Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 2518
NATO nations that ratify the agreement, and the national authorities and staffs a nation directs to put AJP-10.1 into effect
STANAG 2518 is NATO's ratification agreement bringing AJP-10.1, Allied joint doctrine for information operations, into force for participating nations.
STANAG 2518 is the NATO standardization agreement that gives force to AJP-10.1, Edition A, Allied joint doctrine for information operations. A STANAG is not itself a technical specification: it is the agreement by which NATO nations commit to implement one, and the doctrine's own content sits in the Allied Publication it covers, not in this cover document. This STANAG responds to an interoperability requirement stated plainly on its cover: "guidance and directions on the concept, underlying philosophy and fundamentals of Information Operations (Info Ops), its related information staff function and communication capabilities, and their combined integration into planning, execution and assessment, with a focus on the operational level."
This is Edition 3, promulgated 26 January 2023. It supersedes STANAG 2518, Edition 2, dated 7 December 2015.
The mechanism that matters here: a STANAG binds a nation, not a supplier. The Letter of Promulgation records that the agreement "has been ratified by member nations, as reflected in the NATO Standardization Document Database (NSDD)," and any nation still deciding its position is "invited to examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its ratification and implementation." The Enactment clause states plainly that "this STANAG is effective upon receipt for use by the participating nations and NATO bodies." A nation has only implemented it once "the necessary orders/instructions have been issued directing the forces concerned to put the content of the covered standard into effect, including Info Ops processes and structures or similarities to them, and to include it into national education, training and exercises programmes." A supplier meets AJP-10.1 only where a contract or a tender brings it in by name, not because the STANAG exists on its own.
Allies and NATO bodies report both their ratification and their implementation details through NATO's electronic reporting tool (e-Reporting), recorded in the NSDD; partner nations are invited, not required, to report their implementation the same way. This STANAG is reviewed in accordance with AAP-03, and the result of that review is recorded within the NSDD.
No certification exists here, and the document names none. What it describes is a national ratification, implementation and review cycle run through NATO's own machinery, not an audit against this STANAG as such. What AJP-10.1 actually requires of an information staff, and how well it is executed, sits in that publication and in a nation's own military standards and any customer's quality clause, not in this cover.
The cover's list of related documents ties AJP-10.1 to the rest of NATO's operations doctrine: STANAG 2437 covers AJP-01, the Allied joint doctrine capstone; STANAG 2490 covers AJP-03, Allied joint doctrine for the conduct of operations; and STANAG 2526 covers AJP-05, Allied joint doctrine for the planning of operations. It also names four NATO policy instruments outside our catalogue: PO(2009)0141, NATO's Strategic Communications Policy, and Military Committee policies MC 0628, MC 0422 and MC 0457.
STANAG 2518 describes a national ratification and implementation cycle, not a body of work software carries out: its own Implementation of the Agreement clause ties practical effect to orders and instructions being issued and to folding the doctrine's processes and structures into "national education, training and exercises programmes," not to a system a contractor runs. What that leaves to evidence is the paperwork around it: the implementing order or instruction itself, held as a controlled document; training and exercise records showing the relevant processes were actually incorporated as required; and a record of what was submitted through NATO's electronic reporting tool.
ComplyTrain holds that evidence as a modern, auditable system: version-controlled implementing instructions, training records tied to named individuals and dates, and a log of submissions and reviews (this STANAG's own review runs in line with AAP-03) that survives staff turnover. It does not ratify a STANAG on a nation's behalf, does not submit a nation's e-Reporting return, and does not decide what AJP-10.1 requires operationally.
The applicable tier here, and whatever else it comes with, is set by the contract and the customer's quality clause. If you are working out what sits alongside STANAG 2518, the standards explorer covers the related NATO doctrine publications, and we are glad to talk through what that means in practice.
Tell us how you need to work with STANAG 2518 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not in general. It binds a nation once that nation ratifies it, and it reaches a supplier through a contract or a tender that names AJP-10.1 or this STANAG, not by existing on its own. Whether it applies to a given programme is set by the tasking or contract in front of you.
STANAG 2518 is the agreement: the letter of promulgation, the ratification record, and the reporting and review machinery. AJP-10.1 is the publication itself, the Allied joint doctrine for information operations. The STANAG is the cover; AJP-10.1 is the content.
Edition 3, promulgated 26 January 2023. It supersedes STANAG 2518, Edition 2, dated 7 December 2015.
No. There is no accredited certification for STANAG 2518 or AJP-10.1 to hold, and ComplyTrain does not claim one. What we support is the evidence trail around implementation and training records, at an informational level.
NATO member nations do, individually, with partner nations invited to report their implementation on the same terms. Ratification and implementation details are both recorded in the NATO Standardization Document Database.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.