AQAP 2110, in plain language for the procurement desk

What AQAP 2110 is

AQAP 2110 is the NATO Allied Quality Assurance Publication that sets out quality management system requirements for design, development, and production of defense supplies. The full title of the current edition is "NATO Quality Assurance Requirements for Design, Development and Production." Tanax operates under AQAP 2110:2017, Edition D.

The standard exists under STANAG 4107, the Standardization Agreement that binds NATO member nations to a common quality assurance framework. STANAG 4107 is the legal-procedural envelope. AQAP 2110 is the technical content inside it. Together they give a prime contractor or ministry of defense a recognised basis for placing quality requirements into a contract and a recognised basis for verifying that the supplier is meeting them.

In practical terms, AQAP 2110 contains the entirety of ISO 9001 plus a set of additional clauses that are specific to defense procurement. Where ISO 9001 stops at "the organization shall plan and control the design and development," AQAP 2110 adds requirements on configuration management, risk management documented in a risk register that is shared with the customer, supplier traceability that extends through the chain, deliverable Quality Plans approved before production, and right of access for a Government Quality Assurance Representative.

For a buyer, the headline is straightforward. An ISO 9001 vendor manages quality internally. An AQAP 2110 vendor manages quality with you, with documentation that you and your government quality representative can audit at any point in the contract.

AQAP 2110 vs ISO 9001

A direct comparison clarifies why a defense buyer should care about the difference.

| Area | ISO 9001:2015 | AQAP 2110:2017 | | --- | --- | --- | | Quality plan approval | Internal | Customer or GQAR approves before production | | Risk management | Required but internal | Documented risk register, externally reviewable | | Configuration management | Implied | Explicit CM plan, change control, status accounting | | Supplier traceability | Implied | Required and auditable through the chain | | Government access | Not addressed | GQAR site access and audit rights are mandatory | | Nonconformity records | Internal | Subject to GQAR review | | Flow-down to subcontractors | Recommended | Contractually mandatory with AQAP clauses | | Contract-specific deliverables | At supplier discretion | Quality Plan tied to contract scope |

ISO 9001 is necessary but not sufficient for a defense contract that touches NATO scope. AQAP 2110 sits on top of ISO 9001. A supplier that holds both, as Tanax does, is running ISO 9001 as the underlying QMS architecture and AQAP 2110 as the defense-grade overlay.

The most important practical shift is the move from internal verification to external verification. Under ISO 9001 the supplier's auditor confirms that controls exist and are working. Under AQAP 2110 the customer or a designated Government Quality Assurance Representative can verify the same controls, on site, with right of access to records, processes, and personnel. The internal audit cycle still runs. The external one runs in parallel.

What an audited AQAP 2110 supplier delivers

When you place a contract with a supplier audited to AQAP 2110, the deliverables go well beyond the physical product. The full deliverable set includes the following.

A contract-specific Quality Plan. This is not a generic QMS manual. It is a document that maps the specific scope of your contract to the supplier's processes, identifies which procedures apply at each gate, names the responsible engineers and quality leads, and lists the inspection points and acceptance criteria. The plan is submitted for customer or GQAR approval before steel is cut.

A risk register. Risks are identified at contract review and tracked through production. The register covers competence, process repeatability, supplier and subcontractor lead times, surge capacity, terminology control, and any program-specific exposures such as security clearances or export classifications. The register is a live document, reviewed at each milestone.

A configuration management plan. Every change to the product baseline is identified, controlled, accounted for, and audited. The plan defines what the configuration items are, who can authorise changes, and how the as-built configuration is recorded against the as-designed baseline.

Traceability documentation. Material certificates, weld procedure specifications (WPS), procedure qualification records (PQR), welder qualifications under EN ISO 9606, paint batch records, blast records to Sa 2.5, and assembly records all attach to the unit serial number. The chain is auditable.

Nonconformity and corrective action records. Every nonconformity raised during production is logged, dispositioned, and reviewed. Records are open to the GQAR and to the customer's own quality team.

A Certificate of Conformity at handover. The CoC links the as-built unit to the contract scope and to the Quality Plan, and is signed by the responsible quality manager.

For a procurement officer, the question to ask is not "do you have AQAP 2110." It is "show me your last contract Quality Plan, your active risk register, and a sample CoC." A real AQAP 2110 vendor produces these on request.

