Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-2110
Defence suppliers delivering on NATO contracts.
AQAP 2110 is NATO’s quality assurance requirement for design, development and production. It builds on ISO 9001, and ComplyTrain gives you the framework to manage the additional contractual requirements it adds.
AQAP-2110 is the NATO Allied Quality Assurance Publication that sets out quality management requirements for a Supplier's design, development and production work. It does not stand alone: Chapter 4 establishes that the Supplier's quality management system has to meet ISO 9001:2015 "as necessary to satisfy the contract requirements," and Chapter 5 adds a further set of NATO-specific requirements on top of that ISO 9001 base. The current edition is Edition D, Version 1, promulgated 24 June 2016. On completion of a transition ending 21 September 2018 it superseded Edition 3 of AQAP-2110, AQAP-2120 and AQAP-2130, consolidating what had been three separate publications into one.
It has no force by itself. Section 1.3 states that the publication "is primarily intended for use in a contract between two or more parties" and that, "when referenced in a contract, this publication shall apply to all of the processes necessary for the Supplier to fulfil the contractual requirements." A Supplier can also adopt it voluntarily and internally without a contract requiring it. At the level of nations, adoption is itself an agreement: the Letter of Promulgation records that "the agreement of nations to use this publication is recorded in STANAG 4107." And where the contract and this publication disagree, the contract wins - AQAP-2110 is a default set of requirements, not an override.
The document defines its own two parties. The Supplier is the "organisation that acts in a contract as the provider of products to the Acquirer." The Acquirer is "Governmental and/or NATO Organisations, that enter into a contractual relationship with a Supplier, defining the product and quality requirements." Where the Acquirer delegates day-to-day oversight, a Government Quality Assurance Representative (GQAR) acts on its behalf. Government Quality Assurance itself is defined as "the process by which the appropriate National Authorities establish confidence that the contractual requirements relating to quality are met" - so behind the GQAR sits a national authority, not a private certification body.
Because it binds through a contract clause, the practical question is never whether AQAP-2110 applies in general, but whether this specific tender or purchase order names it. The Quality Plan required under 5.4.1.1 is due before work starts, at contract initiation, so the point at which it becomes real is earlier than the point at which most Suppliers notice it: by the time it is in a signed contract, the underlying quality management system, the risk process and the configuration management arrangements it assumes need to already exist.
Chapter 4 requires the Supplier to have a QMS that satisfies ISO 9001:2015, with the Acquirer and/or GQAR reserving the right to reject that QMS as applied to the contract. Where it is rejected, the Supplier proposes corrective action to an agreed timescale, and contractual penalties can follow, as the contract defines them. Chapter 4.3 then lists a long, specific set of access rights the Supplier and any External Providers must give the GQAR and/or Acquirer: entry to facilities, information on how contract requirements are being met, unrestricted opportunity to evaluate compliance and verify product conformity, assistance for evaluation and testing, accommodation and equipment for performing GQA, and copies of documents including electronic media.
Chapter 5 layers NATO-specific requirements on that base. A management representative for GQA matters must be appointed with real organisational authority, reporting directly to top management. Risk management must start at contract review and run to ISO 31000:2009 principles unless the contract says otherwise, with a Risk Management Plan the GQAR/Acquirer can reject. Infrastructure has to include a segregation area for nonconforming product, and the calibration and measurement system has to meet ISO 10012:2003.
The Quality Plan is central to how the Supplier demonstrates compliance. It must be submitted before work starts - at a project or contract initiation meeting, or as the contract states - and it must describe the contract-specific quality requirements, the planning of product realisation (resources, verification, validation, monitoring, inspection, testing, acceptance criteria), and a requirement-and-solution compliance matrix that justifies fulfilment of every contractual requirement. That matrix can be annexed after the plan's initial issue, within a timescale agreed with the GQAR/Acquirer, which gives some room on timing without excusing its absence. Content requirements for the plan itself are set out in AQAP-2105, and the GQAR/Acquirer can reject the plan or any revision to it.
Configuration is managed to ACMP-2100 - planning, identification, change control, status accounting and configuration audit - through a Configuration Management Plan that can sit inside another document if appropriate. Where the Supplier sources a critical item, significant work content or an immature technical solution externally, it has to maintain knowledge of that supply chain, flow down the applicable contractual requirements including relevant AQAPs, and run a formal review confirming the flow-down happened. Only the Supplier that placed the order issues contractual instructions to that External Provider - a GQA activity happening at a subcontractor's site does not shift responsibility away from the Supplier.
