Certification for Ukrainian Drone Manufacturers: ISO 9001, AQAP 2110, and MoD Requirements — A 2026 Roadmap

Drone manufacturer certification in Ukraine in 2026 comes in three tiers, and the choice depends on who you're supplying. For the first serial contracts with DOT (Defense Procurement Agreement) and direct purchases by Ukrainian Armed Forces units, the minimum is ISO 9001. For NATO-compatible supply (NATO member MoDs, NSPA, Bundeswehr or DCMA prime contractors), AQAP 2110 on top of ISO 9001 becomes mandatory. For high-complexity UAVs with avionics, navigation systems and satellite communication channels, AS 9100 — the aerospace standard — gets added.

State registration of UAVs in Ukraine (notification or permit procedure at the State Aviation Service) is a separate technical track, not a quality certification. People confuse it with ISO certification, but they're parallel processes that don't replace each other.

For a startup just transitioning from volunteer deliveries to serial production, the pragmatic path is ISO 9001 first, AQAP 2110 as an add-on in 6-12 months, and AS 9100 only if you're genuinely entering the MALE/HALE aviation class or exporting into European aerospace. More about the Ukrainian market — defense industry.

The Ukrainian drone sector went through a 2024-2026 transformation that took decades in other countries. From volunteer FPV-kit assembly projects in 2022-23 — to industrial production sites with 200-500 staff manufacturing 5,000-15,000 systems per month. According to Brave1, the cluster registered over 1,500 companies as of 2026, around 200 of which are already running serial MoD contracts.

The rules of the game shifted. Earlier, customers looked at functional drone specs: range, payload, flight time. Now they look at two additional things — can you repeat yesterday's batch next month without surprises? And can you show that the drone shot down in Avdiivka was assembled from the same components that were tested in Kyiv three months ago? These are questions of traceability, quality control, documentation — the same things ISO 9001 formalizes and AQAP 2110 reinforces.

The second reason is money. A manufacturer winning a 10,000-unit DOT contract has to show the bank or investor that production is a systemic process, not a heroic team effort. Without certification, getting working capital under such a contract is nearly impossible. A typical case: a company wins a UAH 50 million tender but can't get a credit line for component purchases — because there's no ISO 9001 in the portfolio. The contract falls apart.

The third reason is exports. European and American buyers have actively sought trusted Ukrainian partners since 2025 — they don't have domestic manufacturers of strike FPVs and drone interceptors, and Ukrainian solutions cost 3-5 times less than direct analogues. But without AQAP 2110, the doors to NSPA, DCMA, and national MoDs stay shut. A real pattern: a couple of companies grew from 30 staff to 250 in 18 months, getting their first AQAP 2110 right as they moved from 10,000 to 50,000 units per year. That's not certification magic — it's access to contracts that wouldn't exist otherwise.

ISO 9001 isn't a tender-checkbox document, it's an operational architecture for production. For a drone startup transitioning from maker-format to industrial serial production, ISO 9001 is the cheapest way to organize processes that grew organically. Why it's the foundation: AQAP 2110 and AS 9100 are both add-ons over ISO 9001, and without a working base, there's nothing to layer defense blocks onto.

What ISO 9001 gives drone production in practice. First, mapped responsibility — who accepts components, who controls soldering, who signs off the finished batch. In startups this often blurs. Second, change control on the design — every chassis, board, firmware change gets registered instead of drifting silently. Third, batch traceability of components: you know which batteries went into which drone batch, and if a complaint comes tomorrow, you localize the root cause fast.

Timelines and budget for a typical 15-50 person startup. Implementing ISO 9001 from scratch — 3-4 months. Full-cycle budget (consulting + training + pre-audit + certification body) — from $8,000 to $18,000. That's less than the cost of losing a single mid-size contract because of poor traceability. Details — in the complete ISO 9001 guide.