NSPA CAGE codes (and what 4094M means)

A CAGE code, or Commercial and Government Entity code, is a five-character alphanumeric identifier that uniquely identifies a supplier within the NATO Codification System. Codes assigned to US suppliers are issued by the US Defense Logistics Agency. Codes assigned to non-US suppliers are NCAGE codes, issued either by the supplier's National Codification Bureau (NCB) where one exists, or by the NATO Support and Procurement Agency (NSPA) where it does not.

NSPA is the NATO procurement agency, based in Capellen, Luxembourg. It is the entity that operates the codification ePortal and that issues NCAGEs to non-US entities. The code is the supplier's unique identifier across NATO logistics systems, defense procurement databases, and US SAM.gov registration. It is also the identifier a NATO prime contractor uses to verify that you exist as a recognised supplier before placing a subcontract.

Tanax holds NCAGE 4094M, registered through NSPA in September 2025. Five characters, alphanumeric, permanent for the legal entity (TANAX TRUCKS a.s.) and the production facility in Bánovce nad Bebravou. The code is associated with our address, contact details, business activity codes, and product/service capabilities. Renewal cycles follow NSPA cadence.

For a buyer, the code does three concrete things. It confirms that the supplier exists in NATO's codification system as a registered entity. It enables the supplier to be referenced in any NATO procurement record by a single immutable identifier. And it is a prerequisite for being placed on most NATO and national defense vendor master files, including national framework agreements and prime contractor approved vendor lists.

A CAGE code is necessary but not sufficient. A supplier can hold a CAGE and be a paper trader with no production. The code identifies the entity; AQAP 2110 audits the operation behind the entity. Buyers should always confirm both.

How AQAP 2110 flows down to subcontractors

A NATO prime that holds an AQAP 2110 obligation does not absorb that obligation alone. The standard requires the prime to flow the relevant AQAP clauses down to its external providers, in legally binding contract language, wherever those providers contribute to the deliverable.

In practice, flow-down means three things.

First, the subcontract document must reference the applicable AQAP requirements explicitly. A line in the purchase order that says "supplier shall comply with AQAP 2110 to the extent applicable to this scope" is the minimum. A more rigorous prime will attach the relevant clauses as a contractual annex.

Second, the subcontractor must accept right of access for the GQAR. This is the most-missed clause when smaller subcontractors are first onboarded. The GQAR has the right to inspect the subcontractor's facility, records, and processes, on the same basis as the prime's own facility. If the subcontractor refuses or delays access, the prime is in breach.

Third, the prime remains responsible for the subcontractor's compliance. Outsourcing the work does not outsource the obligation. The prime must have documented qualification evidence for each subcontractor, maintained records of the qualification, and an audit programme that confirms continued compliance through the life of the contract.

For a buyer evaluating a supplier, the question to ask is: "show me your approved subcontractor list, the AQAP-relevant clauses in your standard purchase order, and the audit programme that maintains the list." A supplier that has flowed the standard properly down its own chain will produce these as a matter of routine.

Tanax operates almost the entire production process in-house in Bánovce nad Bebravou. Steel cutting, welding, blasting, painting, assembly, and QA all sit under one roof, under one quality system. Subcontracted scope is limited (specialist electrical, specialist HVAC, transport) and is held under AQAP-flow-down purchase orders with documented qualification.

What the document pack ships with

For a defense container contract executed under AQAP 2110, the document pack that ships with the units typically includes the following.

• Contract-specific Quality Plan, approved at contract start.
• Risk register, updated through the production cycle, closed at handover.
• Configuration management plan with as-built configuration record.
• Material certificates 3.1 (EN 10204) for primary structural steel.
• Welding documentation: WPS, PQR, and welder qualifications to EN ISO 9606.
• ISO 3834-2 welding production-level conformity statement.
• EN 1090-1 EXC2 declaration of performance for the steel structure.
• Surface preparation record to ISO 8501 Sa 2.5.
• Paint batch records and EN ISO 12944 protection class statement.
• FARO 3D measurement report for dimensional verification.
• CSC plate certification (where applicable) and ISO 6346 BIC code.
• Nonconformity log and corrective action records.
• Certificate of Conformity signed by the responsible quality manager.
• Bilingual (or multilingual) handover manual.
• CMR transport documentation on delivery.

This pack is assembled per unit and per contract. For framework agreements the per-unit set is harmonised against a master pack that is approved at framework award.

