DALO's new supplier portal - A compliance agenda for European defence suppliers

Denmark's defence acquisition authority has published, in plain terms, what it expects of a supplier's quality management system. For companies entering Western supply chains, that publication is an opportunity rather than an obstacle.

At DALO Industry Days 2026, SKYLEN Group CEO Martin Holm-Petersen chaired and co-presented a compliance-focused agenda on the Danish Industry stage.

Thea Ballegaard Laursen of DALO opened the session with a presentation of the new supplier portal - the update to how DALO communicates its requirements to current and prospective suppliers to the Danish Defence. Rather than leaving suppliers to reconstruct expectations from individual tender documents, the portal consolidates them in one place: how DALO conducts procurement, what security clearance and information security involve, what quality management standards may apply, and what obligations follow once a contract is signed. For a company weighing whether it can realistically supply the Danish Defence, that consolidation turns a set of unknowns into a checklist.

Martin Holm-Petersen followed, setting out how ComplyTrain can accelerate compliance work and bring a company to the point of readiness at which it can step in as a DALO supplier.

The session made one thing evident. The requirements are not the key constraint; the time it takes to meet them is. What follows is an account of what DALO now asks for, why it asks for it, and what that means for suppliers entering European and NATO supply chains.

Across European procurement offices, capabilities that are combat-relevant, available and in several cases already field-proven are being set aside. Not because they fail on performance, but because the supplier cannot demonstrate a certified quality management system. At a point when rearmament is constrained by time rather than by intent, this is an expensive outcome - and an avoidable one.

The supplier portal: requirements published in advance

The portal Thea Ballegaard Laursen presented rests on a simple premise. DALO administers in the order of 1100,000 procurements each year and applies standardised processes across them in the interest of consistency, transparency and equal treatment of suppliers. The practical consequence for industry is that requirements are not negotiated company by company. They are published, and they are the same for everyone.

DALO's supplier portal on fmi.dk organises those requirements into two tracks. For prospective suppliers, it covers procurement procedures, foreign direct investment screening, information security, facility and personnel security clearance, quality assurance and standards, and advance payment. For suppliers already under contract, it covers invoicing and payment, packaging and labelling, NATO codification, and provisions on delay in delivery.

Read together, these pages constitute a specification of what it takes to be a credible supplier to a NATO member state's armed forces. Quality accreditation is one component of it, and it is the component most often left until too late.

What DALO states on quality

DALO's position is that defence procurement carries requirements ordinary commercial supply rarely does: quality, traceability, documentation and security of supply, sustained across the full life of a contract. Suppliers are therefore expected to operate robust quality management systems and to maintain processes capable of consistent, reliable production and delivery.

Depending on the nature of the contract and the complexity of the supplies or services, DALO may require compliance with recognised standards - ISO 9001, ISO 27001, the NATO Allied Quality Assurance Publications (AQAP), or AS/EN 9100 for the aerospace and defence sector. The stated purpose is to secure consistent quality, reduce the risk of systematic defects and support effective contract performance.

On AQAP specifically, DALO notes that these publications are used throughout NATO to establish a common framework for quality assurance in defence procurement, giving contracting authorities and suppliers a shared understanding of quality requirements. The disciplines addressed are process management, risk management, configuration management, traceability and continual improvement.

That list is not arbitrary. It maps directly onto what a contracting authority must satisfy itself about before it can commit public funds to an unfamiliar supplier.

Certification as an accelerant

The instinct in industry is to read accreditation as one more gate between a working product and a signed contract. The mechanism works in the opposite direction.

Where a procurement authority can rely on an independently verified quality management system, it can dispense with a substantial amount of first-principles diligence. It does not need to construct a bespoke assessment of whether processes are traceable, whether configuration is controlled, whether defects are systematically identified and closed. The certificate answers those questions in a vocabulary every NATO member recognises.

This is the strategic function of the standards. ISO 9001, as well as potentially a number of other ISO standards such as 27001, 14001, 31000, the AQAP publications and AS/EN 9100 exist so that a contracting authority and a supplier - frequently in different member states, with different regulatory traditions - can establish trust without beginning from zero. Accreditation compresses the trust-building phase, and compressed trust is what fast acquisition depends on.

DALO makes the point directly: accredited certification, including AQAP certification where relevant, supports efficient and transparent cooperation, and provides objective evidence that appropriate systems and procedures are in place. Where quality assurance forms part of selection or evaluation, certification may support DALO's initial assessment of a supplier's capability.

The Danish specificity: DANAK accreditation

One detail matters for suppliers planning their route. DALO refers to certificates issued by certification bodies accredited by DANAK, the Danish national accreditation body, as providing assurance that appropriate quality management procedures have been established.

Certification obtained through an accredited body is therefore not interchangeable with self-declaration or with a certificate of uncertain provenance. Suppliers building towards Danish and wider Nordic defence contracts should plan for accredited certification from the outset rather than treat it as a formality to be resolved later.

