What additional requirements apply to suppliers in the defence industry?

For companies with a quality management system implemented in accordance with ISO 9001, participation in defence industry supply chains may involve meeting additional requirements. Where a contract specifies the application of AQAP-2110, the supplier must also comply with NATO's specific quality management and quality assurance requirements.
AQAP-2110 (NATO Quality Assurance Requirements for Design, Development and Production) is a NATO publication intended for use in contracts involving design, development and production. It builds on ISO 9001 by introducing additional requirements for managing contractual risks, configuration, suppliers, production processes and evidence of product conformity.
What are the main differences, and what should companies already applying ISO 9001 consider?

ISO 9001 as the Foundation of AQAP-2110
ISO 9001 specifies general requirements for quality management systems and applies to organisations across all sectors.
AQAP-2110 builds on this foundation but introduces specific requirements relating to the performance of defence contracts, risk management and the provision of objective evidence of product conformity.
For organisations already applying ISO 9001, preparation for AQAP-2110 usually begins with a gap analysis comparing the existing management system against NATO's additional requirements.
It is important to note that AQAP-2110 is contractual in nature. The supplier's specific obligations depend on the applicable edition of the publication and the terms of the relevant contract.

Contractual Risk Management
ISO 9001 requires organisations to identify and address risks that may affect the achievement of intended results.
AQAP-2110 introduces more specific requirements for managing risks associated with contract performance. Risk assessment must also cover risks related to external providers, starting at the contract review stage and being updated as necessary.
The supplier must maintain objective evidence of risk identification, analysis, assessment and control, as well as the actions taken to mitigate identified risks.
Under AQAP-2110, Edition D, Version 1, risk management must be based on the principles and guidelines of ISO 31000:2009, unless otherwise specified in the contract.
The Risk Management Plan must be made available to the Government Quality Assurance Representative (GQAR) and/or the Acquirer, who have the right to reject the plan or any amendments if they do not meet the applicable requirements.

Quality Planning
One of the key features of AQAP-2110 is the requirement to develop and submit a Quality Plan for the specific contract.
The plan defines how contractual requirements will be met, including the necessary processes, resources, responsibilities, inspections, tests and acceptance criteria.
Traceability between contractual requirements and the arrangements for meeting them is particularly important. AQAP-2110 therefore requires a Requirements and Solutions Compliance Matrix.
The matrix may be included in the Quality Plan or provided as a separate annex. Subject to agreement with the Acquirer and/or GQAR, it may also be submitted after the initial issue of the plan.
The applicable requirements of AQAP-2105 concerning the content of Quality Plans should also be considered when developing the plan.
The Quality Plan must be submitted within the agreed timeframe, before the relevant activities begin. The Acquirer and/or GQAR have the right to reject the plan or any amendments.

Configuration and Change Management
ISO 9001 includes requirements for managing changes, but AQAP-2110 establishes more specific obligations for configuration management.
These cover configuration planning, identification of configuration items, change control, configuration status accounting and configuration audits.
The supplier must develop a Configuration Management Plan in accordance with the applicable requirements, including ACMP 2100, contractual conditions or a recognised national equivalent. The plan may be a standalone document or part of another plan, where appropriate.
These requirements are particularly important for complex products and systems, where changes to individual components may affect the technical characteristics, compatibility or operation of the entire system.
Configuration management must ensure that approved changes are traceable and that the actual configuration status of products can be established.

Control of Suppliers and Subcontractors
ISO 9001 requires control of externally provided processes, products and services. AQAP-2110 supplements these requirements with specific obligations for suppliers operating within defence supply chains.
Organisations must ensure that applicable contractual requirements, including relevant AQAP requirements, are flowed down to their suppliers and subcontractors.
A formal review of purchasing documents is also required to confirm that contractual requirements have been correctly communicated, with documented evidence of the review retained.
Purchasing documents must include the notification specified in AQAP-2110 concerning the possibility of Government Quality Assurance activities being conducted at external providers' premises.
Where critical components, significant production activities, design work or high-risk technical solutions are outsourced, more extensive control of the supply chain is necessary. Under certain circumstances, the supplier also has obligations to notify the Acquirer and/or GQAR.
AQAP-2110 explicitly requires a process for preventing, detecting and managing counterfeit materials and components.
Responsibility for the conformity of delivered products remains with the main supplier, including where certain activities are subcontracted.

