Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-2190
Suppliers carrying out disposal of NATO defence equipment or materiel under a contract that names AQAP-2190
AQAP-2190 sets NATO's quality assurance requirements for a supplier's disposal of defence equipment, systems and materiel, building on ISO 9001 and applying once a contract names it.
AQAP-2190 is the NATO Allied Quality Assurance Publication that sets out quality assurance requirements for a Supplier's disposal of equipment, systems, and the supporting materiel and facilities that go with them, at the end of their life cycle. It does not stand alone: Chapter 4 requires the Supplier's quality management system to include "the necessary requirements of ISO 9001:2015 to satisfy the contract requirements", and Chapter 5 adds a further set of NATO-specific requirements for disposal work on top of that base. The current edition is Edition A, Version 1, promulgated 4 June 2025 - the text does not describe it as superseding an earlier edition, so it reads as a new publication rather than a revision.
It explicitly does not cover everything end-of-life. Clause 1.2 states that the publication "does not provide requirements for contracts for resell or reuse of phased-out materiel, for which other publications are more suitable (e.g. AQAP-2110 Ed D)." So a contract for scrapping or destroying materiel sits under AQAP-2190; a contract for reselling or reusing it sits elsewhere.
It also has no force by itself. Clause 1.3 states that the publication "is primarily intended for use in a contract between two or more parties" and that, "when referenced in a contract, this publication shall apply to all of the processes necessary for the Supplier to fulfil the contractual requirements." A Supplier can also adopt it voluntarily and internally without a contract requiring it. At the level of nations, adoption is itself an agreement: the Letter of Promulgation records that "the agreement of nations to use this publication is recorded in STANAG 4107." Where the contract and this publication disagree, the contract wins.
The document defines its own two parties. The Supplier is the "organisation that acts in a contract as the provider of products to the Acquirer." The Acquirer is "Governmental and/or NATO Organisations, that enter into a contractual relationship with a Supplier, defining the product and quality requirements." Where the Acquirer delegates day-to-day oversight, a Government Quality Assurance Representative (GQAR) acts on its behalf, and Government Quality Assurance itself is "the process by which the appropriate National Authorities establish confidence that the contractual requirements relating to quality are met" - so behind the GQAR sits a national authority, not a private certification body.
Because it binds through a contract clause, the practical question is never whether AQAP-2190 applies in general, but whether the tender or contract in front of us names it, and whether our work falls under disposal rather than resale or reuse. The Disposal Quality Plan required under 5.4.1.1 is due before disposal work starts, at contract initiation, so the underlying quality management system, risk process and infrastructure this document assumes need to already exist by the time a contract is signed.
Chapter 4 requires the Supplier to run a QMS that satisfies ISO 9001:2015, with the Acquirer and/or GQAR reserving the right to reject that QMS as applied to the contract. Chapter 4.4 then lists a long, specific set of access rights the Supplier and any external providers must give the GQAR and/or Acquirer: entry to facilities, information on how contract requirements are being met, unrestricted opportunity to evaluate compliance and verify product conformity, assistance for evaluation and testing, accommodation and equipment for performing GQA, and copies of documents including electronic media.
Chapter 5 layers NATO-specific, disposal-specific requirements on that base. A management representative must be appointed with real organisational authority over quality, GQA, environment, health and safety matters, reporting directly to top management. Risk management must start at contract review and run to ISO 31000:2018 principles unless the contract says otherwise. Infrastructure has to include an area that segregates nonconforming product during disposal and prevents the escape of hazardous material - a requirement specific to this document among the AQAP series.
The Disposal Quality Plan (DQP) is central to how the Supplier demonstrates compliance. It must be submitted before disposal work starts - at a project or contract initiation meeting, or as the contract states - and it must describe the contract-specific quality management requirements, the planning of the disposal process (resources, verification, validation, monitoring, inspection, testing, and criteria for the end state of the product), any critical processes affecting health and safety, environment or physical security, the contract-specific environmental arrangements including how environmental performance is monitored and reported, the contract-specific occupational health and safety arrangements including emergency preparedness, and a requirement-and-solution compliance matrix. That matrix can be annexed after the plan's initial issue, within a timescale agreed with the GQAR/Acquirer. The DQP must also identify the disposal work breakdown structure, including work carried out by external providers, and the GQAR/Acquirer can reject the plan or any revision to it.
Where the Supplier sources significant disposal work externally, it has to maintain knowledge of that supply chain, flow down the applicable contractual requirements including relevant AQAPs, insert a standard notice clause into purchasing documents, and run a formal review confirming the flow-down happened correctly, keeping the record of that review. On request, the Supplier must give the GQAR/Acquirer copies of subcontracts and related documents, and must report any deficiency from a third-party regulatory or management-system certification audit that relates to the contract.
