Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-2030
National Quality Assurance Authorities and the accredited certification bodies that assess suppliers for AQAP certification
AQAP-2030 is NATO guidance for national quality authorities on running AQAP certification consistently; it is not itself a certificate a supplier applies for.
AQAP-2030 (AQAP Certification/Confirmation Processes - National Quality Assurance Authority Guidance) is a NATO Allied Quality Assurance Publication, but unlike AQAP-2110 or AQAP-2310 it is not a technical requirement a supplier implements. It is guidance addressed to each nation's National Quality Assurance Authority (NQAA) on how to run AQAP certification consistently, promulgated by the NATO Standardization Office in April 2025 as Edition A, Version 1, and recommended for use through STANREC 4874.
It exists because national AQAP certification activity had grown inconsistent: different countries, and different certification bodies within them, used different approaches, which risked a certificate misrepresenting a supplier's actual capability. AQAP-2030 answers that by setting out three options an NQAA can choose between, and then standardising how each option is run.
Every NQAA decides, for its own nation, which of three approaches governs AQAP certification there:
Whichever option applies, NQAAs and acquisition teams are told plainly not to use AQAP certification as a discriminator at supplier selection, because it is not available to every potential supplier.
Under Option 2, the NQAA signs a formal agreement with its NAB covering how certification and accreditation activity is monitored: sharing assessment information, periodic meetings, an annual review, agreed audit durations, and a requirement that a certification body ask permission before certifying a supplier abroad. Critically, AQAP accreditation is conditional on the supplier already holding accredited ISO 9001 or AS 9100 certification, and it is tied to that certification so tightly that a suspension or withdrawal of the ISO 9001/AS 9100 accreditation automatically suspends or withdraws the AQAP accreditation too.
The document also fixes minimum audit durations by staff numbers at the audited site. For example, a renewal audit under AQAP-2110 adds half a day beyond the equivalent ISO 9001 audit for a site of 1-15 employees, rising to four days for a site of 8,501-10,700 employees. That additional AQAP time can never be reduced to zero, and the NQAA retains the right to attend any AQAP audit as an observer and to review the audit reports.
Under Option 3, the NQAA itself audits the supplier, who must already hold active contracts requiring AQAP-2110 or AQAP-2310, so the assessment tests real contract performance rather than a plan. A certificate issued this way is capped at three years, and can be tied to the validity of the supplier's underlying ISO 9001 or AS 9100 certificate. The body doing the assessing must meet fourteen specific requirements: it must be a government legal entity operating with NQAA permission, run a two-stage initial audit followed by recertification in year three, run limited-scope surveillance in years one and two, never subcontract the assessment to another government body outside the NQAA's own chain, and operate an impartial appeals process with client records available to acquisition and GQAR organisations.
Neither route is something a supplier can start "implementing" in the abstract. The trigger is a tender or contract that requires AQAP certification, or a renewal cycle for a certificate already held. The groundwork that actually helps, whichever option a nation runs, is keeping the underlying ISO 9001 or AS 9100 management system certification current, since both routes in this document build directly on it and Option 2 ties the AQAP accreditation's survival to it.
AQAP-2030 does not certify anyone itself, and NATO does not award or recognise AQAP certification at any level. Certification or confirmation is always issued by a national body, a certification body under Option 2 or the NQAA under Option 3, against a national scheme this document only standardises the shape of. It also says nothing about the technical content a supplier is assessed against; that lives in AQAP-2110 and AQAP-2310, and, underneath those, in ISO 9001 or AS 9100.
AQAP-2030 governs process between NQAAs, accreditation bodies and certification bodies, not something a supplier builds a management system around. The work that actually gets evidenced sits one level down, in ISO 9001 or AS 9100 and in AQAP-2110 or AQAP-2310, whichever a contract requires.
ComplyTrain is where that evidence trail is kept: documented procedures, controlled documents, training records, internal audits and corrective actions, the material an auditor asks for whether the assessment is a third-party certification audit or an NQAA second-party assessment. It gives a supplier a dated record of what was true at each surveillance or renewal cycle, which matters given how directly this document ties an AQAP accreditation to the underlying ISO 9001 or AS 9100 certification staying in good standing.
ComplyTrain does not accredit a certification body, does not conduct the audit, and does not issue an AQAP certificate. Which of AQAP-2030's three options applies, and what tier of assessment a contract demands, is set by the customer's National Quality Assurance Authority and the contract's quality clause, not by us. If you are working out what a specific contract requires, the standards explorer shows what sits alongside AQAP-2030, and we are glad to talk through it.
Tell us how you need to work with AQAP-2030 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AQAP-2030 is guidance to National Quality Assurance Authorities on how to run AQAP certification, not a technical standard a supplier is audited against. A supplier is certified or assessed against AQAP-2110 or AQAP-2310, using a process that AQAP-2030 standardises.
No. Certification or confirmation is always issued by a national body: an accredited certification body under Option 2, or the NQAA itself under Option 3. NATO does not award or recognise AQAP certification at any level.
AQAP-2110 and AQAP-2310 set the quality assurance requirements a supplier's management system is actually assessed against. AQAP-2030 governs the process around that assessment: which NQAA option applies, who is allowed to certify, how long an audit takes, and how certification bodies and NQAAs work together.
Only if a contract or tender says so. AQAP-2030 does not mandate that any nation offer AQAP certification at all; a nation can choose Option 1 and not support it. Where certification is offered, NATO's own guidance says it must never be used as a discriminator in supplier selection.
Under a second-party assessment (Option 3), a maximum of three years, and it can be tied to the validity period of the supplier's ISO 9001 or AS 9100 certificate. Under third-party certification (Option 2), it runs on the surveillance and renewal cycle the accredited certification body sets, and is suspended automatically if the underlying ISO 9001 or AS 9100 accreditation is suspended.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.