Traceability, Production Control and Evidence of Conformity
AQAP-2110 establishes specific requirements for the documented information needed to demonstrate product conformity.
The supplier must determine which documents, records, acceptance criteria and configuration data will be used as objective evidence of compliance with contractual requirements.
Traceability is mandatory where the failure of a product or component could result in the loss of equipment, degradation of operational performance or loss of human life.
Additional requirements also apply to production control. Appropriate production instructions, defined workmanship criteria and controls over processes affecting product conformity must be established.
Particular attention is given to measuring equipment and ensuring reliable measurement results. AQAP-2110, Edition D, Version 1, requires the application of ISO 10012:2003, unless otherwise specified in the contract, and establishes specific obligations when measuring equipment fails calibration.
Additional requirements apply to product release, including the provision of a Certificate of Conformity (CoC), unless otherwise specified.
Where the Acquirer and/or GQAR are required to conduct final inspection or formal acceptance, AQAP-2110 requires advance notification of at least 10 working days, unless otherwise specified in the contract.
The product Certificate of Conformity confirms that the delivered products meet the contractual requirements. It is not a certificate confirming that the quality management system conforms to AQAP-2110.

Management of Nonconformities and Corrective Actions
Under AQAP-2110, the control of nonconforming products is directly linked to the supplier's contractual obligations towards the Acquirer.
Documented procedures are required for identifying, controlling and segregating nonconforming products. Products with an undetermined or unknown status must also be treated as nonconforming.
The supplier must notify the Acquirer and/or GQAR of identified nonconformities and the necessary corrective actions, unless otherwise agreed.
Where the use or acceptance of nonconforming products is proposed through an authorised deviation from requirements, the relevant approvals must be obtained from the Acquirer and/or GQAR in accordance with the applicable contractual conditions.
AQAP-2110 also explicitly requires the supplier to establish a root cause analysis process for nonconformities, including defined methods and techniques for conducting the analysis.
The aim is not only to address the specific nonconformity but also to take action to prevent its recurrence.

Internal Audits and Effectiveness Evaluation
ISO 9001 requires organisations to plan and conduct internal audits of their quality management systems.
AQAP-2110 supplements these requirements with more specific obligations concerning audit scope and the verification of activities related to contract performance.
The internal audit programme must cover critical contractual processes and activities annually, including applicable contractual requirements and additional NATO requirements.
Documented evidence of auditors' training, competence and experience must also be maintained.
Audit results should be used to evaluate the effectiveness of the quality management system, identify gaps and implement the necessary corrective actions.

Interaction with the Acquirer and Government Quality Assurance
One of the key differences compared with ISO 9001 is the involvement of the Acquirer and the authorised Government Quality Assurance Representative (GQAR).
AQAP-2110 provides rights of access to facilities, processes, documentation and the necessary evidence of conformity related to contract performance. These rights may also extend to activities carried out by external providers.
The organisation must appoint a representative from its management with the necessary authority, competence and independence to address quality-related matters. This representative must have direct access to top management and maintain the necessary communication with the Acquirer and/or GQAR.
Government Quality Assurance activities do not relieve the supplier of responsibility for product quality and conformity.

How Can Organisations with ISO 9001 Prepare?
For companies with an established quality management system, implementing AQAP-2110 does not necessarily mean developing an entirely new system.
Existing processes can provide the foundation for integrating the additional requirements.
Practical preparation includes reviewing contractual obligations, conducting a gap analysis, updating processes and documentation, assigning responsibilities and verifying implementation through internal audits.
Particular attention should be paid to contractual risk management, quality planning, configuration management, control of external providers and the availability of evidence of conformity.
It is important to note that the new edition, ISO 9001:2026, was published in September 2026. However, AQAP-2110, Edition D, Version 1, continues to contain an explicit normative reference to ISO 9001:2015.
Publication of the new edition of ISO 9001 does not automatically change the requirements of AQAP-2110. Organisations must therefore check the applicable edition of AQAP-2110, the terms of the specific contract and the requirements applicable to their quality management system.
ISO 9001 certification alone does not demonstrate conformity with AQAP-2110. Organisations must also be able to demonstrate fulfilment of the applicable additional NATO requirements.

How Can CONSEJO Help?
CONSEJO supports companies in implementing AQAP-2110 requirements and integrating them into existing quality management systems based on ISO 9001.
Our consulting services include gap analysis, documentation development and adaptation, implementation support, internal audits and preparation for conformity assessment and certification, where applicable.
Learn more about NATO AQAP standards and our AQAP standards implementation services.