Platform
Modules
By sector
By sector
By standard
Blog
News
Events
STANAG 5636
National authorities and NATO bodies whose systems must exchange interoperable metadata with NATO communications and information systems
STANAG 5636 is NATO's ratified agreement committing member nations to implement ADatP-5636, the metadata specification for interoperable data exchange across NATO systems.
STANAG 5636 is the NATO standardization agreement covering ADatP-5636, the NATO Core Metadata Specification (NCMS), Edition A. Like every STANAG, it is not itself the technical specification: the document states its aim is "To define the core set of metadata elements that should be used to support interoperable information exchange," and it agrees, on behalf of participating nations, to implement the standard it names as "ADatP-5636, Edition A." The metadata elements themselves live in ADatP-5636; STANAG 5636 is the ratified commitment to use it.
That distinction matters because a STANAG binds nations, not suppliers. It becomes relevant to a supplier only where a contract, a tender, or a nation's own system specification requires ADatP-5636 conformant metadata handling - the STANAG itself creates no obligation on a company reading it.
STANAG 5636 "is effective upon receipt for use by the participating nations and NATO bodies," not suppliers or manufacturers. It binds through ratification: nations are "invited to examine their ratification of the STANAG and, if they have not already done so, advise the NSO of their intention regarding its ratification and implementation." Ratifying and implementing are tracked separately, both reported through NATO's electronic reporting system. It is supervised under the authority of the C3 Board (C3B).
The document is specific about the test a national system has to pass. A nation has implemented STANAG 5636 when it "has integrated into any national system that interfaces with any NATO communications and information system the required mechanisms or processes" that both "binds the requisite metadata to finite data objects exchanged among such systems, in accordance with ADatP-5636" and "processes the requisite metadata bound to finite data objects received from such systems, in accordance with ADatP-5636." In practice that is two separate capabilities: producing the metadata binding on data going out, and reading it on data coming in.
There is no NATO Effective Date attached to this STANAG - the document records "NATO EFFECTIVE DATE (NED) Not applicable" - so timing runs entirely through each nation's own ratification and implementation, not a fixed calendar date. This edition does not supersede an earlier one: "This STANAG does not supersede any document." It is reviewed periodically, "in accordance with AAP-03," with the outcome recorded in NATO's own standardization database.
The document lists two related agreements under "OTHER RELATED DOCUMENTS": STANAG 4774 (confidentiality metadata label syntax, carried in ADatP-4774) and STANAG 4778 (the metadata binding mechanism, carried in ADatP-4778). Both inform how metadata of this kind is labelled and bound, but neither is a requirement of STANAG 5636 itself: STANAG 4774, ADatP-4774, STANAG 4778 and ADatP-4778. ADatP-5636 itself is the specification this STANAG commits to. STANAG 5636 is reviewed under AAP-03.
There is no certification against STANAG 5636 in any accredited sense. NATO does not audit a supplier or a product; nations self-report both their ratification and their implementation "through the electronic reporting tool (e-Reporting)," and the review outcome is likewise recorded rather than certified by a third party.
STANAG 5636 is an agreement between nations about metadata interoperability, and the work it describes - integrating the binding and processing mechanisms into a national system that interfaces with NATO's own systems - is systems engineering, not paperwork. ComplyTrain does not build, test or certify a metadata-binding mechanism, and it does not file a nation's implementation report to NATO.
Where this reaches a supplier at all, it is because a contract or a customer's system specification requires ADatP-5636 conformant metadata handling, and that is where the evidencing work looks familiar: a procedure describing which systems and interfaces are in scope, records of who tested the binding and processing mechanisms and when, and a clear audit trail showing the requirement was actually addressed. ComplyTrain holds that procedure, that training record, and that test evidence - it does not do the systems engineering itself.
Which of ADatP-5636, STANAG 4774/4778 or another interoperability agreement actually applies to a given contract is set by the contract and the customer's quality clause, not by this page. The standards explorer shows what sits alongside STANAG 5636. Talk to us about holding the evidence trail once you know what your contract requires.
Tell us how you need to work with STANAG 5636 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. It binds a nation once that nation has ratified it, and reaches a supplier only when a contract or a system specification invokes ADatP-5636 conformant metadata handling. Read the contract's quality clause, not the STANAG, to know whether it applies to you.
STANAG 5636 is the ratified agreement; ADatP-5636 is the technical specification it names, "ADatP-5636, Edition A," which carries the actual metadata elements. The STANAG is the commitment, not the content.
No. The document describes no certification body: nations report their own ratification and implementation status through NATO's electronic reporting tool, and there is no accredited scheme to certify a supplier or product against it.
The document lists both under its "OTHER RELATED DOCUMENTS": STANAG 4774 covers confidentiality metadata label syntax and STANAG 4778 covers the metadata binding mechanism. Both inform metadata handling of this kind but are not requirements of STANAG 5636 itself.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.