Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-2000
NATO Nations, NATO Organisations, and the acquirers and suppliers that work under their defence acquisition contracts
NATO's policy for applying quality management across a defence product's whole life cycle, and the instrument that obliges nations to ratify STANAG 4107 and appoint a national quality assurance authority.
AQAP-2000 is NATO's top-level policy for quality across the whole life of a defence product, from concept to disposal. It is Edition D, Version 1, promulgated November 2023, and it sets out the "integrated systems approach" that the rest of the Allied Quality Assurance Publication (AQAP) family works within. It is a policy statement, not itself a set of testable requirements: it explains why NATO Nations run government quality assurance the way they do, and it hands the actual requirements to other publications.
The policy is addressed directly to NATO Programmes, NATO Nations and NATO Organisations. Interoperability Platform (Partnership for Peace) nations are only invited to follow it, and are not obliged to. Within that framework, an acquirer is a governmental or NATO body that enters a contractual relationship with a supplier, and the supplier is the party responsible for demonstrating compliance with the resulting contractual requirements.
This is the part readers most often get backwards: the policy binds nations, not companies. A NATO Nation is bound as Alliance policy from the moment it is promulgated. A supplier is bound only once an acquirer's contract invokes a specific AQAP as a quality requirement, because acquirers are required to use the common contractual quality requirements defined in the AQAPs. For a supplier this is a contract clause, not a document they sign up to directly, and it can arrive at any stage of the acquisition process, from pre-concept through to retirement.
An organisation working within the policy runs its quality activity through a Quality Management System built on ISO 9000 principles: it determines its objectives and the processes needed to reach them, and seeks assurance through monitoring, measuring and analysing its own performance.
Acquirers must commit resources to quality assurance proportionate to the complexity, criticality and risk of the acquisition programme. NATO Nations specifically must ratify and implement STANAG 4107, and implementing STANAG 4107 requires them to have adequate infrastructure and processes for their National Quality Assurance Authority (NQAA), appoint a Government Quality Assurance (GQA) focal point, establish competent GQA representative resource and implement AQAP-2070, monitor and improve delivery of Government Quality Assurance Surveillance (GQAS), promote the contractual use of AQAPs, and support NATO AC/327 Working Group 2. NATO Organisations carry a parallel duty to appoint their own quality focal point and promote AQAP use through their supply chains.
GQA itself gives an acquirer confidence that a supplier will meet its contractual quality responsibilities. It runs from risk-based thinking in the acquisition strategy, through supplier selection and monitoring performance during contract execution, to acceptance of the product, and it extends to post-delivery activities such as fault investigation. GQAS, the surveillance activity, can happen at any level of the supply chain, is based on a risk assessment, and draws on objective evidence from the supplier, sub-suppliers and the GQA activity itself.
What GQAS is told not to do matters as much as what it checks. It should not replicate the broader quality-management-system (QMS) assurance that accredited third-party certification already provides, and it should not replace the supplier's own quality control or inspection activities. It is a check on the supplier's capability, performance and application of its QMS against the specific contract, and irrespective of any accredited certification the supplier holds elsewhere, GQAS can still result in the supplier's QMS being rejected in relation to that contract.
Mutual GQA is the case where one NATO nation provides this surveillance on behalf of another nation, or of a NATO Organisation. It can only be provided by an NQAA, only once a contractual arrangement is in place, and only for nations that have ratified STANAG 4107. It does not include any kind of product certification, such as airworthiness or seaworthiness: compulsory or legal requirements of that kind stay the responsibility of the acquirer and supplier, not of GQA.
AQAP-2000 states plainly that no AQAP certification scheme exists at NATO level. NATO does not publish a sector scheme, does not have arrangements to award certification, and does not recognise AQAP certification. What exists instead is Government Quality Assurance Surveillance: a National Quality Assurance Authority's staff, or another government body's staff, assess a supplier against its contract, not against this document, and the document sets no fixed audit cycle. Surveillance is proportionate to the complexity, criticality and risk of the programme, so its frequency and depth follow the acquirer's risk assessment rather than a calendar.