A buyer who receives a thinner pack than this should ask why. A supplier audited to AQAP 2110 should not be assembling the pack ad hoc; the pack should be a standard output of the QMS.

How to onboard a NATO-eligible supplier

For a prime contractor or a ministry procurement team that is bringing a new supplier into a NATO-relevant programme, the onboarding sequence typically runs as follows.

1. Identity verification. Confirm the supplier holds an NCAGE issued by NSPA or by their national NCB. Verify the code against the NSPA ePortal. Confirm the legal entity behind the code matches the supplier on the contract.

2. Certification verification. Request copies of AQAP 2110, ISO 9001, ISO 14001, ISO 3834-2, and any product-specific certifications relevant to the scope (for containers: EN 1090-1 EXC2, CSC certification). Verify against the issuing certification body. Check expiry dates.

3. Trade and export license verification. For European suppliers, confirm the national defense trade license is in place. For Slovakia this is the Slovak Defense Trade License issued under SK national regulations.

4. Capability audit. Conduct an on-site audit of the production facility. Walk the line. See the welding cells, the blast booth, the paint booth, the QA stations, the document control room. AQAP 2110 is a paper standard, but the paper has to reflect a real operation.

5. Reference verification. Ask for two or three reference programmes with comparable scope. Request permission to contact those references directly.

6. Sample document pack. Ask the supplier to produce a sample document pack from a recent comparable delivery. This is the single best check that the QMS produces what the standard requires.

7. Contract drafting. Once the supplier is approved, draft the contract with explicit flow-down of AQAP 2110 clauses, right of access for the GQAR, defined milestones for Quality Plan approval and inspection points, and clear acceptance criteria tied to the technical specification.

Tanax's standard NATO onboarding pack is structured to support each step of this sequence. The pack is available on request to procurement teams under NDA.

FAQ

What edition of AQAP 2110 does Tanax operate under? AQAP 2110:2017, Edition D. This is the current edition referenced by most NATO national procurement frameworks. Edition E is in publication; if and when it becomes the contractual baseline, Tanax will move to the new edition through the standard re-audit cycle.

Is AQAP 2110 the same as AQAP 2310? No. AQAP 2310 is the aviation, space, and defense supplier variant, aligned with AS/EN 9100. AQAP 2110 is the broader NATO design, development, and production standard. For container manufacturing AQAP 2110 is the applicable standard. AQAP 2310 is invoked separately when the scope touches certified airframe or avionics work.

Do I still need to require ISO 9001 if the supplier holds AQAP 2110? AQAP 2110 fully contains the ISO 9001 requirements, so a supplier audited to AQAP 2110 is implicitly meeting ISO 9001. That said, most defense contracts continue to require both as a paperwork formality, and most serious suppliers hold both certifications side by side. Tanax does.

What is a GQAR and how do I appoint one? A Government Quality Assurance Representative is the official quality representative appointed by the customer nation to verify a supplier's compliance with the contract. For Slovak MoD contracts the GQAR is appointed by the Ministry of Defense quality directorate. For multinational contracts the appointing nation depends on the STANAG 4107 mutual recognition arrangement.

What is the difference between an NCAGE and a CAGE? A CAGE is issued to US-based entities by the US Defense Logistics Agency. An NCAGE is issued to non-US entities, either by the supplier's national NCB or by NSPA where no national NCB exists. The format is identical (five characters alphanumeric) and the codes are mutually recognised across NATO procurement systems.

Can a NATO prime contractor place work with us under AQAP 2110 directly? Yes. Tanax holds NCAGE 4094M and is audited to AQAP 2110:2017. A NATO prime can place a subcontract directly, with AQAP 2110 flowed down through the standard contractual mechanism. Tanax also accepts GQAR site access as a standard contract clause.

How long does it take to onboard Tanax as a new supplier? From a first procurement enquiry to a signed framework, the typical onboarding window for a NATO-eligible buyer is six to twelve weeks. NDA can be signed in 24 hours. The full document pack, including AQAP 2110 certificate, NCAGE 4094M record, ISO certifications, and capability briefing, ships under NDA within a working week of request.

Who do I contact to start a NATO procurement conversation? English enquiries: [email protected] · +421 911 880 000. German enquiries: [email protected] · +421 904 494 124. The Bratislava office is at Červeňova 28, 811 03 Bratislava; production is at Partizánska 73, 957 01 Bánovce nad Bebravou.