Defence industry
AQAP 2110: NATO’s requirements on top of ISO 9001
For suppliers in the defence sector AQAP 2110 is the threshold below which no contract is discussed. It rests entirely on ISO 9001 and adds what NATO requires on top — a quality plan, configuration management and right of access for the government representative. We prepare both together.
ISO 9001mandatory foundation
GQAgovernment quality assurance
NCAGEcode for the NATO chain
6–10 mo.typical route from scratch
In short
What AQAP 2110 is
Short answer
AQAP 2110 is a NATO publication setting quality assurance requirements for design, development and production. It is not a standalone management system standard — it presumes a working ISO 9001 system and adds the Alliance’s additional requirements for defence supply on top of it.
The logic is simple: with defence production the consequence of a defect does not end with a complaint. NATO therefore requires more visibility into the process — a pre-agreed quality plan, strict configuration management, and the right of a government representative to verify production before the product is accepted.
AQAP does not supersede ISO 9001. On the contrary, it presumes it. A company without a working quality management system cannot meet the AQAP requirements, because they build on clauses that must already exist. In most projects the two are therefore implemented together rather than sequentially.
The core
What AQAP 2110 adds to ISO 9001
| Area | The additional requirement |
|---|---|
| Quality plan | A contract-specific document describing how the requirements will be met, submitted to the customer for agreement |
| Configuration management | Identification, version control, status accounting and configuration audit of the product throughout the contract |
| Right of access | The government quality assurance representative has access to premises, processes and records, including at subcontractors |
| Notification of nonconformity | An obligation to notify the customer promptly of nonconforming product and of any proposed deviation |
| Risk management | A formal approach to risks associated with contract performance, not only risk-based thinking |
| Flow-down of requirements | The relevant AQAP requirements are passed down to subcontractors along the chain |
Where companies underestimate the work: configuration management. Under ISO 9001 version control is often informal. AQAP requires a traceable history of every change to the product and its documentation, so that at any moment you can state which configuration was delivered under which contract.
The family
AQAP 2110, 2210 and 2310 — which applies to you
AQAP 2110
The base publication for quality assurance in design, development and production. The starting point for most suppliers.
AQAP 2210
A supplement for software. Applied alongside AQAP 2110 when the contract includes software development.
AQAP 2310
Requirements for suppliers in the aviation, space and defence sector, linked to the corresponding sector systems.
Which one applies is determined by the customer and stated in the contract or in the tender documentation. If a specific procedure is coming up, the fastest check is in its conditions.
Applicability
Who the standard is for
Manufacturers
Of components, assemblies, ammunition, optics, electronics and special equipment for defence use.
Subcontractors
Firms in the supply chain to whom requirements are passed down by the prime contractor.
Developers
Design and software organisations taking part in contracted development.
Repair and maintenance
Organisations performing repair, upgrade and technical servicing of equipment.
How we work
The route to the certificate
For companies with an existing ISO 9001 certificate the timeline is considerably shorter. The figures below assume both are built together.
- 1
Analysis of the contract requirements
We check which AQAP publication is required, what additional customer clauses apply and what is missing in your current system.
1–2 weeks - 2
Building or aligning ISO 9001
The base system must be working before the specific requirements are added. With an existing certificate this step falls away.
6–10 weeks - 3
Configuration management
We introduce configuration identification, change control, status accounting and preparation for a configuration audit.
3–5 weeks - 4
Quality plan and contract processes
We produce a quality plan template, the route for notifying nonconformity and requesting deviations, and the flow-down to subcontractors.
2–4 weeks - 5
Registrations and GQA readiness
Support with the NCAGE code and relevant registrations, and preparation of the team and records for a government representative’s visit.
2–4 weeks - 6
Certification audit
Preparation and attendance at the certification body’s audit, covering both ISO 9001 and the additional AQAP requirements.
6–10 weeks to certificate
The full route into the NATO supply chain — NCAGE, government quality assurance and registration — is set out step by step in how a company becomes a NATO supplier.
Further reading
More on the topic
Questions and answers
Frequently asked questions
Does AQAP 2110 replace ISO 9001?
No. AQAP 2110 presumes a working ISO 9001 system and adds NATO’s additional requirements on top of it. An organisation without a functioning quality management system cannot meet the AQAP requirements, because they build on clauses that must already exist. In most projects the two are implemented together.
What is the difference between AQAP 2110, 2210 and 2310?
AQAP 2110 is the base publication for quality assurance in design, development and production. AQAP 2210 is a software supplement applied alongside 2110 when the contract involves software development. AQAP 2310 contains requirements for suppliers in the aviation, space and defence sector. Which applies is stated in the contract.
What is government quality assurance?
Government quality assurance, or GQA, is a process in which an authorised government representative verifies that the supplier meets the contract requirements. It is requested by the customer and carried out through the national authority of the relevant country. For the supplier it means an obligation to provide access to premises, processes and records.
Who performs AQAP certification?
Certification is carried out by certification bodies that offer assessment against the AQAP publications alongside ISO 9001. Government quality assurance is a separate process requested by the customer through the relevant defence ministry structures. The two should not be conflated — a certificate does not replace GQA, nor the other way round.
What is an NCAGE code and how is it obtained?
NCAGE is a unique organisational identifier within NATO’s codification system. It is required for participation in the Alliance’s supply chain and is obtained through the national codification bureau. The code itself is not a certificate and does not evidence quality — it is a registration identifier.
How long does implementation take?
For an organisation with a current ISO 9001 certificate the additional AQAP requirements take roughly three to five months to implement. If the quality management system is built at the same time, the realistic timeline is six to ten months. The longest specific part is usually configuration management.
Does AQAP apply only to NATO member states?
The publications were developed for the Alliance’s needs, but they are also applied by suppliers outside it when taking part in contracts with NATO members or their prime contractors. What matters is the requirement in the specific contract, not the membership status of the country.
Must our subcontractors also be certified?
Requirements are passed down the chain in proportion to the influence of the supply on the final product. That does not always mean full certification of every subcontractor, but it does mean contractual obligations, right of access and control on your side — most often through a supplier audit.
Check the requirements of your specific procedure
The fastest way to size the work is to look at the tender documentation — it states which publication is required and what additional clauses the customer imposes.