NATO separately recognises the relevance of ISO 9001 and AS EN 9100 series quality-management-system certification, so long as it comes from a body accredited by an International Accreditation Forum recognised National Accreditation Body. That certification gives confidence in the organisation's QMS, but it does not imply the product or service itself is certified, and it is a different, decoupled mechanism from GQA. Some individual nations do offer their own AQAP certification or confirmation as a national supplier-assessment choice, but that is a national arrangement, not something AQAP-2000 defines or NATO recognises, and acquirers are told they must not use AQAP certification as a discriminator at supplier selection, precisely because it is not available to every potential supplier.
AQAP-2000 sits above a family of documents that carry the actual requirements. It is carried by STANAG 4107, the agreement NATO Nations ratify to implement mutual government quality assurance and the use of the AQAPs. It names AQAP-2110 for its definition of "product," and points to AQAP-2070 for further guidance on risk in the context of GQA. Life-cycle terms used throughout come from AAP-48, which defines Life Cycle Processes, and AAP-20, which defines the NATO Life Cycle Model. It also recognises ISO 9001 and AS9100 quality-management-system certification as relevant across the defence life cycle, and notes that the contractual AQAPs invoke those civil standards and add NATO-specific requirements on top.
AQAP-2000 is published by the NATO Standardization Office and, like all NATO standardization documents, it is free of charge. NATO's Standardization Document Database is the authoritative source; we credit NATO for the catalogue and do not sell or host a copy of the document ourselves.
AQAP-2000 is a policy document, not a set of testable requirements, so there is little to implement directly against it. It exists to explain why the operational AQAPs, STANAG 4107 and the life cycle publications exist. The practical help sits in those documents, particularly AQAP-2110 and AQAP-2070, not in this policy statement.
What AQAP-2000 does describe, and that a supplier will still be asked to evidence, is the substance behind Government Quality Assurance: a documented quality management system, records that show monitoring and measuring of performance, and the objective evidence a GQA representative or an NQAA draws on during surveillance. ComplyTrain is a quality management platform for exactly that kind of work in general: controlled procedures, training records, internal audits, corrective actions, and the document trail an assessor asks to see, kept current and ready to hand over.
ComplyTrain cannot make a product or a supplier "AQAP certified," because no such NATO-level certification exists to hold. It does not stand in for an NQAA's Government Quality Assurance surveillance, and it does not decide which AQAP tier or contractual quality clause applies to a given contract; that is set by the acquirer and the quality clause, never by software. If you need to work out which of these documents actually govern your contract, the standards explorer shows what sits alongside AQAP-2000 in this family, and we are glad to talk through where your obligations sit.
Tell us how you need to work with AQAP-2000 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AQAP-2000 says directly that NATO does not publish a sector scheme, has no arrangements to award certification, and does not recognise AQAP certification. What suppliers go through instead is Government Quality Assurance Surveillance by a national authority, assessed against their contract rather than against this policy document.
AQAP-2000 is the policy: it explains why NATO runs quality management and government quality assurance the way it does, and who is responsible for what. AQAP-2110 is one of the documents beneath it that this policy names, carrying the quality-management-system requirements a supplier's contract can actually invoke.
STANAG 4107 is what NATO Nations ratify, not something a company ratifies. It reaches a supplier only when an acquirer's contract invokes an AQAP as a contractual quality requirement, which can happen at any stage from pre-concept through to retirement. Whether it applies to a specific contract is a question for the acquirer and the contract's quality clause.
Not on its own. AQAP-2000 recognises ISO 9001 and AS EN 9100 certification as relevant, and notes it gives confidence in an organisation's quality management system, but it explicitly says GQA surveillance should not simply replicate that third-party assurance, and can still result in a supplier's QMS being rejected in relation to a specific contract regardless of accredited certification held elsewhere.
Yes, and this is easy to misread. NATO itself does not recognise AQAP certification and awards none. Some individual nations nonetheless offer their own AQAP certification or confirmation as part of their national supplier-assessment approach. AQAP-2000 is explicit that acquirers must not use that as a discriminator in supplier selection, because it is not available to every potential supplier.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.