Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-2021
NATO nations and agencies drafting counterfeit-avoidance contract clauses, and the defence suppliers those contracts bind
NATO guidance offering an example set of counterfeit-avoidance contract requirements and an auditor questionnaire, for nations to write into defence contracts rather than a document that binds suppliers on its own.
AQAP-2021 is NATO guidance, published as an Allied Quality Assurance Publication in June 2023 (Edition A, Version 1), for avoiding counterfeit materiel in the defence supply chain. It defines counterfeit materiel broadly: any materiel whose origin, age, composition, configuration or certification status has been falsely represented, through misleading marking, misleading documentation, or any other means including failing to disclose information, unless the misrepresentation is shown not to be the result of dishonesty. That carve-out matters: an honest labelling mistake is not counterfeiting under this document's own definition.
The guidance names the conditions that raise counterfeit risk: parts known to be vulnerable to counterfeiting such as electrical, electronic and electro-mechanical (EEE) components; parts that are obsolescent or foreseen to become so during the life of the equipment; multiple tiers in the supply chain; traceability that is not otherwise mandated; fraudulent test results; and counterfeited certificates.
AQAP-2021 addresses NATO nations and agencies involved in the acquisition and assurance of defence materiel, and it is explicit that it is not itself a contractual document. Instead it offers an example set of counterfeit-avoidance contract requirements that a nation or agency can choose to write into a contract, to give the acquirer confidence a supplier has appropriate arrangements. Nothing in AQAP-2021 binds a supplier until that happens. It sits under STANREC 4791, which recommends the standard rather than committing nations to it, so adoption is a national choice, not an obligation.
Annex A's example clauses run through nine areas: a documented counterfeit-avoidance policy and Anti Counterfeit Management Plan available to customers on request; a named management representative with authority over the arrangements; role-based training and awareness with records kept; purchasing controls that assess counterfeit risk against criticality and trace materiel to the manufacturer where product integrity matters; test and verification rigor set by risk and criticality; control of suspected and confirmed counterfeit materiel so it cannot re-enter the supply chain; reporting occurrences to the customer, the genuine materiel's IP owner, information-gathering bodies and national law enforcement; wider anti-corruption measures such as covert marking, controlled destruction of substandard materiel and tooling, and published lists of franchised distributors; and an Obsolescence Management Plan aligned with EN IEC 62402:2019, since unmanaged obsolescence is one of the document's named risk factors.
Where a contract has incorporated these requirements, NATO nations and bodies are told to consider Government Quality Assurance Surveillance (GQAS) to confirm supplier arrangements are appropriate and effective. That is government quality assurance, a national authority's representative auditing against a specific contract, not third-party certification, and AQAP-2021 does not establish or claim any certification scheme. Annex B gives the auditor's actual questions: whether the policy is documented and reviewed, who the management representative is, whether inspectors are trained to recognise counterfeit parts, how the Approved Supplier List is rated on counterfeit-avoidance criteria, what traceability evidence exists to the OEM or OCM at goods-inward, and how scrap, packaging and tooling are disposed of so they cannot be reused to fake legitimate materiel. The document does not say how often this surveillance runs; that is left to the contract.
AQAP-2021 takes its terms from ISO 9000:2015 and AQAP-2110 unless it defines them separately, and its one normative reference is EN IEC 62402:2019 Obsolescence Management. Clause 2.3 points to SAE AS5553, IEC/TS 62239, SAE AS6174 and UK Def Stan 05-135 as alternative counterfeit-avoidance requirements a nation could use instead, and Annex C synopsises a further set, including ISO 22380, IEC/TS 62668-1 and -2, and several more SAE documents, for organisations that already work to one of them.
The work AQAP-2021 describes is done on the shop floor and in the supply chain, not in software: inspecting goods on receipt, tracing a part back to its manufacturer, marking materiel to resist counterfeiting, and physically containing and disposing of suspect or confirmed counterfeit items. No compliance tool performs that inspection or that handling, and ComplyTrain does not claim to.
What ComplyTrain supports is the documentation trail Annex A and Annex B describe: holding the counterfeit-avoidance policy and Anti Counterfeit Management Plan as controlled documents, keeping training records that show staff and inspectors have been briefed on counterfeit materiel, recording purchasing-risk assessments and Approved Supplier List reviews, and logging occurrences, corrective actions and disposal decisions so a GQA auditor working through Annex B's questions has something to examine. It is a place to hold the Obsolescence Management Plan alongside the rest of the quality record too.
None of this is a mapping to AQAP-2021 specifically; it is the same evidence trail ComplyTrain supports for any documented process a quality clause requires, applied here to counterfeit avoidance. Which contract brings AQAP-2021-style clauses with it, and what else comes with them, is set by the customer's contract and quality clause, not by us. See the standards explorer for what else sits alongside this document, and talk to us about what your contract actually requires.
Tell us how you need to work with AQAP-2021 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. AQAP-2021 states plainly that it is not intended for use as a contractual document; it offers an example of counterfeit-avoidance contract requirements that a NATO nation or agency can choose to write into a contract. It becomes relevant to a supplier only when a specific contract does that, and adoption by a nation is a recommendation under STANREC 4791, not an obligation.
No. AQAP-2021 does not establish a certification scheme. Where contract requirements based on it are in place, oversight runs through Government Quality Assurance Surveillance, a national authority auditing a supplier against the specific contract, not an accredited body issuing a certificate.
AQAP-2110 sets out NATO quality management system requirements for design, development and production. AQAP-2021 is narrower guidance specifically on avoiding counterfeit materiel, and it borrows its terms and definitions from AQAP-2110 unless it defines them itself.
It is the document Annex A expects a supplier to hold alongside its counterfeit-avoidance policy, made available to customers on request, setting out how the organisation manages the risk of counterfeit materiel entering its supply chain.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.