, in which edition, and what the acquirer expects to see. AQAP 2110 only takes effect when a contract references it, but its Quality Plan is due at contract initiation, so the quality system, the Risk Management Plan and configuration management need to exist before you sign. A practical order: confirm your ISO 9001 system covers the scope of the work, map each AQAP requirement to where you meet it, draft the Quality Plan and Risk Management Plan, and work out what you will need from your own suppliers.
What can the GQAR do on our contract?
The Government Quality Assurance Representative acts for the customer's national quality authority. Under AQAP 2110 the GQAR or acquirer can reject your quality management system as applied to the contract, and reject your Quality Plan and Risk Management Plan. They have access to your facilities and to information on how the contract requirements are being met, at your premises and at your external providers', and they can disapprove your controls for nonconforming product. Where they carry out final inspection or acceptance, you owe at least 10 working days' notice unless the contract sets another figure.
Does AQAP apply to our sub-suppliers?
Through you, yes. Where you source a critical item, significant work content or an immature technical solution externally, AQAP 2110 requires you to keep knowledge of that supply chain and flow the applicable contractual requirements down to it. The GQAR's access rights extend to your external providers, and nonconforming product that reaches you from a supplier is covered by the same controls as your own.
Do we need an AQAP certificate to bid for a defence contract?
Not under NATO policy. AQAP-2030 states that national quality authorities and acquisition teams shall not use AQAP certification as a discriminator at supplier selection, because it is not available to all potential suppliers. What a contract asks is that you meet the AQAP it names, and Government Quality Assurance verifies that. Read the tender for what it asks you to show; a certificate, where your country offers one, can support that case but is not the test.
Implementation
Working out what your AQAP actually requires
The publication is chosen for you. What you control is how quickly you can show it is met.
Find out which AQAP the contract cites
Read the contract or tender itself, not a supplier manual that may predate 2018. A reference to AQAP 2120 or AQAP 2130 means AQAP 2110 Edition D in practice.
Get the base management system in place
AQAP 2110 contains the ISO 9001 requirements and AQAP 2310 contains EN 9100's. Whichever applies, the system underneath carries most of the weight.
Work the AQAP delta
Configuration management, risk to contract performance, the deliverable quality plan where AQAP 2105 is cited, and the software requirements where AQAP 2210 is applied on top.
Be ready for Government Quality Assurance
Keep the quality records the customer's authority will come to verify, and be able to produce them for your sub-suppliers as well as for yourself.
If you need to get there and have no quality function
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
Gap assessment
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversGuided implementation
Our consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksFull-service quality function
We run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service means
Official sources
The primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
What ComplyTrain does
One system for the whole compliance programme. Start with the module you need most.
Forms & Follow-up
Collect information the same way every time, and decide in advance what happens next.
Controls & Assurance
Know whether your controls are operating, not just whether a policy says they exist.
Project Planner
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Product Compliance
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Reporting & Analytics
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
Media Monitoring
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
Grants & Tenders
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
Stakeholder/Vendor Management
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
Requirements Management
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Risk Management
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Training Management
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Document Control
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Quality Management
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Latest from ComplyTrain
ISO 9001:2026: what changed from 2015, and what to do now
ISO 9001:2026 was published in September 2026. What changed from the 2015 edition, the transition deadlines, and a practical checklist for your next audit.
Compliance for two-person defence suppliers: where to start
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.