AQAP 2310
AQAP 2310 quality management for defence suppliers
Aviation, space and defence suppliers bidding for or delivering NATO contracts that require a quality management system the acquirer can accept.
AQAP 2310 sets NATO's quality management requirements for aviation, space and defence suppliers. ComplyTrain ships its requirement tree and a Quality Plan built to AQAP 2105, with the evidence already assembled.
ComplyTrain fully supports this standard
What AQAP 2310 is
AQAP 2310 is NATO's quality management system requirement set for suppliers in the aviation, space and defence sectors. It carries 20 requirements, and it is written on the assumption that the acquirer will look inside your management system rather than take its existence on trust.
The clause that changes how you prepare
Section 4.2 gives the acquirer and their Government Quality Assurance Representative the right to reject the quality management system itself, and requires objective evidence to be readily available. Those two words carry the weight. Evidence that exists but takes three days to assemble is not readily available, and a system that cannot show its own operation on request is rejectable independently of whether the product is good.
Section 5.4, product realisation and the objective evidence behind it, holds ten of the twenty requirements. Half of AQAP 2310 is about being able to show what you did.
What it requires underneath
Section 4.1 requires a quality management system compliant with AS9100 rev D or EN9100:2018. It does not require third-party certification against them. That distinction is worth knowing before you buy a certification programme you were not asked for: what the acquirer needs is a compliant system and the evidence of it, which is a different purchase from a certificate.
Who needs it
Aviation, space and defence suppliers delivering under a contract that invokes AQAP 2310, and sub-suppliers to whom a prime has flowed it down. It travels with contracts where the acquirer's assurance rests on the supplier's management system rather than on inspection alone.
How ComplyTrain helps you meet it
The AQAP 2310 requirement tree and document set are prebuilt and ship with the standard. The centrepiece is a Quality Plan built to AQAP 2105, the NATO quality plan standard, whose sections are mapped to 16 of the 20 requirements.
- All 20 requirements by clause, with criticality, and the evidence attached to each - Requirements Management
- A Quality Plan template built to AQAP 2105, mapped across most of the standard - Document Control
- Procedures for configuration management, external provider control, internal audit, nonconforming product, root cause analysis and corrective action, and risk management - Document Control
- A Certificate of Conformity form and a GQA readiness checklist - Document Control
- GQAR and acquirer complaints handled as tracked customer complaints with root-cause responses - QMS
- Risk management as a live framework rather than a document, which section 5.6 expects - Risk Management
Because evidence has to be readily available rather than merely retained, the useful property is not storage but connection: each requirement points at the documents and records that satisfy it, and gap analysis over the tree shows what is unevidenced before somebody else finds it.
ComplyTrain holds no certification against AQAP 2310, AS9100 or EN9100. It is the system you build and run your own compliant quality management system in.
Questions
Do we need AS9100 certification to satisfy AQAP 2310?
No. Section 4.1 requires a quality management system compliant with AS9100 rev D or EN9100:2018, but it explicitly does not require third-party certification against them. You need a compliant system and the evidence that it operates. Whether you also pursue certification is a commercial decision, not an AQAP 2310 obligation.
Can the acquirer really reject our quality management system?
Yes. Section 4.2 provides for it, and requires objective evidence to be readily available. In practice rejection follows from not being able to show the system working when asked, which is why the difference between evidence that is retained and evidence that is connected to the requirement it satisfies matters so much.
What is AQAP 2105 and why does the Quality Plan matter this much?
AQAP 2105 is the NATO standard for quality plans. In AQAP 2310 the Quality Plan carries most of the weight: its sections map to 16 of the 20 requirements. Getting the plan right is the majority of the work, which is why ComplyTrain ships a template built to AQAP 2105 rather than a blank document.
How are GQAR complaints meant to be handled?
As customer complaints, in the same register, with root cause analysis in the response and corrective actions tracked to closure. Section 5.5 expects the complaint register to include GQAR and acquirer complaints rather than keeping them in a separate channel, and the responses to show root-cause content rather than acknowledgement.
Can AQAP 2310 credit work we have already done for ISO 9001?
Not automatically, and ComplyTrain does not present it as though it does. The standards overlap in substance, and the same evidence often serves both, but cross-standard credit is not something we claim on your behalf. Each requirement is evidenced in its own right.
How much is prebuilt?
The requirement tree and every document template ship with the standard, approved and mapped to the requirements they satisfy. You provide scope, your own content and your evidence. Provisioning is done by our team rather than self-served, so the standard arrives switched on and complete.
The process
Building a quality management system the acquirer will accept
AQAP 2310 is judged on whether your system can show its own operation on demand. These are the four things that decide that.
Scope it and plan it
Record which requirements apply and why, then build the Quality Plan. Because AQAP 2105 sections map across most of the standard, the plan is the spine of the whole submission rather than one document among many.
Put the supporting procedures in place
Configuration management, external provider control, internal audit, nonconforming product, corrective action and risk management each have a template built to the requirement they satisfy, approved by a named person in your organisation.
Make the evidence readily available
Attach approval records, acceptance criteria and external provider approvals to the requirements they evidence. Readily available is the test in section 4.2, and it is a property of how evidence is connected, not of where it is stored.
Close the loop on complaints and findings
Complaints from the GQAR or the acquirer belong in the same register as customer complaints, with root cause analysis and corrective actions tracked to closure. The shipped NATO CAPA workflow is built for exactly this path.