Certifications for defence industry suppliers

ISO 9001 certification is the indispensable foundation for every supplier looking to enter the defence industry. Without a certified quality management system (QMS), admission to the supplier pools of major defence groups is practically impossible. The standard calls for process-oriented thinking, risk-based planning and continual improvement — principles that carry particular weight in the safety-critical defence industry.

• Documented processes: all quality-relevant procedures must be described, implemented and verifiable
• Risk management: systematic identification and assessment of risks in the supply chain and in production
• Supplier evaluation: your own suppliers must be assessed and monitored — the chain must not break
• Control of measuring equipment: all testing and measuring equipment must be calibrated and documented with traceability
• Management review: regular assessment of the QMS by senior management

The Allied Quality Assurance Publications (AQAP) are the NATO-specific quality standards that go beyond ISO 9001. They are monitored by the national quality assurance offices — in Germany by the Bundeswehr quality assurance offices (Güteprüfstellen, GüPrSt) of the BAAINBw. AQAP conformity is not a separate certification; it is required as part of the contract award and verified by the GüPrSt.

• AQAP 2110: quality assurance requirements for design, development and production — the most comprehensive level
• AQAP 2120: quality assurance requirements for production — where no design responsibility is held
• AQAP 2130: quality assurance requirements for inspection and final testing — the minimum requirement
• AQAP 2310: NATO requirements for quality assurance in software development
• Government Quality Assurance (GQA): state quality inspection by the quality assurance office — the client has right of access to the plant

Not every defence contract requires security clearance — but many do. As soon as a supplier is granted access to classified information (Verschlusssachen, VS), it must take part in the security clearance procedure. The Federal Ministry for Economic Affairs and Climate Action (BMWK) is responsible for security clearance in industry. The security screening applies both to the company and to individual employees.

• VS-NfD (restricted, for official use only): the lowest level, requiring a security clearance notice and internal classified information instructions
• VS-Vertraulich (confidential): requires an Ü1 security screening of the employees concerned
• VS-Geheim (secret): requires the extended Ü2 security screening, including interviews with the individual's contacts
• NATO classifications: NATO RESTRICTED, NATO CONFIDENTIAL, NATO SECRET — require an additional NATO security clearance agreement
• Facility Security Clearance: the company itself must obtain a security clearance notice from the BMWK

Suppliers of components or materials can also be affected by export control. The Foreign Trade and Payments Act (AWG), the Foreign Trade and Payments Ordinance (AWV) and the War Weapons Control Act (KrWaffKontrG) form the national framework. At EU level, the Dual-Use Regulation (EU) 2021/821 governs the export of dual-use goods. Suppliers must check whether their products are listed or are subject to an export restriction within the customer's end product.

• Export list (AWV Annex AL): the national list of goods requiring a licence — it also covers high-temperature materials and ceramics
• EU dual-use list (Annex I of Regulation 2021/821): the EU-wide harmonised list of goods with technical thresholds
• War weapons list (annex to the KrWaffKontrG): war weapons and their essential components — the highest licensing level
• Catch-all clause: even unlisted goods can require a licence if the user or the intended use is critical
• Internal Compliance Programme (ICP): the company's internal organisation for complying with export control regulations

Documentation requirements in the defence industry go far beyond what is usual in civil industry. Every material, every batch and every process step must be documented without gaps and remain traceable throughout the entire service life of the end product — often 30 to 50 years in the case of weapon systems.

• Inspection certificates to DIN EN 10204 type 3.1 or 3.2: material composition, mechanical properties, test results
• First article inspection report (FAIR) to AS9102 / VDA: complete measurement and documentation of the first production part
• Batch tracking: from the raw material supplier through to the installation point in the end product — no gaps permitted
• Deviation management: every deviation from the specification must be documented, assessed and released by the client
• Retention periods: at least 10 years, and for weapon systems often for the entire period of use (30+ years)