One definition is worth reading closely: counterfeit materiel is defined to include misrepresentation by "any other means, including failing to disclose information" with the only exception being where it is demonstrated the misrepresentation did not result from dishonesty. That is a broader test than most people expect from the word "counterfeit," and the Supplier is required to run a process for avoiding, detecting, mitigating and dispositioning it.
Traceability is not a blanket requirement in this document - it becomes mandatory in one specific circumstance: "where the failure of an item or component could lead to the loss of equipment, performance or life." At release, only acceptable product may go out, a Certificate of Conformity is provided unless otherwise instructed, and the Supplier stays solely responsible for conformance even after delivery. Where the GQAR or Acquirer needs to perform final inspection or formal acceptance, the Supplier owes a minimum of 10 working days' notice, unless the contract sets a different figure.
Nonconforming product has to be identified, controlled and segregated under documented procedures the GQAR/Acquirer can disapprove if they judge the controls inadequate. Concessions to use, release or accept nonconforming product need authorisation unless otherwise agreed, and records of the authorised quantity or expiry date have to be kept - including for nonconforming product that reaches the Supplier from an External Provider.
AQAP-2110 does not describe a certification scheme. There is no accredited certification body in it, and no mechanism by which an organisation becomes "AQAP-2110 certified." What it describes throughout is Government Quality Assurance: direct evaluation by the Acquirer or a GQAR against the specific contract, not a third-party audit against a general scheme. It also does not fix a review or expiry date for itself in the text supplied here, and it leaves dependability requirements (covered in more detail by the Allied Dependability Management Publications) to apply only "if stated in the contract."
ComplyTrain gives you the ISO 9001-structured quality system AQAP 2110 builds on, plus the tools to manage the requirements it adds:
ComplyTrain is not itself AQAP 2110 certified, and does not need to be: it is the system you build and run your own AQAP 2110 program in. The certificate is yours to earn - ComplyTrain is where the evidence for it lives.
AQAP 2110 is the most commonly cited publication in NATO's family of Allied Quality Assurance Publications, but rarely the only one. That overview sets out how 2110, 2131, 2210, 2310 and 2105 relate, and why AQAP 2120 and AQAP 2130 no longer exist.
Tell us how you need to work with AQAP-2110 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No - but it is built on it. AQAP 2110 requires an ISO 9001-grade quality management system and adds defence-contract-specific requirements on top, such as configuration management and government quality assurance. ComplyTrain gives you the ISO 9001 base and the requirements tracking for the AQAP additions in one system.
No. Qualification is between your organisation and your customer or certification body. ComplyTrain is the system you run your AQAP 2110 quality program in and hold the evidence for - it does not, and cannot, grant a qualification.
Not by a certification body in the ISO 9001 sense. AQAP 2110 is a contractual requirement, and conformance is assured through Government Quality Assurance - the customer’s national quality authority verifying your quality system and the specific contract, often at your premises. An ISO 9001 certificate usually evidences the underlying quality system; the AQAP additions are demonstrated to the customer.
GQA is the process by which a customer nation’s quality assurance authority gains confidence that a supplier meets the quality requirements of a defence contract - reviewing the quality system, witnessing key activities, and reserving the right of access to premises and records, including at sub-suppliers. AQAP 2110 sets out the supplier’s duty to support it.
AQAP 2110 covers quality assurance for design, development and production generally; AQAP 2210 adds the requirements specific to software. A supplier delivering software-intensive defence materiel is often held to both, with 2210 applied on top of the 2110 quality system.
That depends on the contract, not on the standard. AQAP-2110 only takes effect "when referenced in a contract," so whether it applies is a question for the tender or contract in front of you, not something the document answers on its own.
It must describe the contract-specific quality requirements, the planning of product realisation, and a requirement-and-solution compliance matrix justifying how every contractual requirement is met. AQAP-2105 sets out the plan's detailed content requirements.
Only where the failure of an item or component could lead to the loss of equipment, performance or life. AQAP-2110 does not require traceability as a blanket rule for every product.
Implementation
AQAP 2110 is met by an ISO 9001 system plus the defence-contract requirements, ready for Government Quality Assurance.
AQAP 2110 requires an ISO 9001-grade quality management system. Get that in place - or certified - first; it carries most of the weight.
Control the product definition and every change to it, with full traceability and sign-off - the defence-specific discipline AQAP puts front and centre.
Take the AQAP and contract-specific requirements as a tracked set, flow them down to sub-suppliers, and trace each to the evidence that meets it.
Manage risk to contract performance and keep the quality records - and the right of access to them - that a customer’s quality authority will come to verify.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.