ISO 9001 as the foundation

ISO 9001 is the most widely applied quality management standard in the world. It answers a single question: does this organisation have a systematic, documented and repeatable means of delivering what it has committed to? It does not prescribe what an organisation produces; it governs how the producing system is run, so that quality is designed into processes rather than inspected in at the end.

The standard rests on seven principles - customer focus, leadership, engagement of people, a process approach, continual improvement, evidence-based decision-making and relationship management. The 2015 edition introduced a decisive shift towards risk-based thinking: anticipating failure modes and building controls in advance rather than responding after the fact. For a defence buyer, this is the substance of ISO 9001's value. A certified supplier is one whose output is the product of a controlled system rather than of individual effort on a given day.

ISO 9001 is also the base layer for everything above it. AS/EN 9100 and the AQAP publications both take it as their starting point and add sector-specific requirements. Achieving ISO 9001 is not a task separate from meeting NATO's expectations; it is the first stage of meeting them.

AQAP 2110: the NATO layer

AQAP 2110 - NATO Quality Assurance Requirements for Design, Development and Production - is the AQAP standard most suppliers encounter first. It sits within STANAG 4107, the agreement under which NATO nations mutually recognise one another's government quality assurance. That mutual recognition is precisely why a supplier certified in one member state can be relied upon across the Alliance, and why accreditation obtained in Denmark carries weight in Warsaw, The Hague or Vilnius.

AQAP 2110 does not replace ISO 9001. It presupposes it, using ISO 9000 definitions and expecting an ISO 9001-style management system to be in place. What it adds are requirements that matter acutely in a defence context:

• Configuration management - establishing precisely which version, build and specification each delivered item corresponds to, and controlling changes to it
• Risk management - formalised beyond ISO 9001's general risk-based thinking and applied across design, development and production
• Quality planning - documented plans setting out how quality will be assured for the specific contract
• Traceability - tracing materials, components and processes through the entire build
• Government Quality Assurance - the acquirer, or a government representative acting on its behalf, holds the right to verify conformity and access supplier processes prior to acceptance

For a supplier already holding ISO 9001, the move to AQAP is an extension rather than a rebuild. Where software is central to the capability, AQAP 2210 supplements 2110 with additional software quality assurance requirements.

What certification does not do

DALO is equally explicit on the limits. Certification does not replace contractual obligations, and it does not affect DALO's assessment of compliance with the requirements of an individual procurement or contract. Accreditation establishes that a supplier operates a controlled system; it does not discharge the specific commitments that system will be used to meet.

Suppliers should read this as a caution against treating a certificate as an end state. It is a qualification to compete, not a substitute for performance.

The cost of arriving late

The moment at which a defence force wants a capability is not evenly distributed in time. It arrives with an operational requirement, a budget line and a political window that will close. A supplier that is technically ready but not accreditation-ready arrives at that window unable to pass through it.

This is the real content of "we had to say no." The capability was real and the requirement was real. What was absent was the evidence that would have allowed the buyer to act on both. Unlike the capability itself, which may take years to develop, accreditation is a known, bounded and achievable piece of work.

For anyone bringing serious defence technology into European and NATO supply chains - newer entrants in particular, and technology emerging from active theatres such as Ukraine - the conclusion is uncomfortable but clarifying. Quality accreditation is not something to resolve after a contract is won. It is part of what makes winning possible. Building to ISO 9001 and AQAP from the outset, with certification through an accredited body, is not compliance overhead. It converts a procurement officer's interest into a procurement officer's signature.

DALO has now stated what it needs in order to say yes. The suppliers who act on that before the window opens, rather than after it closes, are the ones who will not have to be turned away.

Closing the gap faster

This was the argument Martin Holm-Petersen put to the Danish Industry stage. The obstacle for most defence-technology SMEs is not disagreement with the requirements. It is the elapsed time and internal capacity a first quality management system consumes - documentation written from scratch, processes formalised, evidence assembled, all while the engineering work continues. Consultancy-led implementation is available but slow and expensive, and it scales poorly across a sector that needs hundreds of suppliers qualified rather than a handful.

His contention is that the industry needs a different instrument, and that ComplyTrain is it. The platform takes companies through three stages: Map the applicable standards and identify the gap between current practice and what ISO 9001, AQAP and related requirements demand; Build the management system, documentation and process controls needed to close it; and Sustain the system so it remains audit-ready and continues to satisfy contractual obligations across the life of a contract. The purpose is to compress a process measured in years into one measured in months, and to make it repeatable across many companies at once.

Battle-proven is not the same as procurement-eligible. Bridging the two is a defined piece of work. Doing it at the scale European rearmament now requires - for DALO and for every other Western acquisition authority facing the same constraint - is what Martin Holm-Petersen argued the industry has yet to solve, and what ComplyTrain is built to solve.