AQAP-2190 quality assurance requirements for disposal

What it is

AQAP-2190 is the NATO Allied Quality Assurance Publication that sets out quality assurance requirements for a Supplier's disposal of equipment, systems, and the supporting materiel and facilities that go with them, at the end of their life cycle. It does not stand alone: Chapter 4 requires the Supplier's quality management system to include "the necessary requirements of ISO 9001:2015 to satisfy the contract requirements", and Chapter 5 adds a further set of NATO-specific requirements for disposal work on top of that base. The current edition is Edition A, Version 1, promulgated 4 June 2025 - the text does not describe it as superseding an earlier edition, so it reads as a new publication rather than a revision.

It explicitly does not cover everything end-of-life. Clause 1.2 states that the publication "does not provide requirements for contracts for resell or reuse of phased-out materiel, for which other publications are more suitable (e.g. AQAP-2110 Ed D)." So a contract for scrapping or destroying materiel sits under AQAP-2190; a contract for reselling or reusing it sits elsewhere.

It also has no force by itself. Clause 1.3 states that the publication "is primarily intended for use in a contract between two or more parties" and that, "when referenced in a contract, this publication shall apply to all of the processes necessary for the Supplier to fulfil the contractual requirements." A Supplier can also adopt it voluntarily and internally without a contract requiring it. At the level of nations, adoption is itself an agreement: the Letter of Promulgation records that "the agreement of nations to use this publication is recorded in STANAG 4107." Where the contract and this publication disagree, the contract wins.

Who it binds, and how

The document defines its own two parties. The Supplier is the "organisation that acts in a contract as the provider of products to the Acquirer." The Acquirer is "Governmental and/or NATO Organisations, that enter into a contractual relationship with a Supplier, defining the product and quality requirements." Where the Acquirer delegates day-to-day oversight, a Government Quality Assurance Representative (GQAR) acts on its behalf, and Government Quality Assurance itself is "the process by which the appropriate National Authorities establish confidence that the contractual requirements relating to quality are met" - so behind the GQAR sits a national authority, not a private certification body.

Because it binds through a contract clause, the practical question is never whether AQAP-2190 applies in general, but whether the tender or contract in front of us names it, and whether our work falls under disposal rather than resale or reuse. The Disposal Quality Plan required under 5.4.1.1 is due before disposal work starts, at contract initiation, so the underlying quality management system, risk process and infrastructure this document assumes need to already exist by the time a contract is signed.

Built on ISO 9001, with NATO-specific additions for disposal

Chapter 4 requires the Supplier to run a QMS that satisfies ISO 9001:2015, with the Acquirer and/or GQAR reserving the right to reject that QMS as applied to the contract. Chapter 4.4 then lists a long, specific set of access rights the Supplier and any external providers must give the GQAR and/or Acquirer: entry to facilities, information on how contract requirements are being met, unrestricted opportunity to evaluate compliance and verify product conformity, assistance for evaluation and testing, accommodation and equipment for performing GQA, and copies of documents including electronic media.

Chapter 5 layers NATO-specific, disposal-specific requirements on that base. A management representative must be appointed with real organisational authority over quality, GQA, environment, health and safety matters, reporting directly to top management. Risk management must start at contract review and run to ISO 31000:2018 principles unless the contract says otherwise. Infrastructure has to include an area that segregates nonconforming product during disposal and prevents the escape of hazardous material - a requirement specific to this document among the AQAP series.

The Disposal Quality Plan

The Disposal Quality Plan (DQP) is central to how the Supplier demonstrates compliance. It must be submitted before disposal work starts - at a project or contract initiation meeting, or as the contract states - and it must describe the contract-specific quality management requirements, the planning of the disposal process (resources, verification, validation, monitoring, inspection, testing, and criteria for the end state of the product), any critical processes affecting health and safety, environment or physical security, the contract-specific environmental arrangements including how environmental performance is monitored and reported, the contract-specific occupational health and safety arrangements including emergency preparedness, and a requirement-and-solution compliance matrix. That matrix can be annexed after the plan's initial issue, within a timescale agreed with the GQAR/Acquirer. The DQP must also identify the disposal work breakdown structure, including work carried out by external providers, and the GQAR/Acquirer can reject the plan or any revision to it.

Externally provided processes and counterfeit avoidance

Where the Supplier sources significant disposal work externally, it has to maintain knowledge of that supply chain, flow down the applicable contractual requirements including relevant AQAPs, insert a standard notice clause into purchasing documents, and run a formal review confirming the flow-down happened correctly, keeping the record of that review. On request, the Supplier must give the GQAR/Acquirer copies of subcontracts and related documents, and must report any deficiency from a third-party regulatory or management-system certification audit that relates to the contract.

One definition is worth reading closely: counterfeit materiel is defined to include misrepresentation by "any other means, including failing to disclose information" with the only exception being where it is demonstrated the misrepresentation did not result from dishonesty. The Supplier is required to run a verifiable process to prevent parts re-entering the supply chain as counterfeit materiel.

Release, certificates and nonconforming product

At release, only product that has reached the contractually agreed state through the planned disposal arrangements may go out. The Supplier provides a Certificate of Conformity (CoC) unless otherwise instructed, and stays solely responsible for conformance even after disposal is complete. Where the GQAR or Acquirer needs to perform an assurance activity, the Supplier owes a minimum of 10 working days' notice unless the contract sets a different figure. Traceability runs through a Certificate of Disposal (CoD), which the Supplier must submit to trace the disposal to item, material or batch level - Annex A sets its minimum content, including the disposal method, the outputs of the process, and the name and signature of the person issuing it.

Nonconforming product has to be identified, controlled and segregated under documented procedures, and product with unidentified or unknown status is itself classified as nonconforming. Concessions to dispose of nonconforming product need Acquirer authorisation unless otherwise agreed, and records of the authorised quantity or expiry date have to be kept - the same rules apply where the nonconforming product comes from an external provider.

Where to get it

AQAP-2190 is published by the NATO Standardization Office and, like all NATO standardization documents, it is free of charge. The NATO Standardization Document Database is the authoritative source; we credit NATO for the catalogue and do not sell or host a copy of the document ourselves.

What the document does not cover

AQAP-2190 does not describe a certification scheme. There is no accredited certification body in it, and no mechanism by which an organisation becomes "AQAP-2190 certified." What it describes throughout is Government Quality Assurance: direct evaluation by the Acquirer or a GQAR against the specific disposal contract, not a third-party audit against a general scheme. It also does not cover contracts for the resale or reuse of phased-out materiel, and it does not fix a review date for itself in the text supplied here.

Standards it references

• AQAP-2110Background
• ISO 9001Background
• AAP-48Background
• ISO 31000Background
• AQAP-2000Background
• ISO 14001Background
• ISO 45001Background
• AQAP-2070Background