How to start minimally — a staged model. Don't try to write 50 procedures and 200 forms up front. Order a readiness diagnostic audit — 3-5 days, we fix the real gaps. Based on the report, we implement only what's needed: 8-12 key procedures, 5-7 record forms, a minimal quality policy. The rest of the documentation builds out after the first audit, when you can see where it actually hurts.

AQAP 2110 is a defense overlay on ISO 9001, issued by the NATO Standardization Office. For a drone manufacturer, this is the moment the market shifts from Ukrainian to NATO-compatible: DOT reformats tenders under NATO STANAG 4107, NSPA incorporates AQAP as a mandatory qualification, and Bundeswehr and DCMA primes don't talk to suppliers without the certificate. The standard is published by the NATO Standardization Office and recognized across 26 Alliance countries through the mutual government quality assurance recognition agreement.

What AQAP 2110 adds on top of ISO 9001 specifically for a drone manufacturer. First, full configuration management per the ACMP-2100 model — every modification to an FPV-drone or UGV chassis, board, firmware gets registered, approved, and versioned. That means the drone version shipped in July is documentationally different from the November version, and that difference is transparent to the customer. Without CM you ship 'the same drone type' but actually it's a different one every time, and that's an instant fail at the first audit.

Second, reinforced traceability. Serial numbers on boards, lot tracking on batteries, firmware tied to a specific tail number. For makers of strike FPVs and drone interceptors this is critical — if a batch of components turns out defective tomorrow, you have to quickly find which 500 drones it went into. Without AQAP-grade traceability you're recalling the whole month's batch at best, and shipping unreliable products to the front at worst.

Third, integration with the state customer. The standard contains a GQAR section — the Government Quality Assurance Representative who has the right to come to your production and audit the process. In DOT contracts this is gradually becoming standard practice. If your processes aren't ready for a GQAR audit, deliveries get blocked.

Who needs AQAP 2110 especially badly in the drone segment: makers of drone interceptors (where reliability is a matter of life), makers of mid- and long-range strike UAVs, makers of unmanned ground vehicles (UGVs), and uncrewed surface vessels (USVs). If you build FPV kits for volunteer supply — not yet on the agenda. More about the standard itself — in the complete AQAP 2110 guide.

AS 9100 is the aerospace quality standard from IAQG (International Aerospace Quality Group), current edition AS 9100D / EN 9100:2018. It's built on ISO 9001 and adds aerospace-specific requirements: control of critical flight characteristics, reinforced traceability of aerospace components, and special risk management procedures for safety-critical systems.

When AS 9100 is needed by a drone manufacturer. In three specific scenarios. First — you build high-complexity UAVs with proprietary avionics (inertial navigation, satcom channel, complex autopilot logic) that approach piloted aircraft by design. MALE (Medium-Altitude Long-Endurance) and HALE (High-Altitude Long-Endurance) classes clearly fall here. Second — you make standalone aviation components (engines, navigation modules, controlled optical stations) that you supply to other aviation manufacturers. Third — you're entering the European aviation market, where AS 9100 is the de-facto admission ticket.

How AS 9100 coexists with AQAP 2110. The IAQG 9137 document describes how to integrate AQAP 2110 defense requirements into an existing AS 9100 QMS. For a manufacturer working with both military aviation and NSPA, the typical configuration is AS 9100 + AQAP 2310 (the defense add-on to AS 9100). Certification runs in parallel through one audit, which saves 25-35%.

Does a small FPV manufacturer need AS 9100? Usually no. This is an aerospace-class standard that demands separate documentation discipline and costs noticeably more than AQAP 2110. If you build tactical drones under 25 kg takeoff weight without complex avionics, AQAP 2110 covers the needs, and AS 9100 will be overkill for budget and team.

In practice, a drone startup doesn't move in one leap but in three stages over 2-3 years. Each stage has its certificate, its budget, its customer set. Let's lay it out realistically.

The team emerges from a maker format or from FPV-kit assembly in volunteer projects. First serial orders come from Ukrainian Armed Forces units or via DOT for 1,000-5,000 units. At this stage, ISO 9001 gets implemented — that's 3-4 months of work and $8,000-18,000 in budget. The certificate opens access to serial tenders and to bank financing for working capital. Without it, every next contract becomes a lottery.

