NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production

Conduct internal audits per ISO 19011 covering all QMS processes annually. Hold management reviews at planned intervals (minimum annually) per ISO 9001 Section 9.3 with mandatory AQAP 2110 inputs (NATO contract performance + GQAR observations + nonconformity trends + counterfeit material events + customer satisfaction). Implement corrective action per ISO 9001 Section 10.2 with effectiveness verification. Issue Certificate of Conformity (CofC) per AQAP 2110 Annex A with GQAR countersignature for NATO acceptance. Drive continual improvement through quality objectives, performance metrics, and lessons learned.

• Annual internal audit programme + reports
• Management review minutes with AQAP inputs
• Corrective Action Requests (CARs) with effectiveness verification
• Certificate of Conformity templates + signed copies
• Quality objectives + performance metrics
• Lessons learned database

• No internal audit programme
• Management review missing AQAP inputs
• CARs without effectiveness verification
• Unsigned CofC

Implement configuration management per ISO 10007 and the AQAP 2110 supplement covering: configuration identification (baselines + part numbers + revision marks + serial numbers), configuration control (engineering change proposals + change requests + deviations + waivers), configuration status accounting (item history + as-built records + change boards), configuration verification and audit (functional configuration audit + physical configuration audit). Notify the GQAR and customer of all Class I changes (form/fit/function/interface affecting) prior to incorporation.

• Configuration Management Plan (CMP)
• Engineering Change Proposal (ECP) log
• Baseline registers
• FCA + PCA reports
• Class I change notification records
• Deviation and waiver register

• No CMP
• Missing ECP tracking
• No FCA/PCA
• No customer change notification

Plan, document, and control the design and development process per ISO 9001 Section 8.3 supplemented by AQAP 2110 Edition D requirements. Establish design inputs (regulatory + statutory + customer + reliability + maintainability + safety) and design outputs (drawings + specifications + verification criteria + acceptance criteria + production traveler). Conduct formal design reviews, design verification, design validation, and design transfer including ISO 13485 Clause 7.3.1-7.3.9 cross-walk for medical-device-adjacent defence systems. Maintain dependability requirements (reliability + maintainability + availability + safety + security).

• Design and Development Plan (DDP)
• Design input register
• Design output documents
• Design review minutes (preliminary + critical)
• Design Verification Report
• Design Validation Report
• Design transfer record
• Dependability assessment (RAMS)

• No DDP
• Missing dependability requirements
• No formal design reviews
• Incomplete validation

Provide unrestricted access and surveillance authority for the Government Quality Assurance Representative (GQAR) representing the acquiring NATO nation per STANAG 4107 Mutual Acceptance of Government Quality Assurance (Mutual GQA) and the Allied Quality Assurance Publication 2070 (AQAP 2070). Cooperate with GQAR throughout product lifecycle including design reviews + verification activities + production surveillance + acceptance testing + certificate of conformity issuance + nonconformity disposition.

• GQAR appointment letter
• Site access authorisation
• Surveillance plan acknowledgement
• Joint surveillance reports
• Design review GQAR participation records
• Certificate of Conformity (CofC) with GQAR signature
• Mutual GQA recognition evidence

• No GQAR appointment letter
• Restricted GQAR access
• Missing CofC GQAR endorsement
• No mutual GQA evidence

Control production and service provision per ISO 9001 Section 8.5 supplemented by AQAP 2110 production controls including: special process qualification (welding + heat treatment + plating + non-destructive testing per AWS + ASME + NADCAP), identification and traceability throughout production, control of monitoring and measuring equipment per ISO 10012 (calibration + traceability to national standards), inspection and testing per quality plan, control of nonconforming outputs with material review board (MRB) disposition, and records control per ISO 9001 Section 7.5 with NATO-specified minimum retention of 10 years from contract completion.

• Special process qualification certificates (NADCAP)
• Traveler / production card
• Calibration records traceable to national standards
• Inspection records per quality plan
• Nonconformity register + MRB minutes
• Records retention schedule (10 years minimum)

• No NADCAP for special processes
• Lapsed calibration
• No MRB
• Records retention shorter than 10 years

Establish, document, implement, and maintain a Quality Management System (QMS) that satisfies ISO 9001:2015 as the baseline and the NATO supplementary requirements in AQAP 2110 Edition D Version 2 (published April 2023, replacing Edition D Version 1 of 2018 and Edition C of 2009). Maintain QMS scope covering all design, development, and production activities subject to NATO contracts including allied government acquisitions. Demonstrate top management commitment and customer focus per ISO 9001 Section 5 supplemented by AQAP NATO contractual obligations.

• QMS manual aligned to ISO 9001:2015 + AQAP 2110
• ISO 9001 third-party certificate
• NATO contract reference linking AQAP 2110
• Top management commitment evidence
• Context of organisation analysis
• QMS scope statement

• No ISO 9001 certification
• Outdated QMS
• No NATO contract linkage
• Missing top management commitment

Conduct risk management per ISO 9001 Section 6.1 supplemented by AQAP 2110 risk-based thinking requirements covering technical risk, schedule risk, cost risk, quality risk, supply chain risk, counterfeit material risk, cybersecurity risk (per AQAP 2110 Edition D 2023 addition), and obsolescence risk. Maintain risk register with likelihood, severity, mitigation, owner, target date. Escalate to programme management board for high-severity risks. Coordinate with GQAR on risks affecting NATO product acceptance.

• Risk Management Plan (RMP)
• Risk register with severity + likelihood
• Mitigation plans
• Cybersecurity risk assessment
• Supply chain risk assessment
• Obsolescence risk register
• GQAR risk coordination minutes

• No RMP
• Outdated risk register
• Missing cybersecurity risk
• No GQAR coordination

Flow down AQAP 2110 requirements to subcontractors and suppliers including subcontractor QMS audits, supplier qualification, first article inspection, material certifications, certificates of conformity, and counterfeit material prevention per SAE AS5553 or equivalent (added in AQAP 2110 Edition D 2023). Maintain approved supplier list (ASL) and conduct supplier surveillance. Apply enhanced controls for parts subject to obsolescence and Diminishing Manufacturing Sources and Material Shortages (DMSMS).

• Approved Supplier List (ASL)
• Subcontractor QMS audit reports
• Flow-down clause review records
• Counterfeit Material Prevention Plan (SAE AS5553)
• First Article Inspection (FAI) reports
• Certificate of Conformity from suppliers
• DMSMS register

• No ASL
• Missing flow-down
• No counterfeit prevention plan
• Incomplete FAI