Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AQAP-4107
National quality assurance authorities in NATO and Partnership for Peace nations that request or perform Government Quality Assurance on each other's behalf, and the suppliers whose contracts it reaches
AQAP-4107 is NATO's agreement for nations to mutually accept each other's Government Quality Assurance, covering how a GQA request is raised, implemented, charged for and resolved when disputed.
AQAP-4107 is the NATO Allied Quality Assurance Publication that sets out how member nations mutually accept each other's Government Quality Assurance (GQA), and how the wider AQAP package gets used once GQA is requested. It is not a technical specification a supplier's quality system has to meet. It governs the relationship between two National Authorities: the one representing the nation buying a defence product (the delegator) and the one representing the nation where it is made (the delegatee). Each agrees to provide GQA on the other's behalf, on request, so that a buying nation does not need to send its own inspectors into another nation's supplier. The current edition is Edition B, Version 1, promulgated 4 June 2025, superseding Edition A, Version 2, which nations were instructed to destroy under their own local document-destruction procedure. The Aim states plainly that the publication exists "to set forth the principles under which Mutual Government Quality Assurance of defence products is to be performed by the appropriate National Authority of one NATO member nation, at the request of another NATO member nation or NATO Organization."
The document defines its own parties, and neither is a supplier. The delegator is "the appropriate authority of a NATO Nation or NATO Agency requesting GQA in a NATO supplying Nation," and the delegatee is "the appropriate authority of a NATO Nation performing GQA after acceptance of the RGQA." Behind both sits the National Quality Assurance Authority - "the military service, government agency or organisation within a NATO member state or Partnership for Peace country identified as an authority for NATO quality assurance matters." A supplier only appears once, in the Liability clause, where signing a GQAR statement "will not relieve the supplier from the responsibility for furnishing supplies that meet all specifications of the contract."
It binds nations through a ratified agreement: the NATO Letter of Promulgation records that "the agreement of nations to use this publication is recorded in STANAG 4107." Its effect on a supplier's own contract is one step removed from that. The document commits National Authorities to incorporate "appropriate NATO quality requirements (AQAP)... into contracts where GQA is requested under the terms of this publication," so a supplier meets it only once a GQA request has actually been raised between two nations and an AQAP written into the contract as a result.
Use of mutual GQA is deliberately restricted, not a default: a request is limited "to those cases where quality cannot be satisfactorily verified after receipt and GQA at source is considered essential to reduce or eliminate risk areas that have been identified for the product or the supplier." A request must contain, as a minimum, the delegating authority's own contact references, the contract references, the GQA requirements, the applicable contractual AQAP, and the nature of the risk justifying it, and it must be requested in accordance with AQAP-2070. The delegator must ensure the delegatee receives a copy of the contract and its supporting documents; which AQAP to select is a matter for the separate published guidance in AQAP-4107-SRD.2.
Once implemented, per STANAG 4107 and the AQAP-2070 process, GQA addresses five topics unless the two authorities agree otherwise: notification of unsatisfactory conditions (the delegatee must immediately advise the delegator of major deficiencies or excessive delay risk); the Certificate of Conformity (the delegator may ask the delegatee to sign the "GQAR Statement of GQA"); release for delivery ("Release for delivery of product subjected to GQA shall be as requested by the delegator on the RGQA"); deviation permits and concessions (the delegatee's participation follows the contract and the request); and the delegator's own participation (it must notify the delegatee of any visit to the supplier, so surveillance is coordinated rather than duplicated).
GQA is performed free of charge to the delegator unless otherwise agreed; unusually heavy costs can be negotiated, and expenses for product consumed during GQA are borne by the contracting parties. On liability, the document is explicit both ways: signing a GQAR Statement of GQA does not relieve the supplier of responsibility for meeting every specification of the contract, and the delegatee carries no liability for defects found on or after delivery, though it must assist the delegator's investigation. The delegator, in turn, must notify the supplier of any defect with supporting evidence and, where possible, samples of the defective parts. Any dispute the delegator and delegatee cannot settle through routine communication goes through the resolution process set out in AQAP-2070.
Annex A diagrams the whole family as a stack. AQAP-4107 sits at the top, alongside STANAG 4107, labelled "Agreement." Below it come AQAP-2000 ("Policy & Guidance") and AQAP-2070 ("Procedure"), then the "Prime QA Conditions" that a contract actually imposes on a supplier - AQAP-2110, AQAP-2190, AQAP-2131 and AQAP-2310 - and "Supplementary QA Conditions" AQAP-2105 and AQAP-2210, with Standard Related Documents providing supporting information and guidance beneath all of it. AQAP-4107 explains how the whole stack gets invoked between nations; it does not itself contain the requirements lower down the stack.
AQAP-4107 sets no requirement on a supplier's own quality management system, design process or production controls - those obligations live in whichever Prime or Supplementary QA Condition the contract names, not here. It also names no certification scheme: what it describes throughout is Government Quality Assurance, "the process by which the appropriate National Authorities establish confidence that the contractual requirements relating to quality are met," performed by one nation's authority for another's, never an accredited body auditing to award a certificate.
AQAP-4107 is closest to a policy or framework document: it explains how National Authorities recognise each other's Government Quality Assurance, rather than setting requirements a supplier implements directly. Most of the work a compliance team actually does still belongs to whichever Prime or Supplementary QA Condition the contract names - AQAP-2110, 2131, 2310, 2190, 2105 or 2210 - and that is where most of the evidence trail lives.
Where AQAP-4107 does touch a supplier directly, ComplyTrain holds the record: the Certificate of Conformity or GQAR Statement of GQA issued at release, tied to the delivery it covers; a log of deviation permits and concessions with their disposition and authorisation; and a record of any notification of unsatisfactory conditions together with the corrective action taken in response.
What ComplyTrain does not do: it does not perform Government Quality Assurance, act as a delegator, delegatee or GQAR, decide which nation's authority handles a contract, or take part in the charges, liability or dispute-resolution arrangements this document sets up between National Authorities. Those stay government-to-government matters outside any supplier's own system.
Which tier of AQAP a contract actually requires, and which nation's authority performs the surveillance, is set by the contract and the customer's quality clause, not by us. The standards explorer shows what sits alongside AQAP-4107 in a NATO quality assurance package - talk to us about the evidence trail behind whichever of those documents your contract names.
Tell us how you need to work with AQAP-4107 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AQAP-4107 sets up Government Quality Assurance between NATO National Authorities, not a certification scheme, and it names no accredited body. The actual evaluation of a supplier happens under whichever contractual AQAP a request invokes, such as AQAP-2110.
No. Annex A places AQAP-4107 at the "Agreement" level, above AQAP-2000's policy layer and AQAP-2070's procedure. The requirements a supplier's quality system meets sit in the "Prime QA Conditions" - AQAP-2110, AQAP-2190, AQAP-2131 and AQAP-2310 - which AQAP-4107 does not replace or duplicate.
It means one NATO nation's National Authority will perform Government Quality Assurance on behalf of another nation's authority, on request, so the requesting nation does not send its own inspectors abroad. Both nations agree in advance, through STANAG 4107, to accept the results of that arrangement.
The delegator is the National Authority of the nation requesting GQA, usually representing the buying government or a NATO organization. The delegatee is the National Authority of the nation where the product is made, which performs the GQA once it accepts the request.
It binds nations that have ratified STANAG 4107, which records their agreement to use it. For a supplier, it has no direct force on its own; it only reaches a contract once a National Authority actually raises a GQA request and an AQAP is written into that contract.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.