One definition is worth reading closely: counterfeit materiel is defined to include misrepresentation by "any other means, including failing to disclose information" with the only exception being where it is demonstrated the misrepresentation did not result from dishonesty. The Supplier is required to run a verifiable process to prevent parts re-entering the supply chain as counterfeit materiel.
At release, only product that has reached the contractually agreed state through the planned disposal arrangements may go out. The Supplier provides a Certificate of Conformity (CoC) unless otherwise instructed, and stays solely responsible for conformance even after disposal is complete. Where the GQAR or Acquirer needs to perform an assurance activity, the Supplier owes a minimum of 10 working days' notice unless the contract sets a different figure. Traceability runs through a Certificate of Disposal (CoD), which the Supplier must submit to trace the disposal to item, material or batch level - Annex A sets its minimum content, including the disposal method, the outputs of the process, and the name and signature of the person issuing it.
Nonconforming product has to be identified, controlled and segregated under documented procedures, and product with unidentified or unknown status is itself classified as nonconforming. Concessions to dispose of nonconforming product need Acquirer authorisation unless otherwise agreed, and records of the authorised quantity or expiry date have to be kept - the same rules apply where the nonconforming product comes from an external provider.
AQAP-2190 is published by the NATO Standardization Office and, like all NATO standardization documents, it is free of charge. The NATO Standardization Document Database is the authoritative source; we credit NATO for the catalogue and do not sell or host a copy of the document ourselves.
AQAP-2190 does not describe a certification scheme. There is no accredited certification body in it, and no mechanism by which an organisation becomes "AQAP-2190 certified." What it describes throughout is Government Quality Assurance: direct evaluation by the Acquirer or a GQAR against the specific disposal contract, not a third-party audit against a general scheme. It also does not cover contracts for the resale or reuse of phased-out materiel, and it does not fix a review date for itself in the text supplied here.
AQAP-2190 combines a management-system requirement, built on ISO 9001, with genuinely operational work: destruction, demilitarization, scrapping and waste elimination happen on materiel, not in software. ComplyTrain is the system that holds the evidence trail around that work, not a stand-in for doing it. Concretely: the Disposal Quality Plan and its requirement-and-solution compliance matrix live as a controlled, versioned document with a clear owner. Training and competence records for staff performing disposal-related activities, the formal reviews confirming contractual requirements flowed down correctly to external providers, and the record of nonconformities, concessions and the corrective actions behind them sit in one place. The Certificate of Disposal and Certificate of Conformity themselves are held as signed, dated, retrievable records, ready within the notice periods a contract sets.
What ComplyTrain does not do: it does not carry out the disposal, destruction or demilitarization itself, calibrate measuring equipment, physically segregate hazardous material, or perform the Government Quality Assurance surveillance. Those stay the Supplier's operational work and the GQAR's or Acquirer's own evaluation.
Which tier of AQAP a contract calls up, and whether a given contract falls under AQAP-2190 or AQAP-2110, is set by the Acquirer's contract and quality clause, not by us. See what else sits in a typical NATO quality assurance package in the standards explorer, and talk to us about the evidence trail behind it.
Tell us how you need to work with AQAP-2190 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AQAP-2190 describes Government Quality Assurance, where the Acquirer or an appointed GQAR evaluates a Supplier directly against a specific disposal contract. It does not name an accredited certification body or a scheme for certifying an organisation to AQAP-2190.
That depends on the contract, not on the standard. AQAP-2190 only takes effect "when referenced in a contract," so whether it applies is a question for the tender or contract in front of you, not something the document answers on its own.
AQAP-2190 covers disposal - removing equipment, systems or materiel at the end of their life. AQAP-2110 covers a Supplier's design, development and production work, and the document itself names AQAP-2110 as the more suitable publication for contracts covering resale or reuse of phased-out materiel rather than disposal.
It must describe the contract-specific quality management requirements, the planning of the disposal process, any critical health, safety, environmental or physical-security processes, the environmental and occupational health and safety arrangements, and a requirement-and-solution compliance matrix, and it must be submitted before disposal work starts.
A Certificate of Disposal traces the disposal method and its outputs to item, material or batch level. A Certificate of Conformity is the Supplier's statement that the disposed item met all contractual requirements. AQAP-2190's Annex B notes that traceability back to the Certificate of Disposal should be provided on the Certificate of Conformity.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.