The company grew to 50-150 staff, UAH 30-100 million annual turnover, serial DOT contracts. At this stage, AQAP 2110 gets added as an overlay on a working ISO 9001. Time — 3-5 months, budget — $17,000-35,000 for the full cycle. What changes at this stage: full configuration management gets launched, component traceability gets reinforced, a separate competence program for AQAP internal auditors gets built. Budget and timeline details — in AQAP 2110 cost and timeline. This is the stage when doors to export and NSPA first open.

The company runs with 200+ staff, has several sites, UAH 100-500 million annual turnover. Direct contracts with NATO member MoDs, framework agreements with NSPA, talks with European aviation OEMs. At this stage, AS 9100 gets added (if the product moves into the aviation class) or AQAP 2210 (if a significant part of the product is SW and firmware). Time — 4-6 months, budget — $25,000-50,000 as an add-on. This is the premium segment that pays off only on contracts of millions of euros. The management system implementation service at this stage often includes multi-site coordination setup and integration with Western OEM requirements.

Over three years of work with the defense segment, we see the same mistakes from drone teams. Each one costs months of time or tens of thousands of dollars — and they're all preventable.

1. 'A certificate is just paperwork.' A classic trap for engineering-heavy teams. They order 'audit documents' from a consultant, expect to get a PDF and pass. In a real AQAP 2110 audit, the auditor doesn't ask 'what's written' but 'what do you do.' If the documentation doesn't reflect the real process — that's a critical nonconformity, certification refusal. A certificate confirms that the process works, not that the documents exist.

2. Jumping past ISO 9001 straight to AQAP 2110. The logic: 'we need AQAP, why pay twice.' In practice — fail at Stage 2. Without a working ISO 9001 base, there's nothing to layer defense overlays onto. The team drowns implementing the base and the overlay system simultaneously, and budget and timeline blow up 2x.

3. Weak component traceability. In drone production this is critical but often ignored until the last moment. Batteries without lot numbers, boards without serials, firmware without clear versioning. When the auditor asks 'show me which 100 drones this battery batch went into' — the team can't answer. This is an AQAP 2110 foundation that needs to be raised from day one of the project, not a week before the audit.

4. Gap between engineering process and the official document. Engineers know how to assemble a drone. The document describes a different process that nobody follows. In an audit this shows up in 5 minutes — the operator interview diverges from the instruction. The cure is parallel mapping of the real process and adjusting documentation to reality, not the other way around.

5. Underestimating team time during rapid scaling. A startup grows from 30 to 150 people in 6 months and tries to certify in parallel. There's no time for training, documentation lags real processes, every new hire adds chaos. The real advice — pass the base ISO 9001 certification before the rapid scale moment, and add AQAP after headcount stabilizes.

Ekontrol has worked as Bureau Veritas's partner in Ukraine since 2014. Since 2022 the team has focused on the defense segment — and drone manufacturers make up a significant part of the project portfolio. We've supported ISO 9001 and AQAP 2110 implementations at makers of FPV serials, interceptors, unmanned ground vehicles, and uncrewed surface vessels. Bureau Veritas is one of the few global certification bodies with accreditation recognized by NATO MoDs; details — on the BV AQAP page.

The engagement model is staged, so the budget spreads across the project rather than demanding an upfront payment for everything. The first step is a readiness diagnostic over 3-5 days — you see a realistic budget, timeline, risks. Next — management system implementation with drone-specific focus: configuration management for FPV/UGV, lot tracking for batteries, firmware versioning. After the certificate is issued — annual support for surveillance audits and keeping the system in working condition.

Why this works for the drone segment specifically: we understand the difference between a tactical FPV and a mid-range strike UAV, we know DOT requirements and the rhythm of working with NSPA, and we have experience integrating AQAP 2110 into fast-growing teams without halting production. The first 30-minute session is free, run as a diagnostic call with a drone focus.