Defense Quality in Ukraine: 3 Standards Every Defense Manufacturer Needs in 2026

Defense quality in 2026 rests on three standards that should be read as a sequence, not a menu of options. ISO 9001 is the foundation for any quality manufacturer, civilian or defense. Serious defense contracts don't start without it. AQAP 2110 is the defense overlay — NATO's specification for defense suppliers that adds configuration management, traceability, and government quality assurance representative (GQAR) oversight on top of ISO 9001. AS 9100 is a separate aerospace standard for makers of aircraft components, missile tech, and high-complexity UAVs.

The main takeaway: this isn't an either/or choice. A manufacturer in the defense industry in 2026 enters the market with ISO 9001 in 4-6 months, adds AQAP 2110 over the next 6-12 months, and only adds AS 9100 if the product demands it. The right order saves 20-30% of budget and roughly halves total implementation time compared to a parallel start. The rest of this article unpacks that logic, and the AQAP 2110 vs ISO 9001 comparison goes deeper on the overlay mechanics.

In 2022-2023, the Ukrainian defense sector ran in volunteer-surge mode: quick prototypes, small batches, direct deliveries to units with little formalization. In 2024-2025 the market shifted into industrial scale — Brave1 grew from dozens of startups to hundreds, DOT (defense procurement contract) became the main channel for serial supply, and foreign customers from Poland, Lithuania, Canada, and the UK started signing direct contracts with Ukrainian manufacturers. By 2026 the volunteer logic no longer scales. A customer ordering 10,000 units of hardware can't accept the product without a certified quality management system.

The numbers confirm the shift. According to Brave1, by late 2024 the cluster held around 1500 developments; by 2026 more than 400 manufacturers had reached serial contracts. Of those, industry estimates put fewer than 20% on a certified quality system (ISO 9001 or higher) — and that minority captures the lion's share of export deals. The rest hit qualification filters in NATO tenders and never even reach the commercial price discussion.

Financing is another driver. European Defence Fund grants, EBRD credit lines for defense projects, and investment rounds from Western defense-tech funds increasingly include certified quality as a mandatory due-diligence requirement. A manufacturer without ISO 9001 in 2026 won't pass even the first screen of a serious investor. In practice we see companies without a basic certificate lose the chance to raise $5-15 million rounds over a single tick-box in the fund's checklist.

Add security context. Defense exports from the US, UK, and EU sit under strict ITAR/EAR controls, and getting end-user certification in a partner country without a certified quality system is nearly impossible. A manufacturer who wants to sell components to Poland or Lithuania for joint armament programs hits the same threshold — either you have recognized quality or export stays a theory.

Finally — NATO compatibility. Ukraine has officially followed NATO procurement standards since 2020. In 2025-2026 DOT is systematically rewriting tender documentation against requirements that mirror AQAP 2110 exactly, referencing the NATO Standardization Office catalog. Companies that prepared early get contracts; those who thought 'I'll catch up later' lose 6-9 months on re-tenders and watch key engineers move to certified competitors.

ISO 9001 is the international quality management standard issued by ISO (Geneva). It contains nothing defense-specific: the same requirements apply to a drone manufacturer, a baby food plant, and an IT company. That universality is exactly what makes ISO 9001 the base — it answers the question 'how does your company work' through a process approach, risk analysis, document control, supplier management, and CAPA.

Why does everyone start here? A simple practical argument: 70-80% of AQAP 2110 requirements and roughly 60-70% of AS 9100 requirements are essentially ISO 9001 with small extensions. If you implement AQAP 2110 without a working ISO 9001 base, you're building the foundation and the second floor at the same time. The team drowns under the double load, documentation comes out shallow, and the auditor finds major non-conformities in both layers.

Who issues ISO 9001? A certification body (CB) accredited through IAF MLA — for Ukraine this means international recognition, not just national accreditation. The certificate is issued for 3 years with annual surveillance audits. In practice ISO 9001 gives a defense manufacturer three things: the right to bid in tenders with a 'certified QMS' qualification threshold, the base for further defense overlays, and operational transparency that cuts scrap and returns by 10-20% in the first year.

For a mid-size defense manufacturer (50-200 employees, one production site) the typical ISO 9001 implementation budget is $10-25k over 4-6 months from diagnostic to certificate. That covers consulting, documentation, internal auditor training, and the certification audit at the CB. A 10-20 person startup can hit $5-12k in 3-4 months, but that's working at the limit without trimming process scope.

For a deeper dive into the standard itself, see the ISO 9001 complete guide, which covers all 10 clauses of requirements, common implementation mistakes, and the differences between ISO 9001:2015 and the Ukrainian national edition DSTU ISO 9001:2015.

AQAP 2110 — Allied Quality Assurance Publication 2110 — is NATO's quality standard for defense suppliers. The current edition is Edition D Version 1 (2016), unchanged as of 2026. If ISO 9001 is the base floor, AQAP 2110 is the defense overlay that adds eight key blocks: organizational context with defense focus, reinforced leadership, defense contract risk management, mandatory configuration management (per ACMP-2100), extended traceability, document and change control, CAPA with formal root cause analysis, and internal audits with separate AQAP competence.

The key node is configuration management and traceability. This is what ISO 9001 doesn't carry in such strict form. Under AQAP 2110, every product modification (from a chip swap to a firmware change on an FPV drone) gets formal registration, approval, and updated documentation. Traceability works both ways: you must be able to find which units received a given battery batch, and conversely — which components went into a specific airframe. Without this the certificate isn't issued, and in real operations you can't run a recall or incident investigation.

Who needs AQAP 2110: UAV manufacturers (from FPV to reconnaissance and strike), UGV and unmanned surface vessel makers, NATO-caliber ammunition producers, EW and communication system makers, MRO centers working with Western kit (Leopard, IRIS-T, Patriot), EMS shops producing electronics for defense, and tactical component manufacturers — optics, gyroscopes, batteries. In 2026 this list covers practically the entire active Ukrainian defense industry.

The link to the state customer through DOT is a separate story. Ukraine's Ministry of Defense has been rewriting tender documentation since 2024 toward a NATO-compatible model where AQAP 2110 is effectively a qualification threshold for contracts above a certain volume. By 2027-2028 the transition will complete.

The detailed deep-dive is the AQAP 2110 complete guide. For budget and timeline calculations, see AQAP 2110 cost and timeline. And for how exactly AQAP 2110 differs from the base quality standard, see the AQAP 2110 vs ISO 9001 comparison.

AS 9100 is the IAQG (International Aerospace Quality Group) standard for the aerospace industry. The current edition is AS 9100D (2016), with the European edition EN 9100:2018. The standard is wider than AQAP 2110: it covers civil aviation, space technology, and military aviation in one document. It builds on ISO 9001:2015 with extra aerospace requirements: first article inspection (FAI), FOD (foreign object debris) control, reinforced supplier control, special processes (welding, heat treatment), and critical part management.

How is AS 9100 different from AQAP 2110? Two different logics. AQAP 2110 is NATO defense contracts, with emphasis on configuration and GQAR oversight. AS 9100 is aerospace quality, with emphasis on technological discipline and flight safety. A manufacturer making a tactical FPV drone under 25 kg doesn't need AS 9100. A manufacturer making navigation equipment for a Bayraktar-tier MALE/HALE UAV, or missile components — definitely does.

Categories of Ukrainian manufacturers for whom AS 9100 is genuinely relevant in 2026: aircraft component makers (engines, avionics, hydraulics), satellite communication (satcom) developers, military-grade navigation equipment producers, companies entering contracts with European aerospace (Airbus Defence, Leonardo, MBDA), and missile tech makers. For a small FPV producer AS 9100 is a wasted investment that eats 4-8 months and $10-25k with no visible return.

The IAQG 9137 guidance document (available on IAQG.org) explains how to integrate AQAP 2110 into an AS 9100 system — this is the key reference for manufacturers needing both standards together. In that case you add AQAP 2310 (the defense extension to AS 9100), and the whole quality architecture holds inside one system.

In short: AS 9100 is a premium standard that pays back only on contracts of several million euros with an aerospace or high-tech defense customer. For the rest of the defense industry, ISO 9001 + AQAP 2110 is enough.

Across hundreds of defense projects a clear three-phase model emerges. It saves time, budget, and the quality team's sanity.

Phase 1 (months 0-6): ISO 9001 — for everyone, no exceptions. This is the starting contract with yourself: build the foundation. Budget $10-25k, timeline 4-6 months. The certificate unlocks the first tenders with a 'certified QMS' qualification threshold and creates the base for AQAP 2110. Trying to skip this phase and jump straight into AQAP is the most common mistake we see in manufacturers who want to 'do everything in one audit.'

Phase 2 (months 6-18): AQAP 2110 — for NATO-compatible supply and DOT. Added onto the working ISO 9001 base. Budget $15-40k extra (with 20-30% combined-audit savings against ISO 9001), timeline 6-12 months. The output is a combined ISO 9001 + AQAP 2110 certificate covering civil customers and defense customers at the same time. For many manufacturers the roadmap closes here — two standards last 5-10 years of growth.

Phase 3 (months 18-36): AS 9100 — only for aerospace complexity. Added as a third layer when the product hits a class where aerospace quality is required. Budget $10-25k extra, timeline 4-8 months. Paired with AS 9100 you add AQAP 2310 instead of standalone AQAP 2110, because the architecture is now integrated.

Alongside the phases, read practical material — drone manufacturer certification walks through how this map unfolds specifically for the drone segment, and the MoD customer audit tells you what to expect from the state customer during a real inspection. If you want one contractor to walk you through all three phases, management system implementation covers that model with budget spread across phases.

Ekontrol has been a Bureau Veritas partner in Ukraine since 2014. Since 2022 the team has focused on the defense segment as its main direction: we've supported dozens of ISO 9001, AQAP 2110, and AS 9100 implementations for drone, ammunition, optics, and communications manufacturers. The integrated approach means we build one quality management system instead of three disconnected projects, then layer defense overlays and aerospace extensions on top. That saves 20-30% of total budget compared with parallel or sequential work with different contractors.

The engagement model is staged: a diagnostic audit over 3-5 days at the start gives a realistic gap assessment and budget. Then implementation by phases: ISO 9001 first (4-6 months), then AQAP 2110 as an overlay (6-12 months), and AS 9100 if needed (4-8 months). Certification audit support includes a pre-audit by our consultants two weeks before Stage 2, our presence at the audit itself, and help responding to non-conformities. After the certificate is issued — annual support for surveillance audits and keeping the system operational.

Why combined certification delivers 20-30% savings is detailed in the AQAP 2110 vs ISO 9001 comparison. Short version: the auditor's time is paid once, not twice; documentation is prepared once with sections for defense blocks; internal auditors are trained simultaneously for both standards.

Real Ekontrol experience in the defense segment 2022-2026: makers of tactical UAVs, strike drones, counter-drone systems, tactical radios, optical sights, FPV interceptors, NATO-caliber ammunition, and MRO centers for Western kit. All these projects ran variations of the same three-phase model, adapted to the specific product and market niche. If you want to talk through your specific roadmap — book a 30-minute session and walk away with a budget, timeline, and priority assessment.

We've collected answers to the questions most often heard from defense manufacturers on the first call. If yours isn't here, a consultation takes 30 minutes — we'll add